Edit tour

Windows Analysis Report
free-youtube-downloader_setup_full384.exe

Overview

General Information

Sample name:	free-youtube-downloader_setup_full384.exe
Analysis ID:	1431869
MD5:	e7d83f875043ece6f2fdb16ec9485ebd
SHA1:	f87e5cae97c621a489ed19a6d6a7a399dad17170
SHA256:	1c019635706305028548ec6fae8e8076c36857d6fd532f6461a6f5ac5676f140
Infos:

Detection

Score:	32
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	36
Range:	0 - 100

Signatures

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Excessive usage of taskkill to terminate processes

Modifies Internet Explorer zone settings

Sigma detected: Execution from Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory with a write watch (potentially for evading sandboxes)

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to delete services

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found iframes

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries keyboard layouts

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Analysis Advice

Sample is a service DLL but no service has been registered

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Contains functionality to modify the execution of threads in other processes

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Process Tree

System is w10x64

free-youtube-downloader_setup_full384.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe" MD5: E7D83F875043ECE6F2FDB16EC9485EBD)

NFWCHK.exe (PID: 3264 cmdline: C:\Users\Public\Documents\Wondershare\NFWCHK.exe MD5: 10A678F6B41D513E27FAC510F4368A32)

conhost.exe (PID: 2472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

free-youtube-downloader_full384.exe (PID: 8084 cmdline: "C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\" MD5: E1F9B186653025CDA1496212A7F57114)

free-youtube-downloader_full384.tmp (PID: 8104 cmdline: "C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp" /SL5="$1401F6,39165086,132096,C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\" MD5: 6534DC07A839274161DB6F77BF18B631)

taskkill.exe (PID: 8144 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM ScreenCapture.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8160 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM RegFloatButton.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8176 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM PluginInstallForExe.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5480 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM BrowserPlugInHelper.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1352 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM URLReqService.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7128 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM WsConverter.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5040 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM WsMediaInfo.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 648 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM DriverInstall.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2840 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM PluginInstaller.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2996 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM CreateLib.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2188 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM FreeYouTubeDownloaderUpdateHelper.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2260 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM kv_dr.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6012 cmdline: "C:\Windows\system32\taskkill.exe" /F /IM sniffer.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2692 cmdline: "C:\Windows\system32\TASKKILL.exe" /F /IM FreeYouTubeDownloader.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7876 cmdline: "C:\Windows\system32\TASKKILL.exe" /F /IM iexplore.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7888 cmdline: "C:\Windows\system32\TASKKILL.exe" /F /IM URLReqService.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4420 cmdline: "C:\Windows\system32\TASKKILL.exe" /F /IM DelayPluginI.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 368 cmdline: "C:\Windows\system32\TASKKILL.exe" /F /IM pluginInstall.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1784 cmdline: "C:\Windows\system32\TASKKILL.exe" /F /IM BrowserPlugInHelper.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3588 cmdline: "C:\Windows\system32\TASKKILL.exe" /F /IM PluginInstallForExe.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Wondershare Helper Compact.exe (PID: 7972 cmdline: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe" /VERYSILENT MD5: 44E68F722BBF4530E230B930655DCBD9)

Wondershare Helper Compact.tmp (PID: 7992 cmdline: "C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp" /SL5="$204C4,2101139,54272,C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe" /VERYSILENT MD5: 8AA8C628F7B7B7F3E96EFF00557BD0BF)

WSHelper.exe (PID: 5592 cmdline: "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" /regserver MD5: DB67E9196605D61D8278E5278777C71F)

CreateLib.exe (PID: 4500 cmdline: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe" -add "Free YouTube Downloader" -folders "" -icon "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe" MD5: 8275F3D5425BDEF42556720384B1F98F)

conhost.exe (PID: 5844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

URLReqService.exe (PID: 7540 cmdline: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe" /regserver MD5: A38CD36F5280A0F2693AA53F71656635)

KVYDUrlProtocol.exe (PID: 6316 cmdline: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe" MD5: 47399B65BC25F6E74E32ED5C658B2B08)

PluginInstaller.exe (PID: 6492 cmdline: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe" -i MD5: E0580B7F660E5A4D0B8191A9CC2475AE)

conhost.exe (PID: 6580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

KVYDUrlProtocol.exe (PID: 6780 cmdline: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe" "register" "Allmytube" "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe" MD5: 47399B65BC25F6E74E32ED5C658B2B08)

chrome.exe (PID: 1732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1832,i,1599047514705652765,13031441271017139671,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-80KG4.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-5QFBO.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-KSIMO.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-4J6FD.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-RFB4B.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000039.00000000.2589975690.0000000000401000.00000020.00000001.01000000.00000023.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000035.00000000.2547642375.0000000000401000.00000020.00000001.01000000.0000001A.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000033.00000003.2560443028.0000000002920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author
57.0.KVYDUrlProtocol.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
51.3.Wondershare Helper Compact.tmp.2920000.3.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
53.0.WSHelper.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
51.3.Wondershare Helper Compact.tmp.2920000.3.raw.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, CommandLine: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, NewProcessName: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, OriginalFileName: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, ParentCommandLine: "C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe", ParentImage: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe, ParentProcessId: 6880, ParentProcessName: free-youtube-downloader_setup_full384.exe, ProcessCommandLine: C:\Users\Public\Documents\Wondershare\NFWCHK.exe, ProcessId: 3264, ProcessName: NFWCHK.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\ASHelper.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp, ProcessId: 8104, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wondershare Helper Compact.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp, ProcessId: 8104, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1208

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Cryptography

Source: is-B787M.tmp.8.dr

Binary or memory string: rsaPublicKeyPEM = '''-----BEGIN PUBLIC KEY-----

memstr_f5f2874e-0

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

EXE: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Jump to behavior

Phishing

Found iframes

Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-WRMX62N
Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-WRMX62N
Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: Iframe src: https://cdn.consentmanager.net/delivery/crossdomain.html
Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/1004581587?random=1714076772858&cv=11&fst=1714076772858&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: Iframe src: https://td.doubleclick.net/td/rul/578746000?random=1714076772866&cv=11&fst=1714076772866&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1

HTML title does not match URL

Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install

HTTP Parser: Title: How to Use WondershareFree YouTube Downloader does not match URL

Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: No favicon
Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: No favicon
Source: https://td.doubleclick.net/td/rul/1004581587?random=1714076772858&cv=11&fst=1714076772858&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1	HTTP Parser: No favicon

Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: No <meta name="author".. found
Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: No <meta name="author".. found

Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: No <meta name="copyright".. found
Source: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install	HTTP Parser: No <meta name="copyright".. found

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

EXE: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Jump to behavior

Uses 32bit PE files

Source: free-youtube-downloader_setup_full384.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Window detected: Installation folder:C:\Program Files (x86)\Wondershare\Free ...ChangeWondershare License AgreementJoin Wondershare's customer experience improvement plan.Accept and Install

Creates install or setup log file

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PluginInstaller.exe.log

PE / OLE file has a valid certificate

Source: free-youtube-downloader_setup_full384.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49769 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: free-youtube-downloader_setup_full384.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: D:\CI\jenkins\workspace\Git-DownloadCore\VideoDownloader\win\PDB\Release\URLReqService.pdb source: URLReqService.exe, 00000038.00000000.2589657000.0000000000E12000.00000002.00000001.01000000.00000022.sdmp, URLReqService.exe, 00000038.00000002.2591192690.0000000000E12000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: D:\CI\jenkins\workspace\AgileTrans\Src\SymbolTable\Release\ImageProc.pdb`eI source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003B4F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WorkFolder\ID3Info\ID3InfoSolution\Newtonsoft.Json\tags\6.0.3\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: PluginInstaller.exe, 0000003A.00000002.2619694009.0000000004DC2000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: E:\svn_code\MemberCenterClient\Trunk\Src\English_Release\AutoDownloader_en.pdb source: free-youtube-downloader_setup_full384.exe
Source:	Binary string: D:\Enlistments\WPFOOB\src\wpfoob\WindowsApiCodePack\Main\Win7\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb@ source: CreateLib.exe, 00000036.00000002.2587171774.0000000004F32000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\CI\jenkins\workspace\Git-DownloadCore\VideoDownloader\win\PDB\Release\URLReqService.pdb0 source: URLReqService.exe, 00000038.00000000.2589657000.0000000000E12000.00000002.00000001.01000000.00000022.sdmp, URLReqService.exe, 00000038.00000002.2591192690.0000000000E12000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: E:\svn_code\CommonUI\CBS_Client\Trunk\Src\US1.0\DAQExp\Release\DAQExp.pdb source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: E:\Mobile\MobileMaster\TempBranch\MobileGoNew\PC\Setup\Framework_Lite\DotNetChecker\obj\x86\Release\NFWCHK.pdb source: free-youtube-downloader_setup_full384.exe
Source:	Binary string: E:\svn_code\CommonUI\CBS_Client\Trunk\Src\US1.0\DAQExp\Release\usExp.pdb source: is-E28Q8.tmp.8.dr
Source:	Binary string: p[,C:\Users\martin\34\python\PCbuild\unicodedata.pdb)6 source: is-9GJV1.tmp.8.dr
Source:	Binary string: C:\Users\martin\34\python\PCbuild\unicodedata.pdb source: is-9GJV1.tmp.8.dr
Source:	Binary string: D:\Enlistments\WPFOOB\src\wpfoob\WindowsApiCodePack\Main\Win7\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb source: CreateLib.exe, CreateLib.exe, 00000036.00000002.2587171774.0000000004F32000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\Enlistments\WPFOOB\src\wpfoob\WindowsApiCodePack\Main\Win7\WindowsAPICodePack\Shell\obj\Release\Microsoft.WindowsAPICodePack.Shell.pdb source: CreateLib.exe, CreateLib.exe, 00000036.00000002.2587379108.0000000004F82000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\KPByName\Release\KPByName.pdb source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000002.2561731574.000000000018F000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\My Document\Downloads\easyhook-69709\trunk\Release\x86\EasyHook32.pdb source: URLReqService.exe, 00000038.00000002.2593535891.000000001000E000.00000002.00000001.01000000.00000024.sdmp, is-O8S3K.tmp.8.dr
Source:	Binary string: D:\CI\jenkins\workspace\AgileTrans\Src\SymbolTable\Release\ImageProc.pdb source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003B4F000.00000004.00001000.00020000.00000000.sdmp

Spreading

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00473B80 FindFirstFileA,FindNextFileA,FindClose,	51_2_00473B80
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00451DC0 FindFirstFileA,GetLastError,	51_2_00451DC0
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004963A0 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	51_2_004963A0
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00463080 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	51_2_00463080
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004634FC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	51_2_004634FC
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00461AF4 FindFirstFileA,FindNextFileA,FindClose,	51_2_00461AF4
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B5C018 FindFirstFileW,GetLastError,	53_2_00B5C018
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B5729C GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	53_2_00B5729C
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_69400120 FindFirstFileA,FindNextFileA,FindClose,	53_2_69400120
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CC0F0 FindFirstFileA,FindNextFileA,FindClose,	53_2_693CC0F0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693F2350 FindFirstFileA,FindClose,	53_2_693F2350
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694003B0 FindFirstFileA,FindNextFileA,FindClose,	53_2_694003B0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CC270 FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	53_2_693CC270
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_69400540 FindFirstFileA,FindNextFileA,FindClose,	53_2_69400540
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693D5930 __itoa_s,FindFirstFileA,FindNextFileA,FindClose,	53_2_693D5930
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693C7BE0 FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	53_2_693C7BE0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CBBE0 FindFirstFileA,FindNextFileA,FindClose,	53_2_693CBBE0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CBD70 FindFirstFileA,FindNextFileA,FindClose,	53_2_693CBD70
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CBF30 FindFirstFileA,FindNextFileA,FindClose,	53_2_693CBF30
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693C71A0 FindFirstFileA,DeleteFileA,DeleteFileA,FindNextFileA,FindClose,	53_2_693C71A0

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior

Networking

Connects to many different domains

Source: unknown

Network traffic detected: DNS query count 41

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 87.230.98.78 87.230.98.78
Source: Joe Sandbox View	IP Address: 18.165.98.69 18.165.98.69
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 152.195.50.149
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DFB30E recv,__getptd_noexit,__calloc_crt,__get_sys_err_msg,_strcpy_s,__invoke_watson,

56_2_00DFB30E

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+m4WCRnsRpMdkul&MD=H+CPbanN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+m4WCRnsRpMdkul&MD=H+CPbanN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AfQPRnlXATSkKTK5C0dqeT98RaNcEj49dhlIQyGC_aOHcez6nMt8cEUs35X-FTeEzupXDCyW4Eh-Ikr3wo0WxD8E482m5dnO1Mqpx8QWzv2ayEY0pB5XkNtsdBjeqrhFbrIAxlKa5fNP7GUfiINIpvEHcgcb0jvoaIGD/DHDGFFKKEBHMKFJOJEJMPBLDMPOBFKFO_5_1_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delivery/customcmp/86321.js HTTP/1.1Host: cdn.consentmanager.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delivery/js/cmp_final.min.js HTTP/1.1Host: cdn.consentmanager.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delivery/cmp.php?id=86321&h=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&__cmpfcc=1&l=en&ls=EN_EN_EN&lp=EN&o=1714076766082 HTTP/1.1Host: delivery.consentmanager.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/checkeu HTTP/1.1Host: common-info.wondershare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, /; q=0.01sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.wondershare.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /webstore/inlineinstall/detail/dhdgffkkebhmkfjojejmpbldmpobfkfo HTTP/1.1Host: chrome.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /brand/track.2.0.min.js?bid=85021 HTTP/1.1Host: app.partnerboost.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/checkeu HTTP/1.1Host: common-info.wondershare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _gcl_au=1.1.1367721842.1714076765; srcSite=www.wondershare.com; referrer=; _uetsid=0b3e81f0034211ef80523331be39900f; _uetvid=0b3ea370034211ef8f1ecfac22ceebac; gdprAgree-eu=no
Source: global traffic	HTTP traffic detected: GET /clk.min.js HTTP/1.1Host: analytics.webgains.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /20200.js HTTP/1.1Host: www.dwin1.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /19038.js HTTP/1.1Host: www.dwin1.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uts_lp.php?cgid=900133 HTTP/1.1Host: www.linkconnector.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1020181/ HTTP/1.1Host: cdn.avmws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /A3249244-0e36-42f8-aac7-447bef0e6e601.js HTTP/1.1Host: utt.impactcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /120272.ct.js HTTP/1.1Host: tag.rmp.rakuten.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/platform/handle.js HTTP/1.1Host: trk.indoleads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /healthcheck HTTP/1.1Host: assets-tracking.crazyegg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.wondershare.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /healthcheck HTTP/1.1Host: pagestates-tracking.crazyegg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.wondershare.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=ad.admitad.com HTTP/1.1Host: ad.admitad.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=z.asbmit.com HTTP/1.1Host: z.asbmit.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=lenkmio.com HTTP/1.1Host: lenkmio.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=tjzuh.com HTTP/1.1Host: tjzuh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=pafutos.com HTTP/1.1Host: pafutos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delivery/customdata/bV8xLndfODYzMjEucl8ubF9lbi5kXzMwMjQ2LnhfMTA1LnYucC50XzMwMjQ2Lnh0XzEwNQ.js HTTP/1.1Host: cdn.consentmanager.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /clock?t=1714076770732&tk=187dd3044367ee2f390e706b16c4d1f5&s=379855&p=%2Fguide%2Ffree-youtube-downloader.html&u=1048432&v=58b776d3de2428599fd11c3427deaccfc480ab43&f=wondershare.com%2Fguide%2Ffree-youtube-downloader.html&ul=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall HTTP/1.1Host: tracking.crazyegg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.wondershare.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lantern_global_20200.min.js HTTP/1.1Host: lantern.roeyecdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tu.php?pid=48130&nv=_gcl_au%3D1.1.1367721842.1714076765%2C%20srcSite%3Dwww.wondershare.com%2C%20referrer%3D%2C%20_uetsid%3D0b3e81f0034211ef80523331be39900f%2C%20_uetvid%3D0b3ea370034211ef8f1ecfac22ceebac%2C%20gdprAgree-eu%3Dno%2C%20_ce.irv%3Dnew%2C%20cebs%3D1%2C%20_ce.s%3Dv~58b776d3de2428599fd11c3427deaccfc480ab43~lcw~1714076769255~lva~1714076769255~vpv~0~lcw~1714076769256%2C%20IR_gbd%3Dwondershare.com%2C%20IR_15586%3D1714076769684%257C0%257C1714076769684%257C%257C HTTP/1.1Host: www.linkconnector.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uts_900133_lpcheck=1
Source: global traffic	HTTP traffic detected: GET /js/uts_uid.php?cgid=900133&uts_protocol= HTTP/1.1Host: www.linkconnector.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uts_900133_lpcheck=1
Source: global traffic	HTTP traffic detected: GET /signals/config/475745997703022?v=2.9.154&r=stable&domain=www.wondershare.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsp?cn=rmuid&ro=0&cb=___rmuid HTTP/1.1Host: ut.rd.linksynergy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /healthcheck HTTP/1.1Host: assets-tracking.crazyegg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /healthcheck HTTP/1.1Host: pagestates-tracking.crazyegg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=lenkmio.com HTTP/1.1Host: lenkmio.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=z.asbmit.com HTTP/1.1Host: z.asbmit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=ad.admitad.com HTTP/1.1Host: ad.admitad.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=pafutos.com HTTP/1.1Host: pafutos.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=tjzuh.com HTTP/1.1Host: tjzuh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /clock?t=1714076770732&tk=187dd3044367ee2f390e706b16c4d1f5&s=379855&p=%2Fguide%2Ffree-youtube-downloader.html&u=1048432&v=58b776d3de2428599fd11c3427deaccfc480ab43&f=wondershare.com%2Fguide%2Ffree-youtube-downloader.html&ul=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall HTTP/1.1Host: tracking.crazyegg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/uts_uid.php?cgid=900133&uts_protocol= HTTP/1.1Host: www.linkconnector.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uts_900133_lpcheck=1
Source: global traffic	HTTP traffic detected: GET /tu.php?pid=48130&nv=_gcl_au%3D1.1.1367721842.1714076765%2C%20srcSite%3Dwww.wondershare.com%2C%20referrer%3D%2C%20_uetsid%3D0b3e81f0034211ef80523331be39900f%2C%20_uetvid%3D0b3ea370034211ef8f1ecfac22ceebac%2C%20gdprAgree-eu%3Dno%2C%20_ce.irv%3Dnew%2C%20cebs%3D1%2C%20_ce.s%3Dv~58b776d3de2428599fd11c3427deaccfc480ab43~lcw~1714076769255~lva~1714076769255~vpv~0~lcw~1714076769256%2C%20IR_gbd%3Dwondershare.com%2C%20IR_15586%3D1714076769684%257C0%257C1714076769684%257C%257C HTTP/1.1Host: www.linkconnector.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uts_900133_lpcheck=1; LCID=LC1714076772.5213308
Source: global traffic	HTTP traffic detected: GET /458359.gif?partner_uid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=475745997703022&ev=PageView&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&rl=&if=false&ts=1714076772273&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1714076772272.1933195972&ler=empty&cdl=API_unavailable&it=1714076770754&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=475745997703022&ev=PageView&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&rl=&if=false&ts=1714076772273&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1714076772272.1933195972&ler=empty&cdl=API_unavailable&it=1714076770754&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source;navigation-source, triggerReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?fingerprint=&referrer=&landingpage=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&site=20200 HTTP/1.1Host: lantern.roeye.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delivery/crossdomain.html HTTP/1.1Host: cdn.consentmanager.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDNhOWRiMjVhLWIxZDMtNGM1Mi1iYzkxLTBjNWYyZTQyNmIyZhAAGg0I5fiqsQYSBQjoBxAAQgBKAA HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rlas3=D9ODw24nQCqLMucYiiJbK5HQEfqgOLnpzPc3OOEamos=; pxrc=CAA=
Source: global traffic	HTTP traffic detected: GET /tr/?id=475745997703022&ev=PageView&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&rl=&if=false&ts=1714076772273&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1714076772272.1933195972&ler=empty&cdl=API_unavailable&it=1714076770754&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=475745997703022&ev=PageView&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&rl=&if=false&ts=1714076772273&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1714076772272.1933195972&ler=empty&cdl=API_unavailable&it=1714076770754&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/1004581587?random=1714076772858&cv=11&fst=1714076772858&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/578746000?random=1714076772866&cv=11&fst=1714076772866&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cs?ns=lr&uid3=3655b587ed44784ee9d0d5fb3f19f505e7d1a5e63b8fe901319014e3fd24a8086ac34734d8e453ee HTTP/1.1Host: tags.rd.linksynergy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rmuid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f
Source: global traffic	HTTP traffic detected: GET /track.php?fingerprint=&referrer=&landingpage=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&site=20200 HTTP/1.1Host: lantern.roeye.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/1004581587/?random=1714076772858&cv=11&fst=1714076772858&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&uid=not_logged_in&gjid=802999264&_gid=1258307180.1714076773&_u=6GhACEABBAAAAGAFKkC~&z=1543807389 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/viewthroughconversion/578746000/?random=1714076772866&cv=11&fst=1714076772866&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /cs?ns=lr&uid3=3655b587ed44784ee9d0d5fb3f19f505e7d1a5e63b8fe901319014e3fd24a8086ac34734d8e453ee HTTP/1.1Host: tags.rd.linksynergy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rmuid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f; icts=2024-04-25T20:26:14Z
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&uid=not_logged_in&gjid=802999264&_gid=1258307180.1714076773&_u=6GhACEABBAAAACAFKkC~&z=1882367113 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-2&cid=512838165.1714076768&jid=951242064&gjid=765186483&_gid=1258307180.1714076773&_u=6GjACEABBAAAAGAFKkC~&z=505942294 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&_u=6GhACEABBAAAAGAFKkC~&z=1285735140 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&_u=6GhACEABBAAAACAFKkC~&z=1654147962 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-2&cid=512838165.1714076768&jid=951242064&_u=6GjACEABBAAAAGAFKkC~&z=1454381953 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1004581587/?random=1714076772858&cv=11&fst=1714075200000&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqFvntLDuc52T4GOvgZLQOgwqvUVHllQ&random=3629556956&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/578746000/?random=1714076772866&cv=11&fst=1714075200000&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQB7FLtqfqVZnJSkdyBmSwmLrbnuVKIeArFe11F7aIV2mMk_-GWAWZeZ&random=3332743189&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delivery/info/?id=86321&did=1&cfdid=1&t=pv.cn.d_reg0.oonv.d_dnsx&h=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&o=1714076772825&l=EN&lv=92582&d=1&ct=14&e=&e2=&e3=&i=&sv=57&dv=105& HTTP/1.1Host: b.delivery.consentmanager.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/578746000/?random=1714076772866&cv=11&fst=1714075200000&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQB7FLtqfqVZnJSkdyBmSwmLrbnuVKIeArFe11F7aIV2mMk_-GWAWZeZ&random=3332743189&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1004581587/?random=1714076772858&cv=11&fst=1714075200000&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqFvntLDuc52T4GOvgZLQOgwqvUVHllQ&random=3629556956&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&_u=6GhACEABBAAAAGAFKkC~&z=1285735140 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&_u=6GhACEABBAAAACAFKkC~&z=1654147962 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/landing?gcs=G111&gcu=1&gcd=13r3r3r3r5&rnd=1640983559.1714076766&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html&dma=0&npa=0&gtm=45He44o0n81WRMX62Nv78842364za200&auid=1367721842.1714076765 HTTP/1.1Host: googleads.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=installAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkaoFjFT60v3DPVnpsF6-t-1rDa3x49wlwm0Anmo1rPQfa0Oo5rH2VzREmN
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-2&cid=512838165.1714076768&jid=951242064&_u=6GjACEABBAAAAGAFKkC~&z=1454381953 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /delivery/info/?id=86321&did=1&cfdid=1&t=pv.cn.d_reg0.oonv.d_dnsx&h=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&o=1714076772825&l=EN&lv=92582&d=1&ct=14&e=&e2=&e3=&i=&sv=57&dv=105& HTTP/1.1Host: b.delivery.consentmanager.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rest/v2/downloader/runtime/?client_sign={7C9F717C-EEB4-48a5-94F1-C9F36AA59499}&product_id=384 HTTP/1.1Accept: /Referer: http://platform.wondershare.com/rest/v2/downloader/runtimeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)Host: platform.wondershare.comConnection: CloseData Raw: 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /player/ytd384.html HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: dlinst.wondershare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /player/style/orbit-1.3.0.css HTTP/1.1Accept: /Referer: http://dlinst.wondershare.com/player/ytd384.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: dlinst.wondershare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /player/style/fit-style1.0.1.css HTTP/1.1Accept: /Referer: http://dlinst.wondershare.com/player/ytd384.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: dlinst.wondershare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /player/style/jquery-1.4.4.min.js HTTP/1.1Accept: /Referer: http://dlinst.wondershare.com/player/ytd384.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: dlinst.wondershare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /player/style/jquery.orbit.min.js HTTP/1.1Accept: /Referer: http://dlinst.wondershare.com/player/ytd384.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: dlinst.wondershare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /player/ytd384/01.png?t=20151911 HTTP/1.1Accept: /Referer: http://dlinst.wondershare.com/player/ytd384.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: dlinst.wondershare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /player/ytd384/02.png?t=20151911 HTTP/1.1Accept: /Referer: http://dlinst.wondershare.com/player/ytd384.htmlAccept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: dlinst.wondershare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /go.php?pid=384&m=i HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; CIBA; MS-RTC LM 8)Host: cbs.wondershare.com
Source: global traffic	HTTP traffic detected: GET /go.php?m=ic&back_url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall HTTP/1.1Host: cbs.wondershare.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: is-S2SE6.tmp.8.dr, is-SC5VJ.tmp.8.dr	String found in binary or memory: url: "https://www.facebook.com/video.php?v=" + video_id, equals www.facebook.com (Facebook)
Source: is-S2SE6.tmp.8.dr, is-SC5VJ.tmp.8.dr	String found in binary or memory: youtubeUrl= 'https://www.youtube.com/'+currentUrl; equals www.youtube.com (Youtube)
Source: is-S2SE6.tmp.8.dr, is-SC5VJ.tmp.8.dr	String found in binary or memory: var currentUrl = 'https://www.facebook.com' + $($(spanDom).parent().parent()).attr('href'); equals www.facebook.com (Facebook)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <strong><span>Note</span></strong>: Downloading videos from other 100 video websites like Hulu, VEVO and dailymotion is NOT available with Free YouTube Downloader. To download videos from these additional sites, please upgrade to <a href="https://www.wondershare.com/pro/allmytube-video-downloader.html">Wondershare AllMyTube </a>. equals www.youtube.com (Youtube)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <strong><span>note</span></strong>: downloading videos from other 100 video websites like hulu, vevo and dailymotion is not available with free youtube downloader. to download videos from these additional sites, please upgrade to <a href="https://www.wondershare.com/pro/allmytube-video-downloader.html">wondershare allmytube </a>. equals www.youtube.com (Youtube)
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <h2><a href="http://www.wondershare.com/pro/free-youtube-downloader.html?utm_source=suite-windows-off&utm_medium=pro&utm_campaign=pro" target="_blank">Wondershare Free YouTube Downloader</a></h2> equals www.youtube.com (Youtube)
Source: is-PFHFI.tmp.8.dr	String found in binary or memory: 'url': 'http://www.youtube.com/watch?v=' + feed_entry['youtube_id'], equals www.youtube.com (Youtube)
Source: is-8HMJU.tmp.8.dr	String found in binary or memory: 'url': 'https://www.youtube.com/watch?v=%s' % vid, equals www.youtube.com (Youtube)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <div class="video"> <a href="#video-demo" class="videoDemo" onclick="_gaq.push(['_trackEvent', Videos, 'Popup', videoArray[videoarraynum]+'@'+document.location.pathname]);" src="https://www.youtube.com/v/ZnWpv7Q_qdQ"><img src="https://images.wondershare.com/style/images/video-win.png" border="0" alt="icon"/></a> </div> equals www.youtube.com (Youtube)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <div class="video"> <a href="#video-demo" class="videodemo" onclick="_gaq.push(['_trackevent', videos, 'popup', videoarray[videoarraynum]+'@'+document.location.pathname]);" src="https://www.youtube.com/v/znwpv7q_qdq"><img src="https://images.wondershare.com/style/images/video-win.png" border="0" alt="icon"/></a> </div> equals www.youtube.com (Youtube)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <div class="follow"> <a href="https://www.facebook.com/wondershare" target="_blank" class="icon fm fm-facebook" style="color: #fff !important;"></a> <a href="https://twitter.com/wondershare" target="_blank" class="icon fm fm-twitter" style="color: #fff !important;"></a> <a href="https://www.youtube.com/user/Wondershare" target="_blank" class="icon fm fm-youtube" style="color: #fff !important;"></a> <a href="https://www.instagram.com/wondershare/" target="_blank" class="icon fm fm-instagram" style="color: #fff !important;"></a> </div> equals www.facebook.com (Facebook)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <div class="follow"> <a href="https://www.facebook.com/wondershare" target="_blank" class="icon fm fm-facebook" style="color: #fff !important;"></a> <a href="https://twitter.com/wondershare" target="_blank" class="icon fm fm-twitter" style="color: #fff !important;"></a> <a href="https://www.youtube.com/user/Wondershare" target="_blank" class="icon fm fm-youtube" style="color: #fff !important;"></a> <a href="https://www.instagram.com/wondershare/" target="_blank" class="icon fm fm-instagram" style="color: #fff !important;"></a> </div> equals www.twitter.com (Twitter)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <div class="follow"> <a href="https://www.facebook.com/wondershare" target="_blank" class="icon fm fm-facebook" style="color: #fff !important;"></a> <a href="https://twitter.com/wondershare" target="_blank" class="icon fm fm-twitter" style="color: #fff !important;"></a> <a href="https://www.youtube.com/user/Wondershare" target="_blank" class="icon fm fm-youtube" style="color: #fff !important;"></a> <a href="https://www.instagram.com/wondershare/" target="_blank" class="icon fm fm-instagram" style="color: #fff !important;"></a> </div> equals www.youtube.com (Youtube)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <div class="follow"> <a href="https://www.facebook.com/wondershare" target="_blank" class="icon fm fm-facebook" style="color: #fff !important;"></a> <a href="https://twitter.com/wondershare" target="_blank" class="icon fm fm-twitter" style="color: #fff !important;"></a> <a href="https://www.youtube.com/user/wondershare" target="_blank" class="icon fm fm-youtube" style="color: #fff !important;"></a> <a href="https://www.instagram.com/wondershare/" target="_blank" class="icon fm fm-instagram" style="color: #fff !important;"></a> </div> equals www.facebook.com (Facebook)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <div class="follow"> <a href="https://www.facebook.com/wondershare" target="_blank" class="icon fm fm-facebook" style="color: #fff !important;"></a> <a href="https://twitter.com/wondershare" target="_blank" class="icon fm fm-twitter" style="color: #fff !important;"></a> <a href="https://www.youtube.com/user/wondershare" target="_blank" class="icon fm fm-youtube" style="color: #fff !important;"></a> <a href="https://www.instagram.com/wondershare/" target="_blank" class="icon fm fm-instagram" style="color: #fff !important;"></a> </div> equals www.twitter.com (Twitter)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <div class="follow"> <a href="https://www.facebook.com/wondershare" target="_blank" class="icon fm fm-facebook" style="color: #fff !important;"></a> <a href="https://twitter.com/wondershare" target="_blank" class="icon fm fm-twitter" style="color: #fff !important;"></a> <a href="https://www.youtube.com/user/wondershare" target="_blank" class="icon fm fm-youtube" style="color: #fff !important;"></a> <a href="https://www.instagram.com/wondershare/" target="_blank" class="icon fm fm-instagram" style="color: #fff !important;"></a> </div> equals www.youtube.com (Youtube)
Source: is-8HMJU.tmp.8.dr	String found in binary or memory: url = 'https://www.googleapis.com/youtube/v3/videos?part=snippet%2CcontentDetails' \ equals www.youtube.com (Youtube)
Source: is-I0UO9.tmp.8.dr	String found in binary or memory: <lblHint Text="URL non valide, vous devez copier l'URL comme: https://www.youtube.com/watch?v=RgKAFK5djSk" /> equals www.youtube.com (Youtube)
Source: chromecache_1816.62.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(a){var b=new URL(a);b=b.hostname.endsWith(".facebook.com")&&b.pathname=="/signals/iwl.js";if(!b)throw new Error("Disallowed script URL");return a}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=null;e.exports=new h(function(d,e){try{n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}}}catch(a){return}function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=func
Source: is-VBSUA.tmp.8.dr	String found in binary or memory: : https://www.youtube.com/watch?v=RgKAFK5djSk" /> equals www.youtube.com (Youtube)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2596255981.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2596164464.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2620276127.0000000006FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BrowserHomePage=http://www.youtube.com equals www.youtube.com (Youtube)
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2917684385.000000000214D000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2232280069.0000000002350000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.00000000021F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: platform.wondershare.com
Source: global traffic	DNS traffic detected: DNS query: dlinst.wondershare.com
Source: global traffic	DNS traffic detected: DNS query: download.wondershare.com
Source: global traffic	DNS traffic detected: DNS query: cbs.wondershare.com
Source: global traffic	DNS traffic detected: DNS query: www.wondershare.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: images.wondershare.com
Source: global traffic	DNS traffic detected: DNS query: script.crazyegg.com
Source: global traffic	DNS traffic detected: DNS query: cdn.consentmanager.net
Source: global traffic	DNS traffic detected: DNS query: delivery.consentmanager.net
Source: global traffic	DNS traffic detected: DNS query: common-info.wondershare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: app.partnerboost.com
Source: global traffic	DNS traffic detected: DNS query: chrome.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.webgains.io
Source: global traffic	DNS traffic detected: DNS query: www.dwin1.com
Source: global traffic	DNS traffic detected: DNS query: cdn.avmws.com
Source: global traffic	DNS traffic detected: DNS query: www.linkconnector.com
Source: global traffic	DNS traffic detected: DNS query: utt.impactcdn.com
Source: global traffic	DNS traffic detected: DNS query: trk.indoleads.com
Source: global traffic	DNS traffic detected: DNS query: tag.rmp.rakuten.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: z.asbmit.com
Source: global traffic	DNS traffic detected: DNS query: ad.admitad.com
Source: global traffic	DNS traffic detected: DNS query: pagestates-tracking.crazyegg.com
Source: global traffic	DNS traffic detected: DNS query: assets-tracking.crazyegg.com
Source: global traffic	DNS traffic detected: DNS query: lenkmio.com
Source: global traffic	DNS traffic detected: DNS query: pafutos.com
Source: global traffic	DNS traffic detected: DNS query: tjzuh.com
Source: global traffic	DNS traffic detected: DNS query: tracking.crazyegg.com
Source: global traffic	DNS traffic detected: DNS query: lantern.roeyecdn.com
Source: global traffic	DNS traffic detected: DNS query: ut.rd.linksynergy.com
Source: global traffic	DNS traffic detected: DNS query: lantern.roeye.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: tags.rd.linksynergy.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: b.delivery.consentmanager.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A4109000CC6X-BM-CBT: 1696420817X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 60X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109000CC6X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-tX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2236Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997

Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://%s/data/video.endLevel.json
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: http://123movies.md/movies/the-mummy-2017/
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: http://123movies.net/watch/GpDJMmgG-shooter-season-2/episode-8.html/watching.html
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: http://123movies.sc/ip.file/swf/ipplayer/ipplayer.php?u=%s&s=%s&n=%s
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: http://123movies.sc/ip.file/swf/plugins/ipplugins.php
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: http://123movies.sc/watch-clouds-of-sils-maria-2014-123movies.html/watching.html
Source: is-ID9LN.tmp.8.dr	String found in binary or memory: http://127.0.0.1:8499
Source: is-TJML1.tmp.8.dr	String found in binary or memory: http://192.99.219.222:82/presstv
Source: is-8DD7U.tmp.8.dr	String found in binary or memory: http://91porn.com/view_video.php?viewkey=%s
Source: is-8DD7U.tmp.8.dr	String found in binary or memory: http://91porn.com/view_video.php?viewkey=7e42283b4f5ab36da134
Source: is-886R8.tmp.8.dr	String found in binary or memory: http://9gag.com/tv/embed/a5Dmvl
Source: is-886R8.tmp.8.dr	String found in binary or memory: http://9gag.com/tv/p/Kk2X5/people-are-awesome-2013-is-absolutely-awesome
Source: is-886R8.tmp.8.dr	String found in binary or memory: http://9gag.com/tv/p/KklwM
Source: is-886R8.tmp.8.dr	String found in binary or memory: http://9gag.com/tv/p/aKolP3
Source: is-886R8.tmp.8.dr	String found in binary or memory: http://9gag.tv/p/Kk2X5
Source: is-2OECQ.tmp.8.dr	String found in binary or memory: http://abc7news.com/472581
Source: is-2OECQ.tmp.8.dr	String found in binary or memory: http://abc7news.com/entertainment/east-bay-museum-celebrates-vintage-synthesizers/472581/
Source: is-M5F4Q.tmp.8.dr	String found in binary or memory: http://abcnews.go.com/2020/video/2020-husband-stands-teacher-jail-student-affairs-26119478
Source: is-M5F4Q.tmp.8.dr	String found in binary or memory: http://abcnews.go.com/Blotter/News/dramatic-video-rare-death-job-america/story?id=10498713#.UIhwosWH
Source: is-M5F4Q.tmp.8.dr	String found in binary or memory: http://abcnews.go.com/Entertainment/justin-timberlake-performs-stop-feeling-eurovision-2016/story?id
Source: is-M5F4Q.tmp.8.dr	String found in binary or memory: http://abcnews.go.com/Technology/exclusive-apple-ceo-tim-cook-iphone-cracking-software/story?id=3717
Source: is-M5F4Q.tmp.8.dr	String found in binary or memory: http://abcnews.go.com/ThisWeek/video/week-exclusive-irans-foreign-minister-zarif-20411932
Source: is-M5F4Q.tmp.8.dr	String found in binary or memory: http://abcnews.go.com/video/embed?id=46979033
Source: is-M5F4Q.tmp.8.dr	String found in binary or memory: http://abcnews.go.com/video/itemfeed?id=%s
Source: is-LOHG0.tmp.8.dr	String found in binary or memory: http://academicearth.org/playlists/laws-of-nature/
Source: is-7VOM9.tmp.8.dr	String found in binary or memory: http://achievementhunter.roosterteeth.com/episode/off-topic-the-achievement-hunter-podcast-2016-i-di
Source: is-7I7AC.tmp.8.dr	String found in binary or memory: http://add-anime.net/video/MDUGWYKNGBD8/One-Piece-687
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000002.2912329525.000000000018F000.00000004.00000010.00020000.00000000.sdmp, is-OLCR1.tmp.8.dr	String found in binary or memory: http://addons.mozilla.org/ca/crl.pem0
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: http://adultswim.com/videos/%s/%s
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: http://adultswim.com/videos/rick-and-morty/pilot
Source: is-25IMR.tmp.8.dr	String found in binary or memory: http://ancensored.com/video/get-link
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://antiserver.kuwo.cn/anti.s
Source: is-KLKTJ.tmp.8.dr	String found in binary or memory: http://anysex.com/156592/
Source: is-6QO2H.tmp.8.dr	String found in binary or memory: http://api.bleacherreport.com/api/v1/articles/%s
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: http://api.nowness.com/api/
Source: is-3OQP2.tmp.8.dr	String found in binary or memory: http://api.seekernetwork.com/player/embed?videoId=67558
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: http://api.video.mail.ru/videos/%s.json?new=1
Source: is-6HP6M.tmp.8.dr	String found in binary or memory: http://api.watchbox.de/devapi/id/%s
Source: is-IJ5U4.tmp.8.dr	String found in binary or memory: http://api.yapfiles.ru/load/%s/
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://apis.ign.com/video/v3/videos/%s
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: http://benprunty.bandcamp.com/track/lanius-battle
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://beta.nick.com/nicky-ricky-dicky-and-dawn/videos/nicky-ricky-dicky-dawn-301-full-episode/
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: http://blazo.bandcamp.com/album/jazz-format-mixtape-vol-1
Source: is-6QO2H.tmp.8.dr	String found in binary or memory: http://bleacherreport.com/articles/2496438-fsu-stat-projections-is-jalen-ramsey-best-defensive-playe
Source: is-6QO2H.tmp.8.dr	String found in binary or memory: http://bleacherreport.com/articles/2586817-aussie-golfers-get-fright-of-their-lives-after-being-chas
Source: is-6QO2H.tmp.8.dr	String found in binary or memory: http://bleacherreport.com/video_embed?id=%s
Source: is-6QO2H.tmp.8.dr	String found in binary or memory: http://bleacherreport.com/video_embed?id=8fd44c2f-3dc5-4821-9118-2c825a98c0e1&library=video-cms
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: is-CU6QL.tmp.8.dr	String found in binary or memory: http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=is&c=23&pl=VAST&pli=5349193&PluID=0&pos=7135&o
Source: WSHelper.exe, 00000035.00000003.2551828802.0000000002F2D000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000003.2552219662.0000000002E0A000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000000.2547642375.0000000000401000.00000020.00000001.01000000.0000001A.sdmp, WSHelper.exe, 00000035.00000000.2549664664.0000000000605000.00000002.00000001.01000000.0000001A.sdmp, is-4J6FD.tmp.51.dr	String found in binary or memory: http://bsalsa.com/
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://c.brightcove.com/services/json/experience/runtime/?command=get_programming_for_experience&pla
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://c.brightcove.com/services/viewer/federated_f9?&playerID=1265504713001&publisherID=AQ%7E%7E%2C
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://c.brightcove.com/services/viewer/htmlFederated
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://c.brightcove.com/services/viewer/htmlFederated?%40videoPlayer=ref%3Aevent-stream-356&linkBase
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://c.brightcove.com/services/viewer/htmlFederated?playerID=1217746023001&flashID=myPlayer&%40vid
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://c.brightcove.com/services/viewer/htmlFederated?playerID=1654948606001&flashID=myExperience&%4
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://c.brightcove.com/services/viewer/htmlFederated?playerID=3550052898001&playerKey=AQ%7E%7E%2CAA
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: is-T4UT6.tmp.8.dr	String found in binary or memory: http://can.cbs.com/thunder/player/videoPlayerService.php
Source: is-2LK22.tmp.8.dr	String found in binary or memory: http://capi.9c9media.com/destinations/%s/platforms/desktop/contents/%s/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452350461.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452824743.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452446240.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452555088.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452323632.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452298521.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452945473.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452855090.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452414226.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452385885.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452883922.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452626900.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452474274.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452502504.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.w
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondersha
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/g4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.ph
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://cbs.wondershare.com/go.php
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=11S
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=11TI
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=11rs.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=13=
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=13c
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=14/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=14://cF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=14D
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1364&num=14P
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1378&num=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1378&num=11ha
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1378&num=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1378&num=13hp?m=ck&pid=1396&num=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1378&num=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1378&num=14M
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1378&num=14e
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1396&num=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1396&num=11PE
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1396&num=11h
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1396&num=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1396&num=13/s
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1396&num=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1396&num=140
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1427&num=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1427&num=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1427&num=13(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1427&num=13As
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1427&num=13t
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1427&num=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1430&num=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1430&num=11?l
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1430&num=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1430&num=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1430&num=14Sr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=1430&num=14f
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=1135
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11?
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11H
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11Q
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11are.c
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11nd.1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11ph
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=1335
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=1335br
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=13;
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=13lish
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=13ph
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=13rs.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=13s
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=13witz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=1435
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=1435A
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=1435F
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=145
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=14:
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=14Q
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=14j
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=14ph
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?m=ck&pid=384&num=14~
Source: is-L99G6.tmp.8.dr	String found in binary or memory: http://cbs.wondershare.com/go.php?m=upgrade_info&pid=
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002920000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000000.2547642375.0000000000401000.00000020.00000001.01000000.0000001A.sdmp, is-4J6FD.tmp.51.dr	String found in binary or memory: http://cbs.wondershare.com/go.php?m=upgrade_info&pid=%s&version=%s&email=%s&updatebyua=%sU
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pi
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2634510796.00000000033FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=%s&m=ot
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2634510796.000000000341B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=%s&m=ut
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C10
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C10301135
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C1030=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C1030=13br
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623215393.0000000006A08000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C1030F
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C10m=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C10w
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C12
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C1230=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C12T
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C12um=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C12um=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C1T
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C2-
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C2u
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C2x
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C3A
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C4#
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C4l
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C5
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C59
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C5R
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C5Rz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C6M
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C6x
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C7
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C7O
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C7y
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C8
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C8-
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C8Q
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C8c
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C8s
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C9
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C96
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C9E
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C9_
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=C9f
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=bf
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=bfA
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=bfe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=bfw
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=bfxz&
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=bt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=bt.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=bty
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=db
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dbq
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dc-
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dh
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dhF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dhM
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dhr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=do
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=doS
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dp$
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dp2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dpl
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=ds
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dsF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=dsP
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=i
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=iI
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=ih
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=o
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=oB
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=oL
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=ot
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=oti
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=otu
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=rG
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=rS
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=rT
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=rY
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=sc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=sca
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=u
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=ua
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=ud
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=uj
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=ut
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=uts
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=u~
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=wr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623373790.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=wr)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1364&m=wroz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C10/go.php
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C1030
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C1053E3E770035l
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C10=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C1230
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C12653E3E770035o
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C12=11ph
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C12m=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C1C
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C1V
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C2N
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C3X
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C3g
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C5
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C6%
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C6;
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C7
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C7.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C8
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C9
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C9F
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=C9G
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=bf
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=bf6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=bfi
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=bt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=btH
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=db
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dc2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dcF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dh
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dhP
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=do
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=doF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=doJ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dog
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dpG
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dpe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=ds
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=ds=
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=dsS
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=i
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=o
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=o)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=ot
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=r_
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=rj
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=sc$
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=sc-
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=scP
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=scm
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=u
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=up
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=ur
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=ut1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=utJ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=utZ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=uta
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=wr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=wrT
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1378&m=wrz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C10
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C103014h
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C10=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C10m=14B
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C1230=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C1253E3E770035
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C12m=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C12um=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C2L
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C2~
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C3P
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C3z
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622980265.00000000069E3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C5
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C5G
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C6P
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C7
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C7Yp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C8
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C8j
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C9
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=C9?
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=bf
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622980265.00000000069E3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=bt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=btJ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=db
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=dc6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=dc7
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622980265.00000000069E3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=dcQ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=dh
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=do
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622980265.00000000069E3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=doK
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622980265.00000000069E3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=dp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622980265.00000000069E3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=ds
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453960720.00000000045DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=ds(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=dsQ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=i
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=id
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=o
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=oM
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=oU
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=ot
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=otN
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=rB
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=rq
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622980265.00000000069E3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=sc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=sccq
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=scn
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=sc~
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=u
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=u3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=uH
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=us
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=ut
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=utg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=wr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=wrJ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1396&m=wrT
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C1%
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C10
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C10m=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C10m=13
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C10m=13?l
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C12
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C12=13Ps
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451810332.00000000045DD000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C12um=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C17
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C2H
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C4(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C4J
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C5
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C5m
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C5s
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C6_
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C7
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C7B
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C7X
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C8
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C89r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C8h
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C9
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=C9f
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=bf
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=bf2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=bfi
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=bt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=db
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=dc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=dc4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=dcV
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=dh
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=do
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=doq
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=dp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=ds-
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=dsW
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=dsx
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=dsz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452069523.00000000045DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=i
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=iu
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=o
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=o.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=oS
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=ot
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=otF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=rF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=sc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=u
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=u9r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=u=
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=ui
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=ut
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=utG
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=ute
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=wr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=wr6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=wr;
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1427&m=wrl
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C1#
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C10
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C10m=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C10m=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C1230
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C1230=11
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623215393.0000000006A08000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C12m=14
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C12um=11Ps
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C3Q
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C3Z
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C5
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C7
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C7)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C8
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C8I
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=C9
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=bf
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=bf%
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=bf:
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=bt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=db
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dcd
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dcl
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dh
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dhD
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=do
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=doH
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dp1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dpK
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=dpv
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=ds
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=ds(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=i
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=ic
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=io
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=iw
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=o
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=o6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=ot
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=ot-
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=ot5
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=otu
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=oy
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=sc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=scE
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=scM
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=scb
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=u
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=u:
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=ut
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=utt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=uz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069E7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=wr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=1430&m=wrn
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=38
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C1)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C10
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C10(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C100
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C108
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C10N
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C10Vy
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C10j
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C10m
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C10n
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C12
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C12;
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C12M
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C12R
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C12T
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C12Y
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C12g
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C12h
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C1D
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C1M
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C1S
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C1m
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C1p?ustom4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C1r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C2%
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C27
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C2K
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C2S
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C2h
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C3.bn
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C3I
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C3J
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C3T
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C3_S
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C3h;
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C4&
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C4-
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C4.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C43
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C4:
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C4P
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C4_
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5)
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5:v
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5F
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5G
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5_
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5h
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C5y
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C6.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C6Lxz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C6N
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C6is
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C6n
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C6o
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C6x
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C7
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C7(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C7.W~
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C71
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C77
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C7A
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C7P
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C7R
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C7q
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C7wn1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C8
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C8%
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C8.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C82
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C89
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C8Y
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C8Yx
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C8_S
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C9
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C9&
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C9.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622934763.00000000069E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C92
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C97v
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C98
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C9E
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C9N
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C9cy
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C9k
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453986582.00000000069F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=C9n
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bf
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bfZ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bfe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bfjx
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bfm
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bt#
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bt:
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bt=y
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=btB
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=bte
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=btgx
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2630793163.00000000044F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2463749284.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=db
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=db.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dbK
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dbS
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dbe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dc%
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dc(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dcEq
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dce
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dct
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dc~
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2637478982.000000000452B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dh
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dh.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dh.f
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dh3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dh6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dhgp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dhrw(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2630793163.00000000044F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2463842455.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=do
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=do.Z
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=do8
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=doI
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=doLp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=doaw
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=doh
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dom
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dp(
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dp.K~v
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dp7
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dpF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dpItw
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dpM
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dpS
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dpW
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dpa
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ds
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ds%
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ds3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dsG
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ds_
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dscq
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dsd
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=dsl
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2634510796.00000000033FC000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=i
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=i0
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=i2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=i2D
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=i5
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=iFu
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=iM
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=iU
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=id
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ip
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.00000000022CB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=isers.1
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=iy
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=o
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=o2D
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=o3
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=o9Hqw
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=o?
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=oA
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=of6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ot
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ot&
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ot-
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=otM
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=otWt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=othw
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=otq
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=r
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=r0
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=r2D
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=r2Dr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=r6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=r7Yp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=rR
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=r_v
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=rf
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=rs~.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069EE000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=rt
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451511379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=sc
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=sc2
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=sc:
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=scE
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=scF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=scN
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=scW
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=schz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=scl
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=scq
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=u
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=u.
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=u.H
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=u2D
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=u2D)v
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=u6
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=uF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=uM
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ujp
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ut
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ut-u
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=utF
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=utT
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=ut_
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=uth
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=utk
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=utn
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=uu
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=uz
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2453904512.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451839397.00000000045D8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623176379.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=wr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.00000000069F4000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=wr/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069E8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/go.php?pid=384&m=wr~
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cbs.wondershare.com/jslibs/track.js
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://cdn.playapi.mtgx.tv/imagecache/600x315/cloud/content-images/inbox/765166/a2e95e5f1d735bab9f30
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://cdn.playapi.mtgx.tv/imagecache/600x315/cloud/content-images/seasons/15204/758770/4a5ba509ca8b
Source: is-EL2LS.tmp.8.dr	String found in binary or memory: http://cdn4.videos.motherlessmedia.com/videos/%s.mp4?fs=opencloud
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: http://cinematique.com/embed/%s
Source: is-MEP2B.tmp.8.dr	String found in binary or memory: http://cleveland.cbslocal.com/2016/05/16/indians-score-season-high-15-runs-in-blowout-win-over-reds-
Source: PluginInstaller.exe, 0000003A.00000002.2618713480.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, PluginInstaller.exe, 0000003A.00000000.2612523530.0000000000522000.00000002.00000001.01000000.00000025.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://cnn.com/video/?/video/
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://cnn.com/video/?/video/politics/2015/03/27/pkg-arizona-senator-church-attendance-mandatory.ktv
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://cnn.com/video/?/video/us/2015/04/06/dnt-baker-refuses-anti-gay-order.wkmg
Source: is-T4UT6.tmp.8.dr	String found in binary or memory: http://colbertlateshow.com/video/8GmB0oY0McANFvp2aEffk9jZZZ2YyXxy/the-colbeard/
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: http://community.plm.automation.siemens.com/t5/News-NX-Manufacturing/Tool-Path-Divide/ba-p/4187
Source: is-U5DAM.tmp.8.dr	String found in binary or memory: http://content.api.mnet.com/player/vodConfig
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0X
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, free-youtube-downloader_full384.tmp.7.dr, is-4J6FD.tmp.51.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: NFWCHK.exe, 00000001.00000002.1957052960.000000001C19E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csc3-2010-crl.verisig
Source: is-CA1U3.tmp.8.dr	String found in binary or memory: http://csp.picsearch.com/rest?e=%s&containerId=mediaplayer&i=object
Source: NFWCHK.exe, 00000001.00000002.1955500289.0000000000D49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: NFWCHK.exe, 00000001.00000002.1955500289.0000000000DA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: is-FL0GK.tmp.8.dr	String found in binary or memory: http://cypherpunks.venona.com/date/1994/09/msg00420.html
Source: is-601K9.tmp.8.dr	String found in binary or memory: http://developer.longtailvideo.com/trac/wiki/FlashFormats
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: http://digitalops.sandia.gov/Mediasite/Play/24aace4429fc450fb5b38cdbf424a66e1d
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/style/fit-style1.0.1.css
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.000000000598F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/style/jquery-1.4.4.min.js
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.000000000598F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/style/jquery.orbit.min.js
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.000000000598F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/style/jquery.orbit.min.js1
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/style/jquery.orbit.min.jsM#
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1928801348.000000000B3A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384.html
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929003753.00000000059F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384.htmlAds$
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384.htmlg?t=20151911/tr
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1928947314.000000000B40D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384.htmll
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1928801348.000000000B3A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384.htmlml
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384/01.png?t=20151911
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384/02.png?t=20151911
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384/02.png?t=20151911...
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384/02.png?t=20151911...$$
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929003753.00000000059F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384/02.png?t=20151911...Tl
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005965000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlinst.wondershare.com/player/ytd384/02.png?t=20151911r
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://docs.brightcove.com/en/video-cloud/brightcove-player/guides/in-page-embed-player-implementati
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://docs.brightcove.com/en/video-cloud/brightcove-player/guides/publish-video.html#setvideoinifra
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://docs.brightcove.com/en/video-cloud/brightcove-player/guides/publish-video.html#setvideousingj
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://docs.brightcove.com/en/video-cloud/brightcove-player/guides/publish-video.html#tag
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.jquery.com/Utilities/jQuery.browser
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: http://dotscale.bandcamp.com
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://download.anypdftools.com/anybizsoft-pdf-converter_full524.exe
Source: is-USC47.tmp.8.dr	String found in binary or memory: http://download.blender.org/peach/bigbuckbunny_movies/BigBuckBunny_320x180.mp4
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/1-click-pc-care_full821.exe
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://download.wondershare.com/cbs_down/free-youtube-downloader_full384.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/data-recovery_full542.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/dsb_deluxe_full18.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/dvd-creator_full619.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/dvd-ripper-platinum_full48.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/fgf_deluxe_full388.exe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/free-youtube-downloader_full384.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/mobilego_full818.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/pdf-converter-pro_full839.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/pdf-converter_full524.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/pdf-to-excel_full551.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/pdf-to-word_full417.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/photo-collage-studio_full15.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/photo-recovery_full543.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/streaming-audio-recorder_full383.exe
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://download.wondershare.com/video-converter-ultimate_full495.exe
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://download.wondershare.com/video-editor_full846.exe
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://edition.cnn.com/.element/apps/cvp/3.0/cfg/spider/cnn/expansion/config.xml
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://edition.cnn.com/video/?/video/sports/2013/06/09/nadal-1-on-1.cnn
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://edition.cnn.com/video/?/video/us/2013/08/21/sot-student-gives-epic-speech.georgia-institute-o
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://edition.cnn.com/video/data/3.0/video/%s/index.xml
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://edition.cnn.com/videos/arts/2016/04/21/olympic-games-cultural-a-z-brazil.cnn
Source: is-F2B86.tmp.8.dr	String found in binary or memory: http://embed.acast.com/adambuxton/ep.12-adam-joeschristmaspodcast2015
Source: is-5F90G.tmp.8.dr	String found in binary or memory: http://embed.nexx.cloud/748/KC1614647Z27Y7T?autoplay=1
Source: is-MEP2B.tmp.8.dr	String found in binary or memory: http://embed.sendtonews.com/player2/embedplayer.php?SC=GxfCe0Zo7D-175909-5588&type=single&autoplay=o
Source: is-S2K5T.tmp.8.dr	String found in binary or memory: http://embed.yourupload.com/14i14h
Source: is-FU44R.tmp.8.dr	String found in binary or memory: http://en.musicplayon.com/play?pl=102&play=442629
Source: is-FU44R.tmp.8.dr	String found in binary or memory: http://en.musicplayon.com/play?v=%s
Source: is-FU44R.tmp.8.dr	String found in binary or memory: http://en.musicplayon.com/play?v=433377
Source: is-M4Q14.tmp.8.dr	String found in binary or memory: http://en.savefrom.net
Source: is-M4Q14.tmp.8.dr	String found in binary or memory: http://en.savefrom.net/
Source: is-M4Q14.tmp.8.dr	String found in binary or memory: http://en.savefrom.net/#url=
Source: is-M4Q14.tmp.8.dr	String found in binary or memory: http://en.savefrom.net/#url=http://youtube.com/watch?v=UlVRAPW2WJY&utm_source=youtube.com&utm_medium
Source: is-M4Q14.tmp.8.dr	String found in binary or memory: http://en.savefrom.net/savefrom.php
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: is-T93QJ.tmp.8.dr	String found in binary or memory: http://es.pinkbike.org/i/kvid/kvid-y5.swf?id=406629
Source: is-N9L46.tmp.8.dr	String found in binary or memory: http://esportes.r7.com/videos/cigano-manda-recado-aos-fas/idmedia/4e176727b51a048ee6646a1b.html
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: http://events7.mediasite.com/Mediasite/Catalog/Full/631f9e48-530d-4543-8154-9f955d08c75e
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: http://events7.mediasite.com/Mediasite/Catalog/Full/631f9e48530d454381549f955d08c75e21
Source: is-2L65B.tmp.8.dr	String found in binary or memory: http://ext.yinyuetai.com/main/get-h-mv-info?json=true&videoId=%s
Source: is-73TS4.tmp.8.dr	String found in binary or memory: http://fast.wistia.com/embed/iframe/sh7fpupwlt
Source: is-73TS4.tmp.8.dr	String found in binary or memory: http://fast.wistia.com/embed/medias/%s.json
Source: is-73TS4.tmp.8.dr	String found in binary or memory: http://fast.wistia.net/embed/iframe/%s
Source: is-73TS4.tmp.8.dr	String found in binary or memory: http://fast.wistia.net/embed/iframe/sh7fpupwlt
Source: is-73TS4.tmp.8.dr	String found in binary or memory: http://fast.wistia.net/embed/medias/sh7fpupwlt.json
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://feed.theplatform.com/f/2E2eJC/nbcnews
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://feed.theplatform.com/f/2E2eJC/nnd_NBCNews
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://feeds.mtvnservices.com/od/feed/intl-mrss-player-feed
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: is-USC47.tmp.8.dr	String found in binary or memory: http://forgetfulbc.blogspot.com/2016/06/date.html
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://fr.pornhub.com/view_video.php?viewkey=ph55ca2f9760862
Source: is-7VOM9.tmp.8.dr	String found in binary or memory: http://funhaus.roosterteeth.com/episode/funhaus-shorts-2016-austin-sucks-funhaus-shorts
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://gamevideos.1up.com/video/id/34976.html
Source: is-8HMJU.tmp.8.dr	String found in binary or memory: http://gb.napster.com/artist/madness/album/keep-moving-salvo/track/wings-of-a-dove
Source: is-8MLDH.tmp.8.dr, is-I0I3J.tmp.8.dr	String found in binary or memory: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=b4eb1f29ebddd60c41a2eb39f5af701e38e0d3fd)
Source: is-8HMJU.tmp.8.dr	String found in binary or memory: http://groovesharks.org/music/getYoutube/?
Source: is-VM01N.tmp.8.dr	String found in binary or memory: http://h5vv.video.qq.com/getinfo
Source: is-VM01N.tmp.8.dr	String found in binary or memory: http://h5vv.video.qq.com/getkey
Source: is-4ST41.tmp.8.dr	String found in binary or memory: http://hitech.vesti.ru/news/view/id/4000
Source: is-9199H.tmp.8.dr	String found in binary or memory: http://hls-geo.daserste.de/i/videoportal/Film/c_620000/622873/format
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://ht3.cdn.turner.com/money/big
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://i.youku.com/u/UMTI4ODA1NzE0MA==
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://i.youku.com/u/UMTQ0MDcxODY4
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://i.youku.com/u/UMTUzODYyNDg0
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://i.youku.com/u/UMjUwMzMzODky
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://i.youku.com/u/UMzA5MTM5NzQzNg==
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://i.youku.com/u/UOTUyODk5Ng==
Source: is-886R8.tmp.8.dr	String found in binary or memory: http://instagram.com/p/%s
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://isaacschlueter.com/2006/10/msie-memory-leaks/
Source: Wondershare Helper Compact.exe, 00000032.00000003.2465480059.0000000002310000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.exe, 00000032.00000003.2465576785.00000000020E1000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.exe, 00000032.00000003.2562722031.00000000020E1000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2561196362.00000000021C4000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2469222148.0000000002168000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2561455772.0000000002168000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2469121018.00000000028F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/
Source: Wondershare Helper Compact.exe, 00000032.00000003.2465480059.0000000002310000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.exe, 00000032.00000003.2465576785.00000000020E1000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.exe, 00000032.00000003.2562722031.00000000020E1000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2561196362.00000000021C4000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2469222148.0000000002168000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2561455772.0000000002168000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2469121018.00000000028F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ispp.sourceforge.net/About
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: http://it.slashdot.org/story/13/04/25/178216/recovering-data-from-broken-hard-drives-and-ssds-video
Source: PluginInstaller.exe, 0000003A.00000002.2619694009.0000000004DC2000.00000002.00000001.01000000.00000026.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp, chromecache_1826.62.dr	String found in binary or memory: http://jquery.com/
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp, chromecache_1826.62.dr	String found in binary or memory: http://jquery.org/license
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://json.org/json2.js
Source: is-2U854.tmp.8.dr	String found in binary or memory: http://lenta.ru/news/2015/03/06/navalny/
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://link.brightcove.com/services/player/bcpid
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://link.brightcove.com/services/player/bcpid756015033001?bckey=AQ~~
Source: is-T4UT6.tmp.8.dr	String found in binary or memory: http://link.theplatform.com/s/
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://link.theplatform.com/s/NnzsPC/media/guid/2410887629/
Source: is-16039.tmp.8.dr	String found in binary or memory: http://link.theplatform.com/s/gZWlPC/media/guid/2408950221/%s?mbr=true&manifest=m3u
Source: is-TO0Q8.tmp.8.dr	String found in binary or memory: http://link.theplatform.com/s/ngs/media/guid/2423130747/%s?mbr=true
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://list.youku.com/show/episode
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://list.youku.com/show/id_z20eb4acaf5c211e3b2ad.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://list.youku.com/show/id_za7c275ecd7b411e1a19e.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://list.youku.com/show/id_zc7c670be07ff11e48b3f.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://list.youku.com/show/id_zefbfbd61237fefbfbdef.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://list.youku.com/show/id_zefbfbd70efbfbd780bef.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://list.youku.com/show/module
Source: is-90V98.tmp.8.dr	String found in binary or memory: http://live.philharmoniedeparis.fr/Concert/1030324.html
Source: is-90V98.tmp.8.dr	String found in binary or memory: http://live.philharmoniedeparis.fr/concert/1032066.html
Source: is-90V98.tmp.8.dr	String found in binary or memory: http://live.philharmoniedeparis.fr/misc/Playlist.ashx?id=1030324&track=&lang=fr
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://livepassdl.conviva.com/hf/ver/2.79.0.17083/LivePassModuleMain.swf
Source: is-8TVN8.tmp.8.dr	String found in binary or memory: http://lnkgo.alfa.lt/visi-video/aktualai-pratesimas/ziurek-nerdas-taiso-kompiuteri-2
Source: is-8TVN8.tmp.8.dr	String found in binary or memory: http://lnkgo.alfa.lt/visi-video/yra-kaip-yra/ziurek-yra-kaip-yra-162
Source: is-CJFP9.tmp.8.dr	String found in binary or memory: http://loc.gov/item/90716351/
Source: is-0KBD9.tmp.8.dr	String found in binary or memory: http://m.mgoon.com/ch/hi6618/v/5582148
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: http://m.my.mail.ru/mail/3sktvtr/video/_myvideo/138.html
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://m.ok.ru/video/20079905452
Source: is-8EH9J.tmp.8.dr	String found in binary or memory: http://m.tvland.com/app/
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://m.twitch.tv/vanillatv/profile
Source: is-QERRB.tmp.8.dr	String found in binary or memory: http://m.worldstarhiphop.com/android/video.php?v=wshh6a7q1ny0G34ZwuIO
Source: is-08B52.tmp.8.dr	String found in binary or memory: http://m.ximalaya.com/61425525/album/5534601
Source: is-08B52.tmp.8.dr	String found in binary or memory: http://m.ximalaya.com/61425525/sound/47740352/
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://mashable.com/2013/10/26/thermoelectric-bracelet-lets-you-control-your-body-temperature/
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://me.ign.com/ar/angry-birds-2/106533/video/lrd-ldyy-lwl-lfylm-angry-birds
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://me.ign.com/en/feature/15775/100-little-things-in-gta-5-that-will-blow-your-mind
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://me.ign.com/en/videos/112203/video/how-hitman-aims-to-be-different-than-every-other-s
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://media.mtvnservices.com/embed/%s
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://media.mtvnservices.com/pmt/e1/access/index.html
Source: is-POBBF.tmp.8.dr	String found in binary or memory: http://media2.ntv.ru/vod/%s&tok=%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://medianetwork.oracle.com/video/player/1785452137001
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: http://mediasite.uib.no/Mediasite/Play/90bb363295d945d6b548c867d01181361d?catalog=a452b7df-9ae1-46b7
Source: is-U5DAM.tmp.8.dr	String found in binary or memory: http://mnet.interest.me/tv/vod/172790
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://mobile.ok.ru/video/20079905452
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://money.cnn.com/.element/apps/cvp2/cfg/config.xml
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://money.cnn.com/video/data/4.0/video/%s.xml
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://money.cnn.com/video/news/2016/08/19/netflix-stunning-stats.cnnmoney/index.html
Source: is-IQ4AR.tmp.8.dr	String found in binary or memory: http://moresisek.com/video.get?video=%s&callback=%s
Source: is-IQ4AR.tmp.8.dr	String found in binary or memory: http://moresisek.com/video.get?video=-108921352_456239053&callback=fn_14996814657464
Source: is-EL2LS.tmp.8.dr	String found in binary or memory: http://motherless.com/532291B
Source: is-EL2LS.tmp.8.dr	String found in binary or memory: http://motherless.com/8B4BBC1
Source: is-EL2LS.tmp.8.dr	String found in binary or memory: http://motherless.com/AC3FFE1
Source: is-EL2LS.tmp.8.dr	String found in binary or memory: http://motherless.com/g/cosplay/633979F
Source: is-EL2LS.tmp.8.dr	String found in binary or memory: http://motherless.com/g/movie_scenes
Source: is-EL2LS.tmp.8.dr	String found in binary or memory: http://motherless.com/gv/sex_must_be_funny
Source: is-0KBD9.tmp.8.dr	String found in binary or memory: http://mpos.mgoon.com/player/video?id=
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://mundonick.uol.com.br/programas/the-loud-house/videos/muitas-irmas/7ljo9j
Source: is-BUOPL.tmp.8.dr	String found in binary or memory: http://mwave.interest.me/en/meetgreet/view/256
Source: is-BUOPL.tmp.8.dr	String found in binary or memory: http://mwave.interest.me/en/mnettv/videodetail.m?searchVideoDetailVO.clip_id=176199
Source: is-BUOPL.tmp.8.dr	String found in binary or memory: http://mwave.interest.me/meetgreet/view/256
Source: is-BUOPL.tmp.8.dr	String found in binary or memory: http://mwave.interest.me/mnettv/videodetail.m?searchVideoDetailVO.clip_id=%s
Source: is-BUOPL.tmp.8.dr	String found in binary or memory: http://mwave.interest.me/mnettv/videodetail.m?searchVideoDetailVO.clip_id=168859
Source: is-BUOPL.tmp.8.dr	String found in binary or memory: http://mwave.interest.me/onair/vod_info.m?vodtype=CL&sectorid=&endinfo=Y&id=%s
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: http://my.mail.ru/
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: http://my.mail.ru/corp/hitech/video/news_hi-tech_mail_ru/1263.html
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: http://my.mail.ru/mail/720pizle/video/_myvideo/502.html
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: http://my.mail.ru/video/top#video=/mail/sonypicturesrus/75/76
Source: is-D916M.tmp.8.dr	String found in binary or memory: http://myvi.ru/player/api/Video/Get/%s?sig
Source: is-D916M.tmp.8.dr	String found in binary or memory: http://myvi.ru/player/api/Video/Get/oOy4euHA6LVwNNAjhD9_Jq5Ha2Qf0rtVMVFMAZav8wObeRTZaCATzucDQIDph8hQ
Source: is-D916M.tmp.8.dr	String found in binary or memory: http://myvi.ru/player/content/preloader.swf?id=oOy4euHA6LVwNNAjhD9_Jq5Ha2Qf0rtVMVFMAZav8wOYf1WFpPfc_
Source: is-D916M.tmp.8.dr	String found in binary or memory: http://myvi.ru/player/embed/html/oOy4euHA6LVwNNAjhD9_Jq5Ha2Qf0rtVMVFMAZav8wObeRTZaCATzucDQIDph8hQU0
Source: is-D916M.tmp.8.dr	String found in binary or memory: http://myvi.ru/player/flash/ocp2qZrHI-eZnHKQBK4cZV60hslH8LALnk0uBfKsB-Q4WnY26SeGoYPi8HWHxu0O30
Source: is-D916M.tmp.8.dr	String found in binary or memory: http://myvi.tv/embed/html/oTGTNWdyz4Zwy_u1nraolwZ1odenTd9WkTnRfIL9y8VOgHYqOHApE575x4_xxS9Vn0?ap=0
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://national.ballet.ca/interact/video/Lost_in_Motion_II/
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://nba.cdn.turner.com/nba/big
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://nbavod-f.akamaihd.net
Source: is-LIA0O.tmp.8.dr	String found in binary or memory: http://ndr2.radio.de/
Source: is-CU7PP.tmp.8.dr	String found in binary or memory: http://news.cts.com.tw/action/test_mp4feed.php
Source: is-CU7PP.tmp.8.dr	String found in binary or memory: http://news.cts.com.tw/cts/international/201309/201309031304098.html
Source: is-CU7PP.tmp.8.dr	String found in binary or memory: http://news.cts.com.tw/cts/international/201501/201501291578109.html
Source: is-CU7PP.tmp.8.dr	String found in binary or memory: http://news.cts.com.tw/cts/money/201501/201501291578003.html
Source: is-Q5PN4.tmp.8.dr	String found in binary or memory: http://news.morningstar.com/cover/videocenter.aspx?id=825556
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: http://nightbringer.bandcamp.com/album/hierophany-of-the-open-grave
Source: is-V9RPF.tmp.8.dr	String found in binary or memory: http://njpwworld.com/p/s_series_00155_1_9/
Source: is-9JPKD.tmp.8.dr	String found in binary or memory: http://noco.tv/cdata/js/player/NocoPlayer-v1.2.40.swf
Source: is-9JPKD.tmp.8.dr	String found in binary or memory: http://noco.tv/emission/11538/nolife/ami-ami-idol-hello-france/
Source: is-9JPKD.tmp.8.dr	String found in binary or memory: http://noco.tv/emission/12610/lbl42/the-guild/s01e01-wake-up-call
Source: is-MEV4S.tmp.8.dr	String found in binary or memory: http://noovo.ca/videos/l-amour-est-dans-le-pre/episode-13-8
Source: is-MEV4S.tmp.8.dr	String found in binary or memory: http://noovo.ca/videos/rpm-plus/chrysler-imperial
Source: is-N9L46.tmp.8.dr	String found in binary or memory: http://noticias.r7.com/record-news/video/representante-do-instituto-sou-da-paz-fala-sobre-fim-do-est
Source: is-5F90G.tmp.8.dr	String found in binary or memory: http://nx-%s%02d.akamaized.net/
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://ocsp.digicert.com0L
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://ok.ru/video/%s
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://ok.ru/video/20079905452
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://ok.ru/video/62036049272859-0
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://ok.ru/video/62036049272859-0)
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://ok.ru/video/63567059965189-0?fromTime=5
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://ok.ru/video/64211978996595-1
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://ok.ru/web-api/video/moviePlayer/20079905452
Source: is-90V98.tmp.8.dr	String found in binary or memory: http://pad.philharmoniedeparis.fr/doc/CIMU/1086697/jazz-a-la-villette-knower
Source: is-GBASL.tmp.8.dr	String found in binary or memory: http://parliamentlive.tv/Event/GetShareVideo/
Source: is-GBASL.tmp.8.dr	String found in binary or memory: http://parliamentlive.tv/Event/Index/c1e9d44d-fd6c-4263-b50f-97ed26cc998b
Source: is-GBASL.tmp.8.dr	String found in binary or memory: http://parliamentlive.tv/event/index/3f24936f-130f-40bf-9a5d-b3d6479da6a4
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pdf.wondershare.com/
Source: is-Q776V.tmp.8.dr	String found in binary or memory: http://pic.aebn.net/dis/t/%s/%s_%08d.jpg
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002E18000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/index.php
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=co
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D27000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=coupload
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002920000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000000.2547642375.0000000000401000.00000020.00000001.01000000.0000001A.sdmp, is-4J6FD.tmp.51.dr	String found in binary or memory: http://platform.wondershare.com/interface.php?m=downloader&client_sign=%s&product_ids=%s
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=init1)
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002DBB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=log&type=producterror
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002DC2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=log&type=productoperationQ
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=newtips
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D27000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=regcheckP
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=regcode1.
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=remind
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=suit1E
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002DBB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=ticket&type=attachement
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=times
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=upload1
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://platform.wondershare.com/interface.php?m=uploadstatus
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/ad/boxleft
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/downloader/customize
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/downloader/info
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/message/activity
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/message/linklist
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/product/recommendlist
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/product/recommendlisthttp://platform.wondershare.com/rest/downl
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/v2/downloader/runtime
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://platform.wondershare.com/rest/v2/downloader/track
Source: is-4J6FD.tmp.51.dr	String found in binary or memory: http://platform.wondershare.com/rest/v2/message/getlist/?client_sign=%s&product_ids=%s&user_type=%s&
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002920000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000000.2547642375.0000000000401000.00000020.00000001.01000000.0000001A.sdmp, WSHelper.exe, 00000035.00000003.2552219662.0000000002E18000.00000004.00001000.00020000.00000000.sdmp, is-4J6FD.tmp.51.dr	String found in binary or memory: http://platform.wondershare.com/time.php
Source: is-F2B86.tmp.8.dr	String found in binary or memory: http://play.acast.com/s/ft-banking-weekly
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://play.novatv.bg/programi/zdravei-bulgariya/624952?autostart=true
Source: is-CCLHC.tmp.8.dr	String found in binary or memory: http://play.rmcnmv.naver.com/vod/play/v2.0/
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://play.tv3.lt/programos/moterys-meluoja-geriau/409229?autostart=true
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://playapi.mtgx.tv/v3/videos/%s
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://playapi.mtgx.tv/v3/videos/stream/%s
Source: is-N9L46.tmp.8.dr	String found in binary or memory: http://player-api.r7.com/video/i/%s
Source: is-SEMJ9.tmp.8.dr	String found in binary or memory: http://player.ina.fr/notices/%s.mrss
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: http://player.ooyala.com/
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: http://player.ooyala.com/player.js?embedCode=%s
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: http://player.ooyala.com/player.js?embedCode=FiOG81ZTrvckcchQxmalf4aQj590qTEx
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: http://player.ooyala.com/player.js?embedCode=pxczE2YjpfHfn1f3M-ykG_AmJRRn0PD8
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: http://player.ooyala.com/player.js?embedCode=w2bnZtYjE6axZ_dw1Cd0hQtXd_ige2Is
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: http://player.ooyala.com/player.js?embedCode=x1b3lqZDq9y_7kMyC2Op5qo-p077tXD0
Source: is-N9L46.tmp.8.dr	String found in binary or memory: http://player.r7.com/video/i/%s
Source: is-N9L46.tmp.8.dr	String found in binary or memory: http://player.r7.com/video/i/54e7050b0cf2ff57e0279389?play=true&video=http://vsh.r7.com/54e7050b0cf2
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://player.twitch.tv/?t=5m10s&video=v6528877
Source: is-886R8.tmp.8.dr, is-6K02C.tmp.8.dr	String found in binary or memory: http://player.vimeo.com/video/%s
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://player.youku.com/player.php/sid/XNDgyMDQ2NTQw/v.swf
Source: is-60Q6B.tmp.8.dr, is-PBT7D.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/%s/%s_%s/index.html?videoId=%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/%s/%s_%s/index.min.js
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/%s/default_default/index.html?videoId=%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/1305187701/c832abfb-641b-44eb-9da0-2fe76786505f_default/index.html?vid
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/1582188683001/HkiHLnNRx_default/index.html?videoId=%s
Source: is-JA8LC.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/1659832546/default_default/index.html?videoId=%s
Source: is-E009F.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/1969646226001/default_default/index.html?videoId=%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/3910869709001/21519b5c-4b3b-4363-accb-bdc8f358f823_default/index.html?
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/4036320279001/5d112ed9-283f-485f-a7f9-33f42e8bc042_default/index.html?
Source: is-K6J5F.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/4460760524001/default_default/index.html?videoId=%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/5690807595001/HyZNerRl7_default/index.html?playlistId=5743160747001
Source: is-MEV4S.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/618566855001/default_default/index.html?videoId=%s
Source: is-EVQK2.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/665003303001/default_default/index.html?videoId=%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/710858724001/default_default/index.html?videoId=ref:event-stream-356
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://players.brightcove.net/929656772001/e41d32dc-ec74-459e-a845-6c69f7b724ea_default/index.html?v
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://pmd.cdn.turner.com/cnn/big
Source: is-837V4.tmp.8.dr	String found in binary or memory: http://primeshare.tv/download/238790B611
Source: is-PEDT8.tmp.8.dr	String found in binary or memory: http://prod.www.steelers.clubs.nfl.com/video-and-audio/videos/LIVE_Post_Game_vs_Browns/9d72f26a-9e2b
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://r%d-1-%s-recorded-lp-live.ums.ustream.tv/1/ustream
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://reliablesources.blogs.cnn.com/2014/02/09/criminalizing-journalism/
Source: is-T15LO.tmp.8.dr	String found in binary or memory: http://ren.tv/novosti/2015-09-25/sluchaynyy-prohozhiy-poymal-avtougonshchika-v-murmanske-video
Source: is-T15LO.tmp.8.dr	String found in binary or memory: http://ren.tv/novosti/2016-10-26/video-mikroavtobus-popavshiy-v-dtp-s-gruzovikami-v-podmoskove-prevr
Source: is-T15LO.tmp.8.dr	String found in binary or memory: http://ren.tv/player/
Source: is-T15LO.tmp.8.dr	String found in binary or memory: http://ren.tv/player/118577
Source: is-T15LO.tmp.8.dr	String found in binary or memory: http://ren.tv/video/epizod/118577
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2595841370.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2594664070.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595001253.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595292856.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595510312.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2596255981.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595142826.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2463495760.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2596164464.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595429271.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595361391.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595570980.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2594931889.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595217539.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2463604908.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2634510796.00000000034EF000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595068610.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595706018.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2620276127.0000000006FE0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595772742.00000000041D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://resource.wondershare.com/002/886/FreeYouTubeDownloaderTransferProcess.exe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2595841370.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2594664070.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595001253.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595292856.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595510312.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2596255981.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595142826.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.000000000228D000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2596164464.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595429271.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595361391.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595570980.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2594931889.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595217539.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2463604908.0000000006AE0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595068610.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595706018.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2620276127.0000000006FE0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595772742.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2594835046.00000000041D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://resource.wondershare.com/002/886/TransferUpdate.ini
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rest.wondershare.com/account/v1/webclient/login1
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rest.wondershare.com/account/v1/wondershare/checkRegAuth
Source: is-3OQP2.tmp.8.dr	String found in binary or memory: http://revision3.com/api/getPlaylist.json
Source: is-3OQP2.tmp.8.dr	String found in binary or memory: http://revision3.com/variant
Source: is-3OQP2.tmp.8.dr	String found in binary or memory: http://revision3.com/vr
Source: is-7VOM9.tmp.8.dr	String found in binary or memory: http://roosterteeth.com/episode/million-dollars-but-season-2-million-dollars-but-the-game-announceme
Source: is-7VOM9.tmp.8.dr	String found in binary or memory: http://roosterteeth.com/episode/rt-docs-the-world-s-greatest-head-massage-the-world-s-greatest-head-
Source: is-CA1U3.tmp.8.dr	String found in binary or memory: http://rspoplay.se/?m=elWuEH34SMKvaO4wO_cHBw
Source: is-QSMG3.tmp.8.dr	String found in binary or memory: http://rte.ie/radio/utils/radioplayer/rteradioweb.html#
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://s2.symcb.com0
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Itv.BB.Mercury.Common.Types
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: http://schemas.itv.com/2009/05/Common
Source: is-02OLJ.tmp.8.dr, is-5IDMG.tmp.8.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: is-7VOM9.tmp.8.dr	String found in binary or memory: http://screwattack.roosterteeth.com/episode/death-battle-season-3-mewtwo-vs-shadow
Source: is-SEMJ9.tmp.8.dr	String found in binary or memory: http://search.yahoo.com/mrss/
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://searchapp2.nba.com/nba-search/query.jsp?
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, free-youtube-downloader_full384.tmp.7.dr, is-4J6FD.tmp.51.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://sf.symcd.com0&
Source: is-0TCOQ.tmp.8.dr	String found in binary or memory: http://share.yesvideo.com/api/v3/shares/
Source: is-0TCOQ.tmp.8.dr	String found in binary or memory: http://share.yesvideo.com/s#/share/5962ad5b17744959bc002003
Source: is-0TCOQ.tmp.8.dr	String found in binary or memory: http://share.yesvideo.com/s/aQdzgvCKvcIBAvTb/embed
Source: is-L7TTG.tmp.8.dr	String found in binary or memory: http://shared.sx/0060718775
Source: chromecache_1826.62.dr	String found in binary or memory: http://sizzlejs.com/
Source: is-4ST41.tmp.8.dr	String found in binary or memory: http://sochi2014.vesti.ru/live/play/live_id/301
Source: is-4ST41.tmp.8.dr	String found in binary or memory: http://sochi2014.vesti.ru/video/index/video_id/766403
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://sportscanada.tv/canadagames/index.php/week2/figure-skating/444
Source: is-POBBF.tmp.8.dr	String found in binary or memory: http://stat.ntv.ru/services/access/token
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://stream.nbcolympics.com/2018-winter-olympics-nbcsn-evening-feb-8
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://stream.nbcolympics.com/data/%s_%s.json
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://stream.nbcsports.com/data/live_sources_%s.json
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://stream.nbcsports.com/nbcsn/generic?pid=206559
Source: is-MA652.tmp.8.dr	String found in binary or memory: http://sub.toggle.sg/toggle_api/v1.0/apiService/getSubtitleFilesForMedia?mediaId=%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://support.brightcove.com/en/video-cloud/docs/playlist-support-single-video-players
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.000000000231A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.wondershare.com
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560090764.00000000059B0000.00000004.00000800.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2559962303.00000000059B0000.00000004.00000800.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560013390.00000000059B0000.00000004.00000800.00020000.00000000.sdmp, WSHelper.exe, WSHelper.exe, 00000035.00000003.2552219662.0000000002E0A000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000003.2550583389.0000000002E20000.00000004.00000800.00020000.00000000.sdmp, is-EQ8E1.tmp.51.dr	String found in binary or memory: http://support.wondershare.com/
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2232280069.0000000002350000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.wondershare.comlhttp://www.wondershare.com/pro/youtube-downloader.html
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2917684385.00000000021BA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.wondershare.comq
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://sv.symcd.com0&
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: http://tempuri.org/
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: http://tempuri.org/PlaylistService/GetPlaylist
Source: is-7VOM9.tmp.8.dr	String found in binary or memory: http://theknow.roosterteeth.com/episode/the-know-game-news-season-1-boring-steam-sales-are-better
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://thinkweb2.com/projects/prototype/detecting-event-support-without-browser-sniffing/
Source: is-8MLDH.tmp.8.dr, is-I0I3J.tmp.8.dr	String found in binary or memory: http://trac.ffmpeg.org/ticket/6125#comment:10
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: is-CCLHC.tmp.8.dr	String found in binary or memory: http://tv.naver.com/v/395837
Source: is-CCLHC.tmp.8.dr	String found in binary or memory: http://tv.naver.com/v/81652
Source: is-N9L46.tmp.8.dr	String found in binary or memory: http://tv.r7.com/record-play/balanco-geral/videos/policiais-humilham-suspeito-a-beira-da-morte-morre
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://tv3play.tv3.ee/sisu/kodu-keset-linna/238551?autostart=true
Source: is-CCLHC.tmp.8.dr	String found in binary or memory: http://tvcast.naver.com/v/81652
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://tvplay.skaties.lv/parraides/tv3-zinas/760183
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://tvplay.skaties.lv/parraides/vinas-melo-labak/418113?autostart=true
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://udat.mtvnservices.com/service1/dispatch.htm
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: http://uipsyc.mediasite.com/mediasite/Catalog/Full/d5d79287c75243c58c50fef50174ec1b21
Source: is-VO46K.tmp.8.dr	String found in binary or memory: http://uk.businessinsider.com/how-much-radiation-youre-exposed-to-in-everyday-life-2016-6
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php/?m=upload&api_version=v2&type=ExperienceUploadWithoutId
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=download&api_version=v2&type=CompetingProduct
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002DC2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=download&api_version=v2&type=DataDicta)
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002DC2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=download&api_version=v2&type=DataPriv
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=download&api_version=v2&type=DataPrivTotal
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=download&api_version=v2&type=ProtoCheckA
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=upload&api_version=v2&type=CompetingProduct
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002DC2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=upload&api_version=v2&type=DataCount
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=upload&api_version=v2&type=ErrorLogUpload
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://us.wondershare.com/interface.php?m=upload&api_version=v2&type=ExperienceStatus
Source: is-5IDMG.tmp.8.dr	String found in binary or memory: http://v.telvi.de/
Source: is-2L65B.tmp.8.dr	String found in binary or memory: http://v.yinyuetai.com/video/2322376
Source: is-2L65B.tmp.8.dr	String found in binary or memory: http://v.yinyuetai.com/video/h5/2322376
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://v.youku.com/v_show/id_XMTI1OTczNDM5Mg==.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://v.youku.com/v_show/id_XMTc1ODE5Njcy.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://v.youku.com/v_show/id_XNjA1NzA2Njgw.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://v.youku.com/v_show/id_XODgxNjg1Mzk2_ev_1.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://v.youku.com/v_show/id_XOTUxMzg4NDMy.html
Source: is-A7TB6.tmp.8.dr	String found in binary or memory: http://v2api.play.fm/recordings/slug/%s
Source: is-UHFGR.tmp.8.dr	String found in binary or memory: http://vancouverisland.ctvnews.ca/video?clipId=761241
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://vas.sim-technik.de/vas/live/v2/videos
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://vas.sim-technik.de/vas/live/v2/videos/%s/sources
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://vas.sim-technik.de/vas/live/v2/videos/%s/sources/url
Source: is-OI4JR.tmp.8.dr	String found in binary or memory: http://vf-player-info-loader.herokuapp.com/%s.json
Source: is-6QO2H.tmp.8.dr	String found in binary or memory: http://vid.bleacherreport.com/videos/%s.akamai
Source: is-16039.tmp.8.dr	String found in binary or memory: http://video.cnbc.com/gallery/?video=%s
Source: is-16039.tmp.8.dr	String found in binary or memory: http://video.cnbc.com/gallery/?video=3000503714
Source: is-5UIA1.tmp.8.dr	String found in binary or memory: http://video.internetvideoarchive.net/player/6/configuration.ashx?domain=www.videodetective.com&cust
Source: is-0KBD9.tmp.8.dr	String found in binary or memory: http://video.mgoon.com/5582148
Source: is-TO0Q8.tmp.8.dr	String found in binary or memory: http://video.nationalgeographic.com/video/news/150210-news-crab-mating-vin?source=featuredvideo
Source: is-TO0Q8.tmp.8.dr	String found in binary or memory: http://video.nationalgeographic.com/wild/when-sharks-attack/the-real-jaws
Source: is-CFN7H.tmp.8.dr	String found in binary or memory: http://video.thestaticvube.com/video/%s/%s.mp4
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://video.tudou.com/v/XMjE4ODI3OTg2MA==.html
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://video.tudou.com/v/XMjIyNzAzMTQ4NA==.html?f=46177805
Source: is-0V1LK.tmp.8.dr	String found in binary or memory: http://video.udn.com/embed/news/300040
Source: is-CQ4RT.tmp.8.dr	String found in binary or memory: http://videocdn-pmd.ora.tv/
Source: is-N9L46.tmp.8.dr	String found in binary or memory: http://videos.r7.com/policiais-humilham-suspeito-a-beira-da-morte-morre-com-dignidade-/idmedia/54e70
Source: is-ATUD1.tmp.8.dr	String found in binary or memory: http://vimeo.com/
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: http://vimeo.com/%s
Source: is-886R8.tmp.8.dr	String found in binary or memory: http://vine.co/v/%s
Source: is-L7TTG.tmp.8.dr	String found in binary or memory: http://vivo.sx/d7ddda0e78
Source: is-USC47.tmp.8.dr	String found in binary or memory: http://vlog.xuite.net/embed/cE1xbENoLTI3NDQ3MzM2LmZsdg==?ar=0&as=0
Source: is-USC47.tmp.8.dr	String found in binary or memory: http://vlog.xuite.net/play/RGkzc1ZULTM4NjA5MTQuZmx2
Source: is-USC47.tmp.8.dr	String found in binary or memory: http://vlog.xuite.net/play/S1dDUjdyLTMyOTc3NjcuZmx2/%E5%AD%AB%E7%87%95%E5%A7%BF-%E7%9C%BC%E6%B7%9A%E
Source: is-USC47.tmp.8.dr	String found in binary or memory: http://vlog.xuite.net/play/WUxxR2xCLTI1OTI1MDk5LmZsdg==
Source: is-USC47.tmp.8.dr	String found in binary or memory: http://vlog.xuite.net/play/bWo1N1pLLTIxMzAxMTcwLmZsdg==
Source: is-BCGL4.tmp.8.dr	String found in binary or memory: http://vod-platform.net/embed/RufMcytHDolTH1MuKHY9Fw
Source: is-GBASL.tmp.8.dr	String found in binary or memory: http://vodplayer.parliamentlive.tv/?mid=
Source: is-CFN7H.tmp.8.dr	String found in binary or memory: http://vube.com/Chiara
Source: is-CFN7H.tmp.8.dr	String found in binary or memory: http://vube.com/SerainaMusic/my-7-year-old-sister-and-i-singing-alive-by-krewella/UeBhTudbfS?t=s&n=1
Source: is-CFN7H.tmp.8.dr	String found in binary or memory: http://vube.com/api/video/%s/comment
Source: is-CFN7H.tmp.8.dr	String found in binary or memory: http://vube.com/t-api/v1/video/%s
Source: is-CFN7H.tmp.8.dr	String found in binary or memory: http://vube.com/trending/William
Source: is-CFN7H.tmp.8.dr	String found in binary or memory: http://vube.com/vote/Siren
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://watch.nba.com/video/channels/playoffs/2015/05/20/0041400301-cle-atl-recap.nba
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://webreflection.blogspot.com/2007/08/global-scope-evaluation-and-dom.html
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, WSHelper.exe, 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: http://whereismyip.com/
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: http://whereismyip.com/%sChineseLocalSettingGuidPidErrorTypeErrorUnixTimeCrashFilePathNoticeFilePath
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.7tv.de/circus-halligalli/615-best-of-circus-halligalli-ganze-folge
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://www.8tv.cat/8aldia/videos/xavier-sala-i-martin-aquesta-tarda-a-8-al-dia/
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.Daniusoft.com/
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002DDF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.Daniusoft.com/i
Source: is-D76KL.tmp.8.dr	String found in binary or memory: http://www.KeepVid.com
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2561455772.0000000002168000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2561264387.0000000000566000.00000004.00000020.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2469121018.00000000028F0000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000002.2562177360.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.Wondershare.com/
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2469222148.0000000002168000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2561455772.0000000002168000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.Wondershare.com/J
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2561264387.0000000000566000.00000004.00000020.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000002.2562177360.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.Wondershare.com/iFFc
Source: is-7I7AC.tmp.8.dr	String found in binary or memory: http://www.add-anime.net/watch_video.php?v=24MR3YO5SAS9
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: http://www.adultswim.com/videos/attack-on-titan
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: http://www.adultswim.com/videos/decker/inside-decker-a-new-hero/
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: http://www.adultswim.com/videos/streams/williams-stream
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: http://www.adultswim.com/videos/tim-and-eric-awesome-show-great-job/dr-steve-brule-for-your-wine/
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.advopedia.de/videos/lenssen-klaert-auf/lenssen-klaert-auf-folge-8-staffel-3-feiertage-und
Source: is-EVQK2.tmp.8.dr	String found in binary or memory: http://www.aljazeera.com/programmes/the-slum/2014/08/deliverance-201482883754237240.html
Source: is-EVQK2.tmp.8.dr	String found in binary or memory: http://www.aljazeera.com/video/news/2017/05/sierra-leone-709-carat-diamond-auctioned-170511100111930
Source: is-6ON9P.tmp.8.dr	String found in binary or memory: http://www.alphaporno.com/videos/sensual-striptease-porn-with-samantha-alexandra/
Source: is-I8EE5.tmp.8.dr	String found in binary or memory: http://www.arte.tv/sites/en/corporate/files/complete-technical-guidelines-arte-geie-v1-05.pdf
Source: is-7DIVP.tmp.8.dr	String found in binary or memory: http://www.bild.de/video/clip/apple-ipad-air/das-koennen-die-neuen-ipads-38184146.bild.html
Source: chromecache_1873.62.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: is-D7F1A.tmp.8.dr	String found in binary or memory: http://www.bpb.de/mediathek/297/joachim-gauck-zu-1989-und-die-erinnerung-an-die-ddr
Source: is-PEDT8.tmp.8.dr	String found in binary or memory: http://www.buffalobills.com/video/videos/Rex_Ryan_Show_World_Wide_Rex/b1dcfab2-3190-4bb1-bfc0-d6e603
Source: is-VO46K.tmp.8.dr	String found in binary or memory: http://www.businessinsider.com/excel-index-match-vlookup-video-how-to-2015-2?IR=T
Source: is-03VC8.tmp.8.dr	String found in binary or memory: http://www.buzzfeed.com/abagg/this-angry-ram-destroys-a-punching-bag-like-a-boss?utm_term=4ldqpia
Source: is-03VC8.tmp.8.dr	String found in binary or memory: http://www.buzzfeed.com/craigsilverman/the-most-adorable-crash-landing-ever#.eq7pX0BAmK
Source: is-03VC8.tmp.8.dr	String found in binary or memory: http://www.buzzfeed.com/sheridanwatson/look-at-this-cute-dog-omg?utm_term=4ldqpia
Source: is-PBT7D.tmp.8.dr	String found in binary or memory: http://www.c-span.org/assets/player/ajax-player.php?os=android&html5=%s&id=%s
Source: is-PBT7D.tmp.8.dr	String found in binary or memory: http://www.c-span.org/common/services/flashXml.php?%sid=%s
Source: is-PBT7D.tmp.8.dr	String found in binary or memory: http://www.c-span.org/video/?104517-1/immigration-reforms-needed-protect-skilled-american-workers
Source: is-PBT7D.tmp.8.dr	String found in binary or memory: http://www.c-span.org/video/?313572-1/HolderonV
Source: is-PBT7D.tmp.8.dr	String found in binary or memory: http://www.c-span.org/video/?318608-1/gm-ignition-switch-recall
Source: is-PBT7D.tmp.8.dr	String found in binary or memory: http://www.c-span.org/video/?c4486943/cspan-international-health-care-models
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com/folder/450
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com/folder/853
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com/folder/853/?displayMode=defaultOrderByOrg
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com/media/13885
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com/media/13885)
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com/media/14842
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com/media/5181/
Source: is-HUQPK.tmp.8.dr	String found in binary or memory: http://www.camdemy.com/oembed/?format=json&url=
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: http://www.canvas.be/video/de-afspraak/najaar-2015/de-afspraak-veilt-voor-de-warmste-week
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: http://www.canvas.be/video/panorama/2016/pieter-0167
Source: is-T4UT6.tmp.8.dr	String found in binary or memory: http://www.cbs.com/shows/garth-brooks/video/_u7W953k6la293J7EPTd9oHkSPs6Xn6_/connect-chat-feat-garth
Source: is-ATUD1.tmp.8.dr	String found in binary or memory: http://www.chilloutzone.net/video/eine-sekunde-bevor.html
Source: is-ATUD1.tmp.8.dr	String found in binary or memory: http://www.chilloutzone.net/video/enemene-meck-alle-katzen-weg.html
Source: is-ATUD1.tmp.8.dr	String found in binary or memory: http://www.chilloutzone.net/video/icon-blending.html
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://www.cnn.com/2014/12/21/politics/obama-north-koreas-hack-not-war-but-cyber-vandalism/
Source: is-DJT4C.tmp.8.dr	String found in binary or memory: http://www.cnn.com/video/data/2.0/video/living/2014/12/22/growing-america-nashville-salemtown-board-
Source: is-T4UT6.tmp.8.dr	String found in binary or memory: http://www.colbertlateshow.com/podcasts/dYSwjqPs_X1tvbV_P2FcPWRa_qT6akTC/in-the-bad-room-with-stephe
Source: is-MHV7O.tmp.8.dr	String found in binary or memory: http://www.cosic.esat.kuleuven.be/publications/talk-78.pdf
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.csnne.com/video/snc-evening-update-wright-named-red-sox-no-5-starter
Source: is-UHFGR.tmp.8.dr	String found in binary or memory: http://www.ctvnews.ca/%s
Source: is-UHFGR.tmp.8.dr	String found in binary or memory: http://www.ctvnews.ca/1.810401
Source: is-UHFGR.tmp.8.dr	String found in binary or memory: http://www.ctvnews.ca/canadiens-send-p-k-subban-to-nashville-in-blockbuster-trade-1.2967231
Source: is-UHFGR.tmp.8.dr	String found in binary or memory: http://www.ctvnews.ca/video?binId=1.2876780
Source: is-UHFGR.tmp.8.dr	String found in binary or memory: http://www.ctvnews.ca/video?clipId=901995
Source: is-UHFGR.tmp.8.dr	String found in binary or memory: http://www.ctvnews.ca/video?playlistId=1.2966224
Source: is-96MJ3.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/player/metadata/video/p
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/playlist/xv4bw_nqtv_sport/1#video=xl8v3q
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/swf/video/x3n92nf
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/swf/x3ss1m_funny-magic-trick-barry-and-stuart_fun
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/user/%s/%s
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/user/UnderProject
Source: is-96MJ3.tmp.8.dr, is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/video/%s
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/video/x149uew_katy-perry-roar-official_musi
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/video/x20su5f_the-power-of-nightmares-1-the-rise-of-the-politics-of-fear-
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/video/x5kesuj_office-christmas-party-review-jason-bateman-olivia-munn-t-j
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/video/xhza0o
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: http://www.dailymotion.com/video/xyh2zz_leanna-decker-cyber-girl-of-the-year-desires-nude-playboy-pl
Source: is-9328D.tmp.8.dr	String found in binary or memory: http://www.democracynow.org/2015/7/3/this_flag_comes_down_today_bree
Source: is-9328D.tmp.8.dr	String found in binary or memory: http://www.democracynow.org/shows/2015/7/3
Source: is-RRIHH.tmp.8.dr	String found in binary or memory: http://www.di-mgt.com.au/rsa_alg.html#signpkcs1
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: is-JA8LC.tmp.8.dr	String found in binary or memory: http://www.discovery.de/#5332316765001
Source: is-0DPTQ.tmp.8.dr	String found in binary or memory: http://www.discoveryvr.com/watch/discovery-vr-an-introduction
Source: is-JA8LC.tmp.8.dr	String found in binary or memory: http://www.dmax.de/programme/storage-hunters-uk/videos/storage-hunters-uk-episode-6/
Source: is-MHV7O.tmp.8.dr	String found in binary or memory: http://www.ecrypt.eu.org/documents/D.SPA.17.pdf
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.fem.com/wellness/videos/wellness-video-clip-kurztripps-zum-valentinstag.html
Source: is-VC10R.tmp.8.dr	String found in binary or memory: http://www.history.com/topics/valentines-day/history-of-valentines-day/videos/bet-you-didnt-know-val
Source: is-03TNK.tmp.8.dr	String found in binary or memory: http://www.hotnewhiphop.com/ajax/media/getActions/
Source: is-03TNK.tmp.8.dr	String found in binary or memory: http://www.hotnewhiphop.com/freddie-gibbs-lay-it-down-song.1435540.html
Source: is-7M073.tmp.8.dr	String found in binary or memory: http://www.howcast.com/videos/390161-How-to-Tie-a-Square-Knot-Properly
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://www.ign.com/articles/2014/08/15/rewind-theater-wild-trailer-gamescom-2014?watch
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://www.ign.com/articles/2017/06/08/new-ducktales-short-donalds-birthday-doesnt-go-as-planned
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://www.ign.com/videos/2013/06/05/the-last-of-us-review
Source: is-SEMJ9.tmp.8.dr	String found in binary or memory: http://www.ina.fr/video/I12055569/francois-hollande-je-crois-que-c-est-clair-video.html
Source: Wondershare Helper Compact.tmp, Wondershare Helper Compact.tmp, 00000033.00000000.2467326025.0000000000401000.00000020.00000001.01000000.00000017.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://www.innosetup.com/
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: http://www.itv.com/btcc/races/btcc-2018-all-the-action-from-brands-hatch
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: http://www.itv.com/hub/mr-bean-animated-series/2a2936a0053
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: http://www.itv.com/mercury/Mercury_VideoPlayer.swf
Source: is-QHTND.tmp.8.dr	String found in binary or memory: http://www.jove.com/video-chapters?videoid=
Source: is-QHTND.tmp.8.dr	String found in binary or memory: http://www.jove.com/video/2744/electrode-positioning-montage-transcranial-direct-current
Source: is-QHTND.tmp.8.dr	String found in binary or memory: http://www.jove.com/video/51796/culturing-caenorhabditis-elegans-axenic-liquid-media-creation
Source: free-youtube-downloader_full384.exe, 00000007.00000000.2231633362.0000000000401000.00000020.00000001.01000000.00000013.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.kabeleins.de/tv/rosins-restaurants/videos/jagd-auf-fertigkost-im-elsthal-teil-2-ganze-fol
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.kabeleinsdoku.de/tv/mayday-alarm-im-cockpit/video/102-notlandung-im-hudson-river-ganze-fo
Source: is-7OS2B.tmp.8.dr	String found in binary or memory: http://www.kanal%splay.se/api/getVideo?format=FLASH&videoId=%s
Source: is-7OS2B.tmp.8.dr	String found in binary or memory: http://www.kanal%splay.se/api/subtitles/%s
Source: is-7OS2B.tmp.8.dr	String found in binary or memory: http://www.kanal11play.se/#
Source: is-7OS2B.tmp.8.dr	String found in binary or memory: http://www.kanal5play.se/#
Source: is-7OS2B.tmp.8.dr	String found in binary or memory: http://www.kanal9play.se/#
Source: is-601K9.tmp.8.dr	String found in binary or memory: http://www.karrierevideos.at/berufsvideos/mittlere-hoehere-schulen/altenpflegerin
Source: is-601K9.tmp.8.dr	String found in binary or memory: http://www.karrierevideos.at/orientierung/vaeterkarenz-und-neue-chancen-fuer-muetter-baby-was-nun
Source: is-601K9.tmp.8.dr	String found in binary or memory: http://www.karrierevideos.at/player-playlist.xml.php?p=%s
Source: is-TSR7J.tmp.8.dr	String found in binary or memory: http://www.kika.de/baumhaus/sendungen/video19636_zc-fea7f8a0_zs-4bf89c60.html
Source: is-TSR7J.tmp.8.dr	String found in binary or memory: http://www.kika.de/baumhaus/videos/video19636.html
Source: is-TSR7J.tmp.8.dr	String found in binary or memory: http://www.kika.de/sendungen/einzelsendungen/weihnachtsprogramm/einzelsendung2534.html
Source: is-TSR7J.tmp.8.dr	String found in binary or memory: http://www.kika.de/sendungen/einzelsendungen/weihnachtsprogramm/videos/video8182.html
Source: is-CA1U3.tmp.8.dr	String found in binary or memory: http://www.konserthusetplay.se/?m=CKDDnlCY-dhWAAqiMERd-A
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://www.ktvu.com/videos/news/raw-video-caltrain-releases-video-of-man-almost/vCTZdY/
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/album/%s/
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/album/502294/
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/artist/contentMusicsAjax
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/mingxing/Ali/music.htm
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/mingxing/bruno
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/mv/6480076/
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/yinyue/%s/
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/yinyue/3197154?catalog=yueku2016
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/yinyue/635632/
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/yinyue/6446136/
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://www.kuwo.cn/yy/st/mvurl?rid=MUSIC_%s
Source: is-BCGL4.tmp.8.dr	String found in binary or memory: http://www.lbcgroup.tv/watch/chapter/29143/52844/%D8%A7%D9%84%D9%86%D8%B5%D8%B1%D8%A9-%D9%81%D9%8A-%
Source: is-8TVN8.tmp.8.dr	String found in binary or memory: http://www.lnkgo.lt/visi-video/aktualai-pratesimas/ziurek-putka-trys-klausimai
Source: is-TSR7J.tmp.8.dr	String found in binary or memory: http://www.mdr.de/fakt/video189002.html
Source: is-TSR7J.tmp.8.dr	String found in binary or memory: http://www.mdr.de/kultur/audio1312272_zc-15948bad_zs-86171fdd.html
Source: is-TSR7J.tmp.8.dr	String found in binary or memory: http://www.mdr.de/kultur/videos-und-audios/audio-radio/operation-mindfuck-robert-wilson100.html
Source: is-TSR7J.tmp.8.dr	String found in binary or memory: http://www.mdr.de/mediathek/mdr-videos/a/video-1334.html
Source: is-0KBD9.tmp.8.dr	String found in binary or memory: http://www.mgoon.com/play/view/5582148
Source: is-U5DAM.tmp.8.dr	String found in binary or memory: http://www.mnet.com/tv/vod/171008
Source: is-U5DAM.tmp.8.dr	String found in binary or memory: http://www.mnet.com/tv/vod/vod_view.asp?clip_id=172790&tabMenu=
Source: is-9B57E.tmp.8.dr	String found in binary or memory: http://www.mojvideo.com/playerapi.php?v=%s&t=1
Source: is-9B57E.tmp.8.dr	String found in binary or memory: http://www.mojvideo.com/video-v-avtu-pred-mano-rdecelaska-alfi-nipic/3d1ed4497707730b2906
Source: is-Q5PN4.tmp.8.dr	String found in binary or memory: http://www.morningstar.com/cover/videocenter.aspx?id=615869
Source: is-D76KL.tmp.8.dr	String found in binary or memory: http://www.mozilla.org/2004/em-rdf#
Source: is-JKEO1.tmp.8.dr	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.msnbc.com/all-in-with-chris-hayes/watch/the-chaotic-gop-immigration-vote-314487875924
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://www.nba.com/
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://www.nba.com/%s.xml
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://www.nba.com/%s/video/%s
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://www.nba.com/clippers/news/doc-rivers-were-not-trading-blake
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://www.nba.com/timberwolves/wiggins-shootaround#
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://www.nba.com/video/games/hornets/2014/12/05/0021400276-nyk-cha-play5.nba/
Source: is-OSF6C.tmp.8.dr	String found in binary or memory: http://www.nba.com/video/games/nets/2012/12/04/0021200253-okc-bkn-recap.nba/index.html
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbc.com/Kings/video/goliath/n1806
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbc.com/saturday-night-live/video/star-wars-teaser/2832821
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbc.com/the-tonight-show/video/jimmy-fallon-surprises-fans-at-ben-jerrys/2848237
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbcnews.com/business/autos/volkswagen-11-million-vehicles-could-have-suspect-software-emi
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbcnews.com/feature/dateline-full-episodes/full-episode-family-business-n285156
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbcnews.com/nightly-news/video/nightly-news-with-brian-williams-full-broadcast-february-4
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbcnews.com/watch/dateline/full-episode--deadly-betrayal-386250819952
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbcnews.com/watch/nbcnews-com/how-twitter-reacted-to-the-snowden-interview-269389891880
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbcnews.com/widget/video-embed/701714499682
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbcolympics.com/video/justin-roses-son-leo-was-tears-after-his-dad-won-gold
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.nbcsports.com//college-basketball/ncaab/tom-izzo-michigan-st-has-so-much-respect-duke
Source: is-PFHFI.tmp.8.dr	String found in binary or memory: http://www.nerdcubed.co.uk/feed.json
Source: is-PEDT8.tmp.8.dr	String found in binary or memory: http://www.nfl.com/news/story/0ap3000000467586/article/patriots-seahawks-involved-in-lategame-skirmi
Source: is-PEDT8.tmp.8.dr	String found in binary or memory: http://www.nfl.com/videos/nfl-game-highlights/0ap3000000398478/Week-3-Redskins-vs-Eagles-highlights
Source: is-PEDT8.tmp.8.dr	String found in binary or memory: http://www.nfl.com/videos/nfl-network-top-ten/09000d5d810a6bd4/Top-10-Gutsiest-Performances-Jack-You
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nick.ch/shows/2304-adventure-time-abenteuerzeit-mit-finn-und-jake
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nick.com.pl/seriale/474-spongebob-kanciastoporty/wideo/17412-teatr-to-jest-to-rodeo-oszol
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nick.com/videos/clip/alvinnn-and-the-chipmunks-112-full-episode.html
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nick.de/playlist/3773-top-videos/videos/episode/17306-zu-wasser-und-zu-land-rauchende-erd
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nick.de/shows/342-icarly
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.at/playlist/3773-top-videos/videos/episode/77993-das-letzte-gefecht
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.be/afspeellijst/4530-top-videos/videos/episode/73917-inval-broodschapper-lari
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.com.tr/programlar/sunger-bob/videolar/kayip-yatak/mgqbjy
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.dk/serier/2626-hojs-hus/videoer/761-tissepause
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.es/videos/nickelodeon-consejos-tortitas/f7w7xy
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.fr/programmes/bob-l-eponge/videos/le-marathon-de-booh-kini-bottom-mardi-31-oc
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.hu/musorok/spongyabob-kockanadrag/videok/episodes/buborekfujas-az-elszakadt-n
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.nl/shows/474-spongebob/videos/17403-een-kijkje-in-de-keuken-met-sandy-van-bin
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.no/program/2626-bulderhuset/videoer/90947-femteklasse-veronica-vs-vanzilla
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.pt/series/spongebob-squarepants/videos/a-bolha-de-tinta-gigante/xutq1b
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.ro/emisiuni/shimmer-si-shine/video/nahal-din-bomboane/uw5u2k
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.ru/shows/henrydanger/videos/episodes/3-sezon-15-seriya-licenziya-na-polyot/pm
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.ru/videos/smotri-na-nickelodeon-v-iyule/g9hvh7
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickelodeon.se/serier/2626-lugn-i-stormen/videos/998-
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickjr.com.br/patrulha-canina/videos/210-labirinto-de-pipoca/
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickjr.com/paw-patrol/videos/pups-save-a-goldrush-s3-ep302-full-episode/
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickjr.de/blaze-und-die-monster-maschinen/videos/f6caaf8f-e4e8-4cc1-b489-9380d6dcd059/
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nickjr.nl/paw-patrol/videos/311-ge-wol-dig-om-terug-te-zijn/
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nicknight.at/shows/1900-faking-it
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nicknight.at/shows/977-awkward
Source: is-G4FR5.tmp.8.dr	String found in binary or memory: http://www.nicknight.at/shows/977-awkward/videos/85987-nimmer-beste-freunde
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: http://www.nowness.com/iframe?id=%s
Source: is-POBBF.tmp.8.dr	String found in binary or memory: http://www.ntv.ru/kino/Koma_film
Source: is-POBBF.tmp.8.dr	String found in binary or memory: http://www.ntv.ru/novosti/863142/
Source: is-POBBF.tmp.8.dr	String found in binary or memory: http://www.ntv.ru/peredacha/segodnya/m23700/o232416
Source: is-POBBF.tmp.8.dr	String found in binary or memory: http://www.ntv.ru/serial/Delo_vrachey/m31760/o233916/
Source: is-POBBF.tmp.8.dr	String found in binary or memory: http://www.ntv.ru/vi%s/
Source: is-POBBF.tmp.8.dr	String found in binary or memory: http://www.ntv.ru/video/novosti/750370/
Source: is-6UABB.tmp.8.dr	String found in binary or memory: http://www.nzz.ch/zuerich/gymizyte/gymizyte-schreiben-schueler-heute-noch-diktate-ld.9153
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://www.ok.ru/video/20648036891
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: http://www.ok.ru/videoembed/20648036891
Source: is-GBOPJ.tmp.8.dr	String found in binary or memory: http://www.openssh.com/txt/socks4.protocol
Source: is-GBOPJ.tmp.8.dr	String found in binary or memory: http://www.openssh.com/txt/socks4a.protocol
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................BB
Source: is-PEDT8.tmp.8.dr	String found in binary or memory: http://www.patriots.com/video/2015/09/18/10-days-gillette
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://www.pcmag.com/article2/0
Source: is-N2NIV.tmp.8.dr	String found in binary or memory: http://www.pcmag.com/videos/2015/01/06/010615-whats-new-now-is-gogo-snooping-on-your-data
Source: is-T93QJ.tmp.8.dr	String found in binary or memory: http://www.pinkbike.com/video/%s
Source: is-T93QJ.tmp.8.dr	String found in binary or memory: http://www.pinkbike.com/video/402811/
Source: is-0RGKH.tmp.8.dr	String found in binary or memory: http://www.playvid.com/watch/RnmBNgtrrJu
Source: is-0RGKH.tmp.8.dr	String found in binary or memory: http://www.playvid.com/watch/hwb0GpNkzgH
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://www.popcornflix.com/hoodies-vs-hooligans/7f2d2b87-bbf2-4623-acfb-ea942b4f01dd
Source: is-7OVTE.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/%s
Source: is-7OVTE.tmp.8.dr, is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/users/rushandlia/videos
Source: is-7OVTE.tmp.8.dr, is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/users/zoe_ph/videos/public
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/video/show?viewkey=648719015
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/view_video.php?viewkey=1331683002
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/view_video.php?viewkey=1331683002)
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/view_video.php?viewkey=648719015
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/view_video.php?viewkey=788152859
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/view_video.php?viewkey=ph557bbb6676d2d
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/view_video.php?viewkey=ph56fd731fce6b7
Source: is-D711J.tmp.8.dr	String found in binary or memory: http://www.pornhub.com/view_video.php?viewkey=ph572716d15a111
Source: is-Q776V.tmp.8.dr	String found in binary or memory: http://www.pornotube.com
Source: is-Q776V.tmp.8.dr	String found in binary or memory: http://www.pornotube.com/orientation/straight/video/4964/title/weird-hot-and-wet-science
Source: is-02DMS.tmp.8.dr	String found in binary or memory: http://www.pornoxo.com/videos/7564/striptease-from-sexy-secretary.html
Source: is-TJML1.tmp.8.dr	String found in binary or memory: http://www.presstv.ir/Detail/2016/04/09/459911/Australian-sewerage-treatment-facility-/
Source: is-TJML1.tmp.8.dr	String found in binary or memory: http://www.presstv.ir/Scripts/playback.js
Source: is-Q9THQ.tmp.8.dr	String found in binary or memory: http://www.promptfile.com/l/86D1CE8462-576CAAE416
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.prosieben.de
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.prosieben.de/stars/oscar-award/videos/jetzt-erst-enthuellt-das-geheimnis-von-emma-stones-
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.prosieben.de/tv/circus-halligalli/videos/218-staffel-2-episode-18-jahresrueckblick-ganze-
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.prosieben.de/tv/joko-gegen-klaas/videos/playlists/episode-8-ganze-folge-playlist
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.prosieben.de/videokatalog/Gesellschaft/Leben/Trends/video-Lady-Umstyling-f%C3%BCr-Audrina
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.prosiebenmaxx.de/tv/experience/video/144-countdown-fuer-die-autowerkstatt-ganze-folge
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.ran.de/fussball/bundesliga/video/schalke-toennies-moechte-raul-zurueck-ganze-folge
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://www.redbull.com/en/bike/stories/1331655643987/replay-uci-dh-world-cup-2014-from-fort-william
Source: is-5IDMG.tmp.8.dr	String found in binary or memory: http://www.regio-tv.de/video/395808
Source: is-5IDMG.tmp.8.dr	String found in binary or memory: http://www.regio-tv.de/video/395808.html
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.0000000002490000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000000.2235579555.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Wondershare Helper Compact.exe, 00000032.00000003.2465998525.0000000002310000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.exe, 00000032.00000003.2466393580.00000000020E8000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, Wondershare Helper Compact.tmp, 00000033.00000000.2467326025.0000000000401000.00000020.00000001.01000000.00000017.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: Wondershare Helper Compact.exe, 00000032.00000003.2465998525.0000000002310000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.exe, 00000032.00000003.2466393580.00000000020E8000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000000.2467326025.0000000000401000.00000020.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: is-3OQP2.tmp.8.dr	String found in binary or memory: http://www.revision3.com/technobuffalo/5-google-predictions-for-2016
Source: is-5UIA1.tmp.8.dr	String found in binary or memory: http://www.rottentomatoes.com/m/toy_story_3/trailers/11028566/
Source: is-QSMG3.tmp.8.dr	String found in binary or memory: http://www.rte.ie/player/ie/show/iwitness-862/10478715/
Source: is-QSMG3.tmp.8.dr	String found in binary or memory: http://www.rte.ie/radio/utils/radioplayer/rteradioweb.html#
Source: is-QSMG3.tmp.8.dr	String found in binary or memory: http://www.rte.ie/rteavgen/getplaylist/?type=web&format=json&id=
Source: is-PG89R.tmp.8.dr	String found in binary or memory: http://www.ruhd.ru
Source: is-PG89R.tmp.8.dr	String found in binary or memory: http://www.ruhd.ru/play.php?vid=207
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.sat1.de/film/der-ruecktritt/video/im-interview-kai-wiesinger-clip
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.sat1gold.de/tv/edel-starck/playlist/die-gesamte-1-staffel
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.sat1gold.de/tv/edel-starck/video/11-staffel-1-episode-1-partner-wider-willen-ganze-folge
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.sixx.de/stars-style/video/sexy-laufen-in-ugg-boots-clip
Source: is-P3LVQ.tmp.8.dr	String found in binary or memory: http://www.skysports.com/watch/video/10328419/bale-its-our-time-to-shine
Source: is-5F90G.tmp.8.dr	String found in binary or memory: http://www.spiegel.de/video/eifel-zoo-aufregung-um-ausgebrochene-raubtiere-video-99018031.html
Source: is-PEDT8.tmp.8.dr	String found in binary or memory: http://www.steelers.com/news/article-1/Tomlin-on-Ben-getting-Vick-ready/56399c96-4160-48cf-a7ad-1d17
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: http://www.the-voice-of-germany.de/video/31-andreas-kuemmert-rocket-man-clip
Source: is-JA8LC.tmp.8.dr	String found in binary or memory: http://www.tlc.de/sendungen/breaking-amish/videos/#3235167922001
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.today.com/video/see-the-aurora-borealis-from-space-in-stunning-new-nasa-video-66983123578
Source: is-E8K4S.tmp.8.dr	String found in binary or memory: http://www.trnicely.net/misc/mpzspsp.html
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.tv3play.ee/sisu/kodu-keset-linna/238551?autostart=true
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.tv3play.no/programmer/anna-anka-soker-assistent/230898?autostart=true
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.tv3play.se/program/husraddarna/395385?autostart=true
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.tv6play.no/programmer/hotelinspektor-alex-polizzi/361883?autostart=true
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.tv6play.se/program/den-sista-dokusapan/266636?autostart=true
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.tv8play.se/program/antikjakten/282756?autostart=true
Source: is-BTP8S.tmp.8.dr	String found in binary or memory: http://www.tvc.ru/channel/brand/id/29/show/episodes/episode_id/39702/
Source: is-BTP8S.tmp.8.dr	String found in binary or memory: http://www.tvc.ru/channel/brand/id/47/show/episodes#
Source: is-BTP8S.tmp.8.dr	String found in binary or memory: http://www.tvc.ru/news/show/id/69944
Source: is-BTP8S.tmp.8.dr	String found in binary or memory: http://www.tvc.ru/video/iframe/id/74622/isPlay/false/id_stat/channel/?acc_video_id=/channel/brand/id
Source: is-BTP8S.tmp.8.dr	String found in binary or memory: http://www.tvc.ru/video/json/id/%s
Source: is-8EH9J.tmp.8.dr	String found in binary or memory: http://www.tvland.com/feeds/mrss/
Source: is-8EH9J.tmp.8.dr	String found in binary or memory: http://www.tvland.com/full-episodes/iu0hz6/younger-a-kiss-is-just-a-kiss-season-3-ep-301
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.tvplay.lv/parraides/vinas-melo-labak/418113?autostart=true
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/TWITCHPLAYSPOKEMON)
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/acracingleague/c/5285812
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/belkao_o/v/11230755
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/miracle_doto#profile-0
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/riotgames/b/577357806
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/riotgames/v/6528877?t=5m10s
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/shroomztv
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/tsm_theoddone/c/2349361
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: http://www.twitch.tv/vanillatv/profile
Source: is-0HEL3.tmp.8.dr, is-25IMR.tmp.8.dr	String found in binary or memory: http://www.txxx.com/videos/2631606/stepmom-seduces-teen-babe/
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://www.un.org/chinese/News/story.asp?NewsID=27724
Source: is-CQ4RT.tmp.8.dr	String found in binary or memory: http://www.unsafespeech.com/video/2016/5/10/student-self-censorship-and-the-thought-police-on-univer
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://www.ustream.tv
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://www.ustream.tv/channel/channeljapan
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://www.ustream.tv/embed/10299409
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://www.ustream.tv/embed/recorded/59307601?ub=ff0000&lc=ff0000&oc=ffffff&uc=ffffff&v=3&wmode=dire
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://www.ustream.tv/recorded/
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://www.ustream.tv/recorded/20274954
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: http://www.ustream.tv/recorded/91343263
Source: is-7C2J0.tmp.8.dr	String found in binary or memory: http://www.veoh.com/embed/v56314296nk7Zdmz3
Source: is-7C2J0.tmp.8.dr	String found in binary or memory: http://www.veoh.com/watch/e152215AJxZktGS
Source: is-7C2J0.tmp.8.dr	String found in binary or memory: http://www.veoh.com/watch/v27701988pbTc4wzN?h1=Chile
Source: is-7C2J0.tmp.8.dr	String found in binary or memory: http://www.veoh.com/watch/v56314296nk7Zdmz3
Source: is-7C2J0.tmp.8.dr	String found in binary or memory: http://www.veoh.com/watch/v69525809F6Nc4frX
Source: is-4ST41.tmp.8.dr	String found in binary or memory: http://www.vesti.ru/doc.html?id=1349233
Source: is-4ST41.tmp.8.dr	String found in binary or memory: http://www.vesti.ru/only_video.html?vid=%s
Source: is-4ST41.tmp.8.dr	String found in binary or memory: http://www.vesti.ru/only_video.html?vid=576180
Source: is-4ST41.tmp.8.dr	String found in binary or memory: http://www.vesti.ru/videos?vid=575582&cid=1
Source: is-O34A5.tmp.8.dr	String found in binary or memory: http://www.vh1.com/episodes/0umwpq/hip-hop-squares-kent-user-vs-nick-young-season-1-ep-120
Source: is-O34A5.tmp.8.dr	String found in binary or memory: http://www.vh1.com/feeds/mrss/
Source: is-O34A5.tmp.8.dr	String found in binary or memory: http://www.vh1.com/video-clips/t74mif/scared-famous-scared-famous-extended-preview
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.viafree.dk/programmer/reality/paradise-hotel/saeson-7/episode-5
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.viafree.no/programmer/underholdning/det-beste-vorspielet/sesong-2/episode-1
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.viafree.se/program/livsstil/husraddarna/sasong-2/avsnitt-2
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.viafree.se/program/reality/sommaren-med-youtube-stjarnorna/sasong-1/avsnitt-1
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.viafree.se/program/reality/sommaren-med-youtube-stjarnorna/sasong-1/avsnitt-2
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.viafree.se/program/underhallning/i-like-radio-live/sasong-1/676869
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: http://www.viasat4play.no/programmer/budbringerne/21873?autostart=true
Source: is-OI4JR.tmp.8.dr	String found in binary or memory: http://www.videofy.me/thisisvideofyme/1100701
Source: is-8KJ9K.tmp.8.dr	String found in binary or memory: http://www.vidio.com/watch/165683-dj_ambred-booyah-live-2015
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: http://www.vulture.com/2016/06/letterman-couldnt-care-less-about-late-night.html
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllc
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2232280069.0000000002350000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2917684385.000000000219D000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.00000000022FD000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560090764.00000000059B0000.00000004.00000800.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2559962303.00000000059B0000.00000004.00000800.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560013390.00000000059B0000.00000004.00000800.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000003.2552219662.0000000002DDF000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000003.2550583389.0000000002E20000.00000004.00000800.00020000.00000000.sdmp, is-EQ8E1.tmp.51.dr	String found in binary or memory: http://www.wondershare.com
Source: is-6FIS2.tmp.8.dr, is-12AQJ.tmp.8.dr	String found in binary or memory: http://www.wondershare.com/
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/android-manager/?utm_source=suite-windows&utm_medium=pro&utm_camp
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/data-recovery/?utm_source=suite-windows&utm_medium=pro&utm_campai
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/data-recovery/photo-recovery.html?utm_source=suite-windows-off&utm_me
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pc-tuning/?utm_source=suite-windows-off&utm_medium=pro&utm_campai
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pdf-converter/?utm_source=suite-windows&utm_medium=pro&utm_campai
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pdf-converter/?utm_source=suite-windows-off&utm_medium=pro&utm_ca
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pdf-converter/pdf-to-excel-converter.html?utm_source=suite-windows-off&am
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pdf-converter/pdf-to-word-converter.html?utm_source=suite-windows-off&amp
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/powersuite-golden/?utm_source=suite-windows-off&utm_medium=pro&ut
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/dvd-creator.html?utm_source=suite-windows-off&utm_medium=pro&
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/dvd-ripper-platinum.html?utm_source=suite-windows-off&utm_medium=
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/dvd-slideshow-builder-deluxe.html?utm_source=suite-windows&utm_me
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/flash-gallery-factory-deluxe.html?utm_source=suite-windows-off&ut
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/free-youtube-downloader.html?utm_source=suite-windows-off&utm_med
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/photo-collage-studio.html?utm_source=suite-windows-off&utm_medium
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/streaming-audio-recorder.html?utm_source=suite-windows-off&utm_me
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/video-converter-ultimate.html?utm_source=suite-windows&utm_medium
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2917684385.000000000214D000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.00000000021F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/pro/youtube-downloader.html
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wondershare.com/video-editor/?utm_source=suite-windows-off&utm_medium=pro&utm_cam
Source: is-3031J.tmp.8.dr	String found in binary or memory: http://www.wondershare.it/
Source: is-FKE0J.tmp.8.dr	String found in binary or memory: http://www.wondershare.jp/
Source: is-QERRB.tmp.8.dr	String found in binary or memory: http://www.worldstarhiphop.com/videos/video.php?v=wshh6a7q1ny0G34ZwuIO
Source: is-08B52.tmp.8.dr	String found in binary or memory: http://www.ximalaya.com/61425525/album/5534601/
Source: is-08B52.tmp.8.dr	String found in binary or memory: http://www.ximalaya.com/61425525/sound/47740352/
Source: is-08B52.tmp.8.dr	String found in binary or memory: http://www.ximalaya.com/zhubo/61425525/
Source: is-IJ5U4.tmp.8.dr	String found in binary or memory: http://www.yapfiles.ru/get_player/?v=vMDE1NjcyNDUt0413
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: http://www.youku.com
Source: is-S2K5T.tmp.8.dr	String found in binary or memory: http://www.yourupload.com/embed/%s
Source: is-S2K5T.tmp.8.dr	String found in binary or memory: http://www.yourupload.com/embed/14i14h
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2917684385.000000000214D000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2232280069.0000000002350000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.00000000021F0000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2633321956.000000000327B000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2596255981.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2596164464.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2620276127.0000000006FE0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2596071170.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595930565.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2595995983.00000000041D0000.00000004.00000800.00020000.00000000.sdmp, FreeYouTubeDownloader.ini.8.dr	String found in binary or memory: http://www.youtube.com
Source: is-PFHFI.tmp.8.dr	String found in binary or memory: http://www.youtube.com/watch?v=
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: http://www8.hp.com/cn/zh/home.html)
Source: is-4CSR6.tmp.8.dr	String found in binary or memory: http://xboxclips.com/video.php?uid=2533274823424419&gamertag=Iabdulelah&vid=074a69a9-5faf-46aa-b93b-
Source: is-ID9LN.tmp.8.dr	String found in binary or memory: http://xpau.se/watch/prison-break/s5/e1
Source: is-JM63K.tmp.8.dr	String found in binary or memory: http://yespornplease.com/view/119147578
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://yinyue.kuwo.cn/billboard_
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: http://yinyue.kuwo.cn/yy/cinfo_86375.htm
Source: is-S2K5T.tmp.8.dr	String found in binary or memory: http://yourupload.com/watch/14i14h
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: http://youtube-dl.bandcamp.com/track/youtube-dl-test-song
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://123movies.co/movie/baby-driver-free112/?watching=HNGgShnEZp/watching.html
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://123movies.film/film/the-handmaid-s-tale-season-1-2017.74909/watching.html?episode_id=93254
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://123movies.sc/ip.file/swf/ipplayer/api.php?hash=%s
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://123movies.vg/ajax/v2_get_sources?id=%s
Source: is-LSR2L.tmp.8.dr	String found in binary or memory: https://7plus.com.au/MTYS?episode-id=MTYS7-003
Source: is-LSR2L.tmp.8.dr	String found in binary or memory: https://7plus.com.au/UUUU?episode-id=AUMS43-001
Source: is-26BG3.tmp.8.dr	String found in binary or memory: https://air.mozilla.org/privacy-lab-a-meetup-for-privacy-minded-people-in-san-francisco/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://api.%s/embeddedVideoPlayer
Source: is-Q776V.tmp.8.dr	String found in binary or memory: https://api.aebn.net/auth/v2/origins/authenticate
Source: is-Q776V.tmp.8.dr	String found in binary or memory: https://api.aebn.net/content/v2/clips/%s?fields=%s
Source: is-Q776V.tmp.8.dr	String found in binary or memory: https://api.aebn.net/delivery/v1/clips/%s/MP4
Source: is-QTLN5.tmp.8.dr	String found in binary or memory: https://api.camtube.co
Source: is-PO3VF.tmp.8.dr	String found in binary or memory: https://api.curiositystream.com/v1/
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://api.dailymotion.com/video/%s/subtitles?fields=id
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: https://api.nbc.com/v3/videos
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://api.nexx.cloud/v3/%s/%s
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://api.nexx.cloud/v3/%s/videos/byid/%s
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://api.nexx.cloud/v3/741/videos/byid/247858
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://api.nexx.cloud/v3/748/videos/byid/128907
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://api.nexxcdn.com/v3/748/videos/byid/128907
Source: is-9JPKD.tmp.8.dr	String found in binary or memory: https://api.noco.tv/1.1/%s?ts=%s&tk=%s
Source: is-P1JU9.tmp.8.dr	String found in binary or memory: https://api.services.gotomeeting.com/registrationservice/api/v1/webinars/
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://api.twitch.tv
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: https://api.ustream.tv/videos/%s.json
Source: is-IJ5U4.tmp.8.dr	String found in binary or memory: https://api.yapfiles.ru/get_player/?uid=video_player_1872528&plroll=1&adv=1&v=vMDE4NzI1Mjgt690b
Source: is-PO3VF.tmp.8.dr	String found in binary or memory: https://app.curiositystream.com/collection/2
Source: is-PO3VF.tmp.8.dr	String found in binary or memory: https://app.curiositystream.com/video/2
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://arc.nexx.cloud/api/video/%s.json
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://arc.nexx.cloud/api/video/128907.json
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: https://bandcamp.com/?blah/blah
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: https://bandcamp.com/?show=224
Source: is-QTLN5.tmp.8.dr	String found in binary or memory: https://camtube.co/recording/minafay-030618-1136-chaturbate-female
Source: is-ICEF6.tmp.8.dr	String found in binary or memory: https://cdn.portal.restudy.dk/dynamic/themes/front/awsmedia/SmilDirectory/video_%s.xml
Source: is-2OECQ.tmp.8.dr	String found in binary or memory: https://clips.abcotvs.com/kabc/video/214814
Source: is-2OECQ.tmp.8.dr	String found in binary or memory: https://clips.abcotvs.com/vogo/video/getByIds?ids=
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://clips.twitch.tv/FaintLightGullWholeWheat
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://clips.twitch.tv/api/v2/clips/%s/status
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://clips.twitch.tv/rflegendary/UninterestedBeeDAESuppy
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: https://cn.nowness.com/story/kasper-bjorke-ft-jaakko-eino-kalevi-tnr
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://collegerama.tudelft.nl/Mediasite/Play/585a43626e544bdd97aeb71a0ec907a01d
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://collegerama.tudelft.nl/Mediasite/Play/86a9ea9f53e149079fbdb4202b521ed21d?catalog=fd32fd35-6c
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://collegerama.tudelft.nl/Mediasite/Showcase/livebroadcast/Presentation/ada7020854f743c49fbb45c
Source: is-LSR2L.tmp.8.dr	String found in binary or memory: https://component-cdn.swm.digital/content/
Source: is-PO3VF.tmp.8.dr	String found in binary or memory: https://curiositystream.com/series/2
Source: is-PO3VF.tmp.8.dr	String found in binary or memory: https://curiositystream.com/video/
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: https://d2gg02c3xr550i.cloudfront.net/assets/asvp.e9c8bef24322d060ef87.bundle.js
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://de.pornhub.com/playlist/4667351
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://developer.dailymotion.com/api#access-error
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://developer.dailymotion.com/player#player-parameters
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622398781.00000000069F3000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623112740.00000000069F5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.wondershare.com/free-youtube-downloader_fu
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.wondershare.com/free-youtube-downloader_full384.exe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drfone.wondershare.com/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drfone.wondershare.com/iphone-data-recovery.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drfone.wondershare.com/store/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dvdcreator.wondershare.com/
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: https://edge.api.brightcove.com/playback/v1/accounts/%s/%ss/%s
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://educourse.ga/Bootstrap-tutorials/Using-exercise-files/110885/114408-4.html
Source: is-PG139.tmp.8.dr	String found in binary or memory: https://en.chaturbate.com/siswet19/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://famisafe.wondershare.com/
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://feedapi.b2c.on.aol.com/v1.0/app/videos/aolon/%s/details
Source: is-F2B86.tmp.8.dr	String found in binary or memory: https://feeder.acast.com/api/v1/shows/%s/episodes/%s
Source: is-QSMG3.tmp.8.dr	String found in binary or memory: https://feeds.rasset.ie/rteavgen/player/playlist?type=iptv&format=json&showId=
Source: is-VC10R.tmp.8.dr	String found in binary or memory: https://feeds.video.aetnd.com/api/v2/history/videos?filter
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filmora.wondershare.com/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filmora.wondershare.com/filmorapro-video-editor/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filmora.wondershare.com/video-editor/
Source: is-MAEJU.tmp.8.dr	String found in binary or memory: https://flashservice.xvideos.com/embedframe/41692293
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v11/1YwB1sO8YE1Lyjf12WNiUA.woff2)
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v11/EsvMC5un3kjyUhB9ZEPPwg.woff2)
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v11/H2DMvhDLycM56KNuAtbJYA.woff2)
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v11/ObQr5XYcoH0WBoUxiaYK3_Y6323mHUZFJMgTvxaG2iE.woff2)
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v11/R4a6fty3waPci7C44H8AjvY6323mHUZFJMgTvxaG2iE.woff2)
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v11/UyBMtLsHKBKXelqf4x7VRQ.woff2)
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v11/dPJ5r9gl3kK6ijoeP1IRsvY6323mHUZFJMgTvxaG2iE.woff2)
Source: chromecache_1871.62.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v11/tI4j516nok_GrVf4dhunkg.woff2)
Source: is-V9RPF.tmp.8.dr	String found in binary or memory: https://front.njpwworld.com/auth
Source: is-V9RPF.tmp.8.dr	String found in binary or memory: https://front.njpwworld.com/auth/login
Source: is-GBOPJ.tmp.8.dr	String found in binary or memory: https://gist.github.com/bluec0re/cafd3764412967417fd3
Source: is-9199H.tmp.8.dr	String found in binary or memory: https://github.com/rg3/youtube-dl/issues/10165
Source: is-9199H.tmp.8.dr	String found in binary or memory: https://github.com/rg3/youtube-dl/issues/10448).
Source: is-7OVTE.tmp.8.dr	String found in binary or memory: https://github.com/rg3/youtube-dl/issues/11594).
Source: is-8MLDH.tmp.8.dr, is-I0I3J.tmp.8.dr	String found in binary or memory: https://github.com/rg3/youtube-dl/issues/11800#issuecomment-275037127
Source: is-4EAAL.tmp.8.dr	String found in binary or memory: https://github.com/rg3/youtube-dl/issues/6057#issuecomment-126129799)
Source: is-8MLDH.tmp.8.dr, is-I0I3J.tmp.8.dr	String found in binary or memory: https://github.com/rg3/youtube-dl/issues/8300).
Source: is-I0I3J.tmp.8.dr	String found in binary or memory: https://github.com/rg3/youtube-dl/issues/955#issuecomment-209789656
Source: is-6K02C.tmp.8.dr	String found in binary or memory: https://github.com/rg3/youtube-dl/pull/7209)
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/11594).
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/12744)
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/13580)
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/1553
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/1608
Source: is-0GFDC.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/2990)
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/6215:
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/7826
Source: is-9JPKD.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/7864)
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/issues/9965)
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: https://github.com/ytdl-org/youtube-dl/pull/6242
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://go.twitch.tv/food
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://graphql.api.dailymotion.com
Source: is-96MJ3.tmp.8.dr	String found in binary or memory: https://graphql.api.dailymotion.com/
Source: is-96MJ3.tmp.8.dr, is-CHBKK.tmp.8.dr	String found in binary or memory: https://graphql.api.dailymotion.com/oauth/token
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://hitsmediaweb.h-its.org/mediasite/Play/2db6c271-681e-4f19-9af3-c60d1f82869b1d
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://hitsmediaweb.h-its.org/mediasite/Play/2db6c271681e4f199af3c60d1f82869b1d
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/guide/images/free-youtube-downloader/button-to-download.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/guide/images/free-youtube-downloader/code.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/guide/images/free-youtube-downloader/connect.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/guide/images/free-youtube-downloader/install-player.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/guide/images/free-youtube-downloader/main-interface.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/guide/images/free-youtube-downloader/settings.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/guide/images/free-youtube-downloader/transfer-to-mobile.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/guide/images/youtube-downloader/scan-code.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/drfone_logoImg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/drfone_logoimg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/filmore_logoImg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/filmore_logoimg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/mg_booster.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/multimedia/free-youtube-downloader/main-interface-1.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/multimedia/video-converter-ultimate/record-2.jpg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/multimedia/video-converter-ultimate/record-5.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/pe_logoImg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/pe_logoimg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/pro-icon/freeyoutube-downloader.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/vcu_logoImg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images/vcu_logoimg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images2016/drfone_logoImg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images2016/drfone_logoimg.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images2016/icon_money2.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images2016/icon_secure.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images2016/icon_support2.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/images2019/christmas/footer-banner.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/script/fancybox-2.0.1.css
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/script/fancybox-2.0.1.js
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/script/gdpr_ws.js
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/script/jquery-1.7.2.js
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611858668.0000000006A54000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A54000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622299497.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622299497.0000000006A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/script/mobile-sendmail.js
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/script/mobile_download.js
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/script/wsPlugs.js
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/script/wsplugs.js
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2630793163.00000000044F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2637478982.000000000452D000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2632340993.000000000452D000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/scripts/affiliate.js
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/style/images/download_icon.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/style/images/video-win.png
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/style/products.css
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622299497.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/style2016/global.css
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622299497.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.wondershare.com/style2016/pro_nav.css
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: https://insulters.bandcamp.com/album/we-are-the-plague
Source: is-T5JDG.tmp.8.dr	String found in binary or memory: https://itunes.apple.com/us/post/idsa.4ab17a39-2720-11e5-96c5-a5b38f6c42d3
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: https://jstrecords.bandcamp.com/album/entropy-ep
Source: is-39OC2.tmp.8.dr	String found in binary or memory: https://kissasian.sh
Source: chromecache_1844.62.dr	String found in binary or memory: https://lantern.roeye.com/track.php?
Source: is-2U854.tmp.8.dr	String found in binary or memory: https://lenta.ru/news/2018/03/22/savshenko_go/
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: https://link.brightcove.com/services/player/bcpid1722935254001/?bctid=5360463607001&autoStart=false&
Source: is-VC10R.tmp.8.dr	String found in binary or memory: https://link.theplatform.com/s/xc6n8B/media/9IUm_8ro4KOM?1=1&switch=hls_med_ak&assetTypes=medium_vid
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://live.libraries.psu.edu/Mediasite/Catalog/Full/8376d4b24dd1457ea3bfe4cf9163feda21
Source: is-90V98.tmp.8.dr	String found in binary or memory: https://live.philharmoniedeparis.fr
Source: is-90V98.tmp.8.dr	String found in binary or memory: https://live.philharmoniedeparis.fr/embed/1098406/berlioz-fantastique-lelio-les-siecles-national-you
Source: is-90V98.tmp.8.dr	String found in binary or memory: https://live.philharmoniedeparis.fr/embedapp/1098406/berlioz-fantastique-lelio-les-siecles-national-
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: https://log.mmstat.com/eg.js
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1928947314.000000000B40D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1928947314.000000000B40D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1928572735.0000000005A1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929277824.0000000005980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929003753.00000000059EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033(
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929003753.00000000059EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033:
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929003753.0000000005A08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: https://m.ok.ru/dk?st.cmd=movieLayer&st.discId=863789452017&st.retLoc=friend&st.rtu=%2Fdk%3Fst.cmd%3
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://m.twitch.tv/beagsandjam/v/247478721
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://m.twitch.tv/food
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://m.twitch.tv/spamfish/videos/all
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://m.twitch.tv/spamfish/videos/highlights
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://m.twitch.tv/spamfish/videos/past-broadcasts
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://m.twitch.tv/spamfish/videos/uploads
Source: is-QH99R.tmp.8.dr	String found in binary or memory: https://massengeschmack.tv/play/fktv202
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://medaudio.medicine.iu.edu/Mediasite/Catalog/Full/9518c4a6c5cf4993b21cbd53e828a92521/97a9db45f
Source: is-CJFP9.tmp.8.dr	String found in binary or memory: https://media.loc.gov/services/v1/media?id=%s&context=json
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://mediasite.ntnu.no/Mediasite/Showcase/default/Presentation/7d8b913259334b688986e970fae6fcb31d
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://mediazone.vrt.be/api/v1/%s/assets/%s
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://mediazone.vrt.be/api/v1/canvas/assets/mz-ast-5e5f90b6-2d72-4c40-82c2-e134f884e93e
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://mediazone.vrt.be/api/v1/ketnet/assets/md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://mediazone.vrt.be/api/v1/vrtvideo/assets/%s
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobiletrans.wondershare.com/
Source: is-IQ4AR.tmp.8.dr	String found in binary or memory: https://moresisek.net/watch/AXQtab_KbIU6h0293Le5w0OJeFy7bBGkOWakFLZt-cA
Source: is-EKJ2Q.tmp.8.dr	String found in binary or memory: https://msite.misis.ru/Mediasite/Catalog/catalogs/2016-industrial-management-skriabin-o-o
Source: is-39OC2.tmp.8.dr	String found in binary or memory: https://multi.idocdn.com/vip
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://munchies.vice.com/en/show/fuck-thats-delicious-2
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: https://my.mail.ru/
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: https://my.mail.ru/cgi-bin/my/ajax
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: https://my.mail.ru/music/search/black%20shadow
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: https://my.mail.ru/music/songs/%D0%BC8%D0%BB8%D1%82%D1%85-l-a-h-luciferian-aesthetics-of-herrschaft-
Source: is-2KM8D.tmp.8.dr	String found in binary or memory: https://my.mail.ru/video/embed/7949340477499637815
Source: is-P3LVQ.tmp.8.dr	String found in binary or memory: https://news.sky.com/video/russian-plane-inspected-after-deadly-fire-11712962
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://nexxtvstorage.blob.core.windows.net/files/201610/27.pdf
Source: is-V9RPF.tmp.8.dr	String found in binary or memory: https://njpwworld.com/
Source: is-9JPKD.tmp.8.dr	String found in binary or memory: https://noco.tv/do.php
Source: is-5F90G.tmp.8.dr	String found in binary or memory: https://nx-s.akamaized.net/files/201510/44.pdf
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: https://ok.ru/video/954886983203
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://passport.twitch.tv/login
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pdf.wondershare.com/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pdf.wondershare.com/buy/pdfelement-windows.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pdf.wondershare.com/pdfelement.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://photo.wondershare.com/
Source: WSHelper.exe, 00000035.00000003.2552219662.0000000002D76000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://platform.wondershare.com/interface.php?m=co
Source: is-F2B86.tmp.8.dr	String found in binary or memory: https://play-api.acast.com/splash/%s/%s
Source: is-F2B86.tmp.8.dr	String found in binary or memory: https://play.acast.com/api/
Source: is-F2B86.tmp.8.dr	String found in binary or memory: https://play.acast.com/s/%s/%s
Source: is-F2B86.tmp.8.dr	String found in binary or memory: https://play.acast.com/s/rattegangspodden/s04e09-styckmordet-i-helenelund-del-22
Source: is-F2B86.tmp.8.dr	String found in binary or memory: https://play.acast.com/s/sparpodcast/2a92b283-1a75-4ad8-8396-499c641de0d9
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=com.wondershare.mobilego
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: https://play.nova.bg/programi/zdravei-bulgariya/764300?autostart=true
Source: is-PMOFB.tmp.8.dr	String found in binary or memory: https://player.ooyala.com/player.js?externalId=espn:10365079&pcode=1kNG061cgaoolOncv54OAO1ceO-I&adSe
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://player.twitch.tv/?channel=lotsofs
Source: is-6K02C.tmp.8.dr	String found in binary or memory: https://player.vimeo.com/video/
Source: is-5HT0U.tmp.8.dr	String found in binary or memory: https://player.vimeo.com/video/%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: https://players.brightcove.net/1752604059001/S13cJdUBz_default/index.html?playlistId=5718313430001
Source: is-7O181.tmp.8.dr	String found in binary or memory: https://plays.tv/embeds/56af17f56c95335490
Source: is-7O181.tmp.8.dr	String found in binary or memory: https://plays.tv/video/%s
Source: is-7O181.tmp.8.dr	String found in binary or memory: https://plays.tv/video/56af17f56c95335490/when-you-outplay-the-azir-wall
Source: is-ICEF6.tmp.8.dr	String found in binary or memory: https://portal.restudy.dk/video/leiden-frosteffekt/id/1637
Source: is-D7P8E.tmp.8.dr	String found in binary or memory: https://public-api.wordpress.com/rest/v1.1/videos/%s
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://rechat.twitch.tv/rechat-messages
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recoverit.wondershare.com
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recoverit.wondershare.com/
Source: is-8PE7B.tmp.8.dr	String found in binary or memory: https://relapsealumni.bandcamp.com/track/hail-to-fire
Source: is-E009F.tmp.8.dr	String found in binary or memory: https://rmcdecouverte.bfmtv.com/mediaplayer-direct/
Source: is-E009F.tmp.8.dr	String found in binary or memory: https://rmcdecouverte.bfmtv.com/wheeler-dealers-occasions-a-saisir/program_2566/
Source: is-PG139.tmp.8.dr	String found in binary or memory: https://roomimg.stream.highwebmedia.com/ri/%s.jpg
Source: is-7VOM9.tmp.8.dr	String found in binary or memory: https://roosterteeth.com/login
Source: is-VC10R.tmp.8.dr	String found in binary or memory: https://signature.video.aetnd.com/v2/?
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-download.wondershare.com/drfone_full3360.exe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-download.wondershare.com/drfone_full3361.zip
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-download.wondershare.com/filmora_full846.exe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-download.wondershare.com/mac-pdfelement_full841.dmg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-download.wondershare.com/mac-video-editor_full718.dmg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-download.wondershare.com/pdfelement-pro_full5239.exe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-download.wondershare.com/video-converter-ultimate-mac_full735.dmg
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl-download.wondershare.com/video-converter-ultimate_full495.exe
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.wondershare.com/shop/buy/buy-dvd-converter-ultimate.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.wondershare.com/shop/buy/buy-mac-pdf-editor-pro.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.wondershare.com/shop/buy/buy-mac-video-converter-ultimate.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.wondershare.com/shop/buy/buy-mac-video-editor.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.wondershare.com/shop/buy/buy-video-editor.html
Source: is-ASGDO.tmp.8.dr	String found in binary or memory: https://streaming.ivideon.com/flv/live?%s
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: https://support.brightcove.com/en/video-cloud/docs/dynamically-assigning-videos-player
Source: is-60Q6B.tmp.8.dr	String found in binary or memory: https://support.brightcove.com/playback-api-video-fields-reference#key_systems_object
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.wondershare.com/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.wondershare.com/how-tos/wondershare-refund-policy.html
Source: is-7VOM9.tmp.8.dr	String found in binary or memory: https://svod-be.roosterteeth.com/api/v1/episodes/%s
Source: is-39OC2.tmp.8.dr	String found in binary or memory: https://there.to/api/source/%s
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: https://token.playmakerservices.com/cdn
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://token.vrt.be
Source: is-9199H.tmp.8.dr	String found in binary or memory: https://tools.ietf.org/html/draft-pantos-http-live-streaming-17#section-4.3.2.2
Source: is-9199H.tmp.8.dr	String found in binary or memory: https://tools.ietf.org/html/draft-pantos-http-live-streaming-17#section-4.3.2.4
Source: is-9199H.tmp.8.dr	String found in binary or memory: https://tools.ietf.org/html/draft-pantos-http-live-streaming-17#section-4.3.3.2
Source: is-9199H.tmp.8.dr	String found in binary or memory: https://tools.ietf.org/html/draft-pantos-http-live-streaming-17#section-4.3.3.5
Source: is-GBOPJ.tmp.8.dr	String found in binary or memory: https://tools.ietf.org/html/rfc1928
Source: is-GBOPJ.tmp.8.dr	String found in binary or memory: https://tools.ietf.org/html/rfc1929
Source: is-2JP7F.tmp.8.dr	String found in binary or memory: https://travis-ci.org/ytdl-org/youtube-dl/jobs/78878540
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tunesgo.wondershare.com
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: https://tvplay.skaties.lv/vinas-melo-labak/418113/?autostart=true
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: https://tvplay.skaties.lv/vinas-melo-labak/vinas-melo-labak-10280317/
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: https://tvplay.tv3.ee/cool-d-ga-mehhikosse/cool-d-ga-mehhikosse-10044354/
Source: is-SRIBD.tmp.8.dr	String found in binary or memory: https://tvplay.tv3.lt/aferistai-n-7/aferistai-10047125/
Source: is-LDPKR.tmp.8.dr	String found in binary or memory: https://tweakers.net/video/9926/new-nintendo-3ds-xl-op-alle-fronten-beter.html
Source: is-LDPKR.tmp.8.dr	String found in binary or memory: https://tweakers.net/video/s1playlist/%s/1920/1080/playlist.json
Source: is-E0O95.tmp.8.dr	String found in binary or memory: https://twitcasting.tv/ivetesangalo/movie/2357609
Source: is-E0O95.tmp.8.dr	String found in binary or memory: https://twitcasting.tv/mttbernardini/movie/3689740
Source: is-89UGD.tmp.8.dr	String found in binary or memory: https://unity3d.com/learn/tutorials/projects/2d-ufo-tutorial/following-player-camera?playlist=25844
Source: is-89UGD.tmp.8.dr	String found in binary or memory: https://unity3d.com/learn/tutorials/topics/animation/animate-anything-mecanim
Source: is-0NOC5.tmp.8.dr	String found in binary or memory: https://ups.youku.com/ups/get.json
Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://usd.swreg.org/cgi-bin/s.cgi?s=46637&p=46637-WDR001&q=1&v=15&d=0?utm_source=s
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://usher.ttvnw.net
Source: is-VM01N.tmp.8.dr	String found in binary or memory: https://v.qq.com/x/cover/rxqx32noqzdvziw/s0854s1zdp6.html
Source: is-VM01N.tmp.8.dr	String found in binary or memory: https://v.qq.com/x/cover/x6aayd03yfxv3bv.html
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: https://vas-v4.p7s1video.net/4.0/get
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://vice-web-statics-cdn.vice.com/vice-player/player-embed.js
Source: is-26BG3.tmp.8.dr	String found in binary or memory: https://vid.ly/
Source: is-0V1LK.tmp.8.dr	String found in binary or memory: https://video.udn.com/embed/news/300040
Source: is-0V1LK.tmp.8.dr	String found in binary or memory: https://video.udn.com/news/303776
Source: is-0V1LK.tmp.8.dr	String found in binary or memory: https://video.udn.com/play/news/303776
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://video.vice.com/%s/embed/%s
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://video.vice.com/alps/video/ulfs-wien-beruchtigste-grafitti-crew-part-1/581b12b60a0e1f4c0fb6ea
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://video.vice.com/en_us/embed/57f41d3556a0a80f54726060
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://video.vice.com/en_us/video/pet-cremator/58c69e38a55424f1227dc3f7
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://video.vice.com/en_us/video/pizza-show-trailer/56d8c9a54d286ed92f7f30e4
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://video.vice.com/en_us/video/the-signal-from-tolva/5816510690b70e6c5fd39a56
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://videoconverter.wondershare.com
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://videoconverter.wondershare.com/video-converter-ultimate-mac.html
Source: is-D7P8E.tmp.8.dr	String found in binary or memory: https://videopress.com/embed/iH3gstfZ
Source: is-D7P8E.tmp.8.dr	String found in binary or memory: https://videopress.com/embed/kUJmAcSf
Source: is-5HT0U.tmp.8.dr	String found in binary or memory: https://videos.raywenderlich.com/api/v1/videos/%s.json
Source: is-5HT0U.tmp.8.dr	String found in binary or memory: https://videos.raywenderlich.com/courses/105-testing-in-ios/lessons/1
Source: is-LSR2L.tmp.8.dr	String found in binary or memory: https://videoservice.swm.digital/playback
Source: is-6K02C.tmp.8.dr	String found in binary or memory: https://vimeo.com/
Source: is-6K02C.tmp.8.dr	String found in binary or memory: https://vimeo.com/%s
Source: is-6K02C.tmp.8.dr	String found in binary or memory: https://vimeo.com/channels/tributes/6213729)
Source: is-6K02C.tmp.8.dr	String found in binary or memory: https://vimeo.com/id
Source: is-6K02C.tmp.8.dr	String found in binary or memory: https://vimeo.com/search
Source: is-6QO2H.tmp.8.dr	String found in binary or memory: https://vine.co/v/%s
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://vms.vice.com/%s/video/preplay/%s
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://vms.vice.com/en_us/video/preplay/58c69e38a55424f1227dc3f7
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: https://vplayer.nbcsports.com/p/BxmELC/nbcsports_embed/select/9CsDKds0kvHI
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: https://vplayer.nbcsports.com/p/BxmELC/nbcsports_embed/select/media/_hqLjQ95yx8Z
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://wipro.udemy.com/java-tutorial/
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://wipro.udemy.com/java-tutorial/#/lecture/172757
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.%s/view_video.php?viewkey=%s
Source: is-K6J5F.tmp.8.dr	String found in binary or memory: https://www.9now.com.au/afl-footy-show/2016/clip-ciql02091000g0hp5oktrnytc
Source: is-K6J5F.tmp.8.dr	String found in binary or memory: https://www.9now.com.au/afl-footy-show/2016/episode-19
Source: is-K6J5F.tmp.8.dr	String found in binary or memory: https://www.9now.com.au/andrew-marrs-history-of-the-world/season-1/episode-1
Source: is-F2B86.tmp.8.dr	String found in binary or memory: https://www.acast.com/sparpodcast/2.raggarmordet-rosterurdetforflutna
Source: is-F2B86.tmp.8.dr	String found in binary or memory: https://www.acast.com/todayinfocus
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: https://www.adultswim.com/api/search
Source: is-ESJI5.tmp.8.dr	String found in binary or memory: https://www.adultswim.com/api/shows/v1/videos/
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.ca/video/view/u-s-woman-s-family-arrested-for-murder-first-pinned-on-panhandler-poli
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.co.uk/video/view/-one-dead-and-22-hurt-in-bus-crash-/5cb3a6f3d21f1a072b457347/
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.com/video/playlist/PL8245/5ca79d19d21f1a04035db606/
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.com/video/view/donald-trump-spokeswoman-tones-down-megyn-kelly-attacks/519442220/
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.com/video/view/netflix-is-raising-rates/5707d6b8e4b090497b04f706/
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.com/video/view/park-bench-season-2-trailer/559a1b9be4b0c3bfad3357a7/
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.com/video/view/u-s--official-warns-of-largest-ever-irs-phone-scam/518167793/
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.de/video/view/eva-braun-privataufnahmen-von-hitlers-geliebter-werden-digitalisiert/5
Source: is-5B00F.tmp.8.dr	String found in binary or memory: https://www.aol.jp/video/playlist/5a28e936a1334d000137da0c/5a28f3151e642219fde19831/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.asiancrush.com/series/012481s/scholar-walks-night/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.asiancrush.com/video/012869v/women-who-flirt/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.asiancrush.com/video/she-was-pretty/011886v-pretty-episode-3/
Source: is-VO46K.tmp.8.dr	String found in binary or memory: https://www.businessinsider.nl/5-scientifically-proven-things-make-you-less-attractive-2017-7/
Source: is-PBT7D.tmp.8.dr	String found in binary or memory: https://www.c-span.org/video/?114917-1/armed-services
Source: is-PBT7D.tmp.8.dr	String found in binary or memory: https://www.c-span.org/video/?437336-1/judiciary-antitrust-competition-policy-consumer-rights
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://www.canvas.be/check-point/najaar-2016/de-politie-uw-vriend
Source: is-3ECV5.tmp.8.dr	String found in binary or memory: https://www.cartoonnetwork.com/video/ben-10/how-to-draw-upgrade-episode.html
Source: is-PG139.tmp.8.dr	String found in binary or memory: https://www.chaturbate.com/siswet19/
Source: is-16039.tmp.8.dr	String found in binary or memory: https://www.cnbc.com/video/2018/07/19/trump-i-dont-necessarily-agree-with-raising-rates.html
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.cocoro.tv/series/008549s/the-wonderful-wizard-of-oz/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.cocoro.tv/video/the-wonderful-wizard-of-oz/008878v-the-wonderful-wizard-of-oz-ep01/
Source: is-8H5UI.tmp.8.dr	String found in binary or memory: https://www.dagbladet.no/video/PynxJnNWChE/
Source: is-8H5UI.tmp.8.dr	String found in binary or memory: https://www.dagbladet.no/video/embed/xlGmyIeN9Jo/?autoplay=false
Source: is-8H5UI.tmp.8.dr	String found in binary or memory: https://www.dagbladet.no/video/truer-iran-bor-passe-dere/PalfB2Cw
Source: is-96MJ3.tmp.8.dr, is-CHBKK.tmp.8.dr	String found in binary or memory: https://www.dailymotion.com
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://www.dailymotion.com/embed/video/
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://www.dailymotion.com/embed/video/%s
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://www.dailymotion.com/player/metadata/video/%s
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://www.dailymotion.com/user/%s
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://www.dailymotion.com/user/nqtv
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://www.dailymotion.com/video/%s
Source: is-CHBKK.tmp.8.dr	String found in binary or memory: https://www.dailymotion.com/video/x2iuewm_steam-machine-models-pricing-listed-on-steam-store-ign-new
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp.7.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.edrawsoft.com/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.edrawsoft.com/edraw-max/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.edrawsoft.com/edraw-project/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.edrawsoft.com/mindmaster/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.edrawsoft.com/orgcharting/
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://www.een.be/sorry-voor-alles/herbekijk-sorry-voor-alles
Source: is-DGCGF.tmp.8.dr	String found in binary or memory: https://www.galileo.tv/video/diese-emojis-werden-oft-missverstanden
Source: is-39OC2.tmp.8.dr	String found in binary or memory: https://www.gaobook.review/api/source/%s
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, free-youtube-downloader_full384.tmp.7.dr, is-4J6FD.tmp.51.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2233271303.00000000025A8000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2234766444.000000007FE34000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003520000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.00000000035B4000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, free-youtube-downloader_full384.tmp.7.dr, is-4J6FD.tmp.51.dr, is-MRPUM.tmp.8.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: is-8HMJU.tmp.8.dr	String found in binary or memory: https://www.googleapis.com/youtube/v3/videos?part=snippet%2CcontentDetails
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A13000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623215393.0000000006A08000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622299497.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-WRMX62N
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=gtm-wrmx62n
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hipdf.com/?utm_source=wsweb&utm_medium=footer&utm_campaign=hipdf
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hipdf.com/?utm_source=wsweb&utm_medium=header&utm_campaign=hipdf
Source: is-SEMJ9.tmp.8.dr	String found in binary or memory: https://www.ina.fr/audio/P16173408
Source: is-SEMJ9.tmp.8.dr	String found in binary or memory: https://www.ina.fr/video/P16173408-video.html
Source: is-SEMJ9.tmp.8.dr	String found in binary or memory: https://www.ina.fr/video/S806544_001/don-d-organes-des-avancees-mais-d-importants-besoins-video.html
Source: is-K6IF7.tmp.8.dr	String found in binary or memory: https://www.ispot.tv/ad/ARfj/nike-unlimited-you-featuring-serena-williams-kevin-durant
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: https://www.itv.com/hub/james-martins-saturday-morning/2a5159a0034
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: https://www.itv.com/hub/through-the-keyhole/2a2271a0033
Source: is-02OLJ.tmp.8.dr	String found in binary or memory: https://www.itv.com/hub/whos-doing-the-dishes/2a2898a0024
Source: is-ASGDO.tmp.8.dr	String found in binary or memory: https://www.ivideon.com/tv/camera/100-916ca13b5c4ad9f564266424a026386d/0/
Source: is-ASGDO.tmp.8.dr	String found in binary or memory: https://www.ivideon.com/tv/camera/100-c4ee4cb9ede885cf62dfbe93d7b53783/589824/?lang=ru
Source: is-ASGDO.tmp.8.dr	String found in binary or memory: https://www.ivideon.com/tv/map/22.917923/-31.816406/16/camera/100-e7bc16c7d4b5bbd633fd5350b66dfa9a/0
Source: is-SD2RB.tmp.8.dr	String found in binary or memory: https://www.litv.tv/promo/miyuezhuan/?content_id=VOD00044841&
Source: is-SD2RB.tmp.8.dr	String found in binary or memory: https://www.litv.tv/vod/%s/content.do?id=%s
Source: is-SD2RB.tmp.8.dr	String found in binary or memory: https://www.litv.tv/vod/ajax/getProgramInfo
Source: is-SD2RB.tmp.8.dr	String found in binary or memory: https://www.litv.tv/vod/drama/content.do?brc_id=root&id=VOD00041610&isUHEnabled=true&autoPlay=1
Source: is-SD2RB.tmp.8.dr	String found in binary or memory: https://www.litv.tv/vod/getMainUrl
Source: is-CJFP9.tmp.8.dr	String found in binary or memory: https://www.loc.gov/item/78710669/
Source: is-CJFP9.tmp.8.dr	String found in binary or memory: https://www.loc.gov/item/afc1981005_afs20503/
Source: is-CJFP9.tmp.8.dr	String found in binary or memory: https://www.loc.gov/item/ihas.200197114/
Source: is-CJFP9.tmp.8.dr	String found in binary or memory: https://www.loc.gov/today/cyberlc/feature_wdesc.php?rec=5578
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/%s/%%s-4.html
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/ASP-NET-tutorials/What-you-should-know/5034180/2811512-4.html
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/Bootstrap-tutorials/Using-exercise-files/110885/114408-4.html
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/Graphic-Design-tutorials/Grundlagen-guten-Gestaltung/393570-2.html
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/ajax/course/%s/%s/play
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/ajax/player
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/ajax/player/conviva
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/ajax/player?courseId=%s&type=course
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/ajax/player?videoId=%s&type=transcript
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/de/Graphic-Design-tutorials/Grundlagen-guten-Gestaltung/393570-2.html
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/de/Graphic-Design-tutorials/Willkommen-Grundlagen-guten-Gestaltung/393570/3935
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/player/embed/133770?tr=foo=1;bar=g;fizz=rt&fs=0
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/signin/lynda
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/signin/password
Source: is-N88RC.tmp.8.dr	String found in binary or memory: https://www.lynda.com/signin/user
Source: is-D09MU.tmp.8.dr	String found in binary or memory: https://www.mall.tv/18-miliard-pro-neziskovky-opravdu-jsou-sportovci-nebo-clovek-v-tisni-pijavice
Source: is-D09MU.tmp.8.dr	String found in binary or memory: https://www.mall.tv/kdo-to-plati/18-miliard-pro-neziskovky-opravdu-jsou-sportovci-nebo-clovek-v-tisn
Source: is-7QJPG.tmp.8.dr	String found in binary or memory: https://www.microsoftvirtualacademy.com/en-US/training-courses/microsoft-azure-fundamentals-virtual-
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.midnightpulp.com/series/016375s/mononoke/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.midnightpulp.com/video/010400v/drifters/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.midnightpulp.com/video/mononoke/016378v-zashikiwarashi-part-1/
Source: is-D916M.tmp.8.dr	String found in binary or memory: https://www.myvi.ru/watch/YwbqszQynUaHPn_s82sx0Q2
Source: is-D916M.tmp.8.dr	String found in binary or memory: https://www.myvi.tv/embed/%s
Source: is-D916M.tmp.8.dr	String found in binary or memory: https://www.myvi.tv/embed/ccdqic3wgkqwpb36x9sxg43t4r
Source: is-D916M.tmp.8.dr	String found in binary or memory: https://www.myvi.tv/idmi6o?v=ccdqic3wgkqwpb36x9sxg43t4r#watch
Source: is-TO0Q8.tmp.8.dr	String found in binary or memory: https://www.nationalgeographic.com/tv/
Source: is-TO0Q8.tmp.8.dr	String found in binary or memory: https://www.nationalgeographic.com/tv/watch/6a875e6e734b479beda26438c9f21138/
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: https://www.nbc.com/classic-tv/charles-in-charge/video/charles-in-charge-pilot/n3310
Source: is-EVHLK.tmp.8.dr	String found in binary or memory: https://www.nbc.com/up-all-night/video/day-after-valentine%27s-day/n2189
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: https://www.nowness.com/playlist/3286/i-guess-thats-why-they-call-it-the-blues
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: https://www.nowness.com/series/60-seconds
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: https://www.nowness.com/series/nowness-picks/jean-luc-godard-supercut
Source: is-GPFC6.tmp.8.dr	String found in binary or memory: https://www.nowness.com/story/candor-the-art-of-gesticulation
Source: is-6UABB.tmp.8.dr	String found in binary or memory: https://www.nzz.ch/video/nzz-standpunkte/cvp-auf-der-suche-nach-dem-mass-der-mitte-ld.1368112
Source: is-8EAS5.tmp.8.dr	String found in binary or memory: https://www.ok.ru/live/484531969818
Source: is-CQ4RT.tmp.8.dr	String found in binary or memory: https://www.ora.tv/larrykingnow/2015/12/16/vine-youtube-stars-zach-king-king-bach-on-their-viral-vid
Source: is-A7TB6.tmp.8.dr	String found in binary or memory: https://www.play.fm/dan-drastic/sven-tasnadi-leipzig-electronic-music-batofar-paris-fr-2014-07-12
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/categories/teen
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/categories/teen?page=3
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/channels/povd
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/channels/povd/videos
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/channels/povd/videos?o=da
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/channels/povd/videos?o=ra
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/channels/povd/videos?o=vi
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/described-video
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/described-video?page=2
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/hd
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/hd?page=3
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/model/zoe_ph
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/model/zoe_ph/videos
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/model/zoe_ph/videos/upload
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/model/zoe_ph?abc=1
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/playlist/44121572
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/playlist/4667351
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/jenny-blighe/videos
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/jenny-blighe/videos/upload
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/jenny-blighe/videos?page=3
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/liz-vicious
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/liz-vicious/videos/fanonly
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/liz-vicious/videos/paid
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/liz-vicious/videos?o=cm
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/liz-vicious/videos?o=lg
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/liz-vicious/videos?o=mv
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/pornstar/liz-vicious/videos?o=tr
Source: is-7OVTE.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/users/%s/videos/public/ajax?o=mr
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/users/russianveet69
Source: is-7OVTE.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/users/zoe_ph/videos/public
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/video
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/video/incategories/60fps-1/hd-porn
Source: is-7OVTE.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/video/search?search=
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/video/search?search=123
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/video?page=3
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.com/view_video.php?viewkey=ph5af5fef7c2aa7
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.pornhub.net/view_video.php?viewkey=203640933
Source: is-5HT0U.tmp.8.dr	String found in binary or memory: https://www.raywenderlich.com/3530-testing-in-ios
Source: is-5HT0U.tmp.8.dr	String found in binary or memory: https://www.raywenderlich.com/3530-testing-in-ios/lessons/1
Source: is-3JHJD.tmp.8.dr	String found in binary or memory: https://www.rbmaradio.com/shows/main-stage/episodes/ford-lopatin-live-at-primavera-sound-2011
Source: is-ICEF6.tmp.8.dr	String found in binary or memory: https://www.restudy.dk/video/play/id/1637
Source: is-D711J.tmp.8.dr	String found in binary or memory: https://www.thumbzilla.com/video/ph56c6114abd99a/horny-girlfriend-sex
Source: is-MAEJU.tmp.8.dr	String found in binary or memory: https://www.tubxporn.com/videos/12491/wild-and-wet-twin-sisters-get-fucked-and-creampie-outdoor/
Source: is-8EH9J.tmp.8.dr	String found in binary or memory: https://www.tvland.com/episodes/s04pzf/everybody-loves-raymond-the-dog-season-1-ep-19
Source: is-8EH9J.tmp.8.dr	String found in binary or memory: https://www.tvland.com/video-clips/4n87f2/younger-a-first-look-at-younger-season-6
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://www.twitch.tv/login
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://www.twitch.tv/northernlion/video/291940395
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://www.twitch.tv/sergeynixon/clip/StormyThankfulSproutFutureMan
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://www.twitch.tv/spamfish/videos/all
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://www.twitch.tv/spamfish/videos/highlights
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://www.twitch.tv/spamfish/videos/past-broadcasts
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://www.twitch.tv/spamfish/videos/uploads
Source: is-RTUM8.tmp.8.dr	String found in binary or memory: https://www.twitch.tv/videos/6528877
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/%s/learn/v4/t/lecture/%s
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/api-2.0/courses/%s/cached-subscriber-curriculum-items
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/api-2.0/users/me/subscribed-courses/%s/lectures/%s?
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/electric-bass-right-from-the-start/learn/v4/t/lecture/4580906
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/how-you-can-help-your-local-community-5-amazing-examples/learn/v4/t/lecture/32
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/ios9-swift/learn/#/lecture/3383208)
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/java-tutorial/
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/java-tutorial/#/lecture/172757
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/join/login-popup/?displayType=ajax&showSkipButton=1
Source: is-FADFS.tmp.8.dr	String found in binary or memory: https://www.udemy.com/learn-web-development-complete-step-by-step-guide-to-success/learn/v4/t/lectur
Source: is-7C2J0.tmp.8.dr	String found in binary or memory: https://www.veoh.com/watch/getVideo/
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://www.vice.com/en_us/article/cowboy-capitalists-part-1
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://www.vice.com/en_us/article/how-to-hack-a-car
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://www.vice.com/en_us/article/on-set-with-the-woman-making-mormon-porn-in-utah
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://www.vice.com/en_us/article/znm9dx/karley-sciortino-slutever-reloaded
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://www.vice.com/ru/article/big-night-out-ibiza-clive-martin-229
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://www.viceland.com/assets/common/js/web.vendor.bundle.js
Source: is-8TPIL.tmp.8.dr	String found in binary or memory: https://www.viceland.com/en_us/video/thursday-march-1-2018/5a8f2d7ff1cdb332dd446ec1
Source: is-8KJ9K.tmp.8.dr	String found in binary or memory: https://www.vidio.com/watch/77949-south-korea-test-fires-missile-that-can-strike-all-of-the-north
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://www.vrt.be/vrtnu/
Source: is-NOOU2.tmp.8.dr	String found in binary or memory: https://www.vrt.be/vrtnu/a-z/postbus-x/1/postbus-x-s1a1/
Source: is-R77SL.tmp.8.dr	String found in binary or memory: https://www.wakanim.tv/de/v2/catalogue/episode/2997/the-asterisk-war-omu-staffel-1-episode-02-omu
Source: is-R77SL.tmp.8.dr	String found in binary or memory: https://www.wakanim.tv/de/v2/catalogue/episode/7843/sword-art-online-alicization-omu-arc-2-folge-15-
Source: is-6HP6M.tmp.8.dr	String found in binary or memory: https://www.watchbox.de/filme/free-jimmy-12325.html
Source: is-6HP6M.tmp.8.dr	String found in binary or memory: https://www.watchbox.de/serien/ugly-americans-12231/staffel-1/date-in-der-hoelle-328286.html
Source: is-6HP6M.tmp.8.dr	String found in binary or memory: https://www.watchbox.de/serien/ugly-americans-12231/staffel-2/der-ring-des-powers-328270
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com
Source: chromecache_1844.62.dr	String found in binary or memory: https://www.wondershare.com.br/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2632777177.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2637874671.00000000006B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/RL
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/android-lock-scr
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/android-lock-screen-removal.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/christmas2019.html?utm_source=lpcm&utm_medium=lpcm&utm_campaign=wscm201
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/company/company.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/company/contact-us.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/company/end-user-license-agreement.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/company/join-us.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/company/partner.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/company/terms_conditions.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2634510796.0000000003435000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2632610802.0000000004601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/cookis-policy.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/cookis-policy.html).
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/de/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/drfone-how-tos/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/drfone/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2630793163.00000000044F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2631409265.000000000452B000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/es/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2630793163.00000000044F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2631409265.000000000452B000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/fr/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/guide/free-youtube-downloader.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2632777177.00000000006CC000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000002.2912899264.000000000064E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/ios-system-recovery.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/ios-whatsapp-transfer-backup-and-restore.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/iphone-unlock.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/it/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/newsletter-sub/subscribe.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/privacy.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/pro/allmytube-video-downloader.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/pro/dvd-slideshow-builder-deluxe.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2630793163.00000000044F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2637478982.000000000452D000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2632340993.000000000452D000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/pt-br/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622617537.00000000069E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/resource/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/search.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/shop/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622758387.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2623066462.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/shop/license/volume-licensing.html
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622299497.0000000006A3E000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.com/style-fonts/global_fonts.css
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2630793163.00000000044F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2631409265.000000000452B000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.wondershare.net/uninstall.html
Source: is-08B52.tmp.8.dr	String found in binary or memory: https://www.ximalaya.com/11045267/sound/15705996/
Source: is-08B52.tmp.8.dr	String found in binary or memory: https://www.ximalaya.com/zhubo/11045267/
Source: is-S2SE6.tmp.8.dr, is-SC5VJ.tmp.8.dr	String found in binary or memory: https://www.youtube.com/
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/v/ZnWpv7Q_qdQ
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/v/znwpv7q_qdq
Source: is-8HMJU.tmp.8.dr	String found in binary or memory: https://www.youtube.com/watch?v=%s
Source: is-I0UO9.tmp.8.dr, is-VBSUA.tmp.8.dr	String found in binary or memory: https://www.youtube.com/watch?v=RgKAFK5djSk
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.yuyutv.com/series/013920s/peep-show/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.yuyutv.com/video/013886v/the-act-of-killing/
Source: is-SMTMI.tmp.8.dr	String found in binary or memory: https://www.yuyutv.com/video/peep-show/013922v-warring-factions/
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://www1.123movie.cc/meego/grabber.php?ep=%s&server_name=openload&type=movies
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://www1.123movie.cc/meego/grabber.php?ep=%s&server_name=rapidvideo&type=movies
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://www1.123movie.cc/movies/%s/
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://www1.123movie.cc/movies/how-to-train-your-dragon/
Source: is-3BLM6.tmp.8.dr	String found in binary or memory: https://www1.123movies.solar/15093-the-perverts-guide-to-cinema.html#/watching.html
Source: is-O2FKK.tmp.8.dr	String found in binary or memory: https://yt-dl.org/ip

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49769 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to read the clipboard data

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: 53_2_00B8F354 GetClipboardData,CopyEnhMetaFileW,GetEnhMetaFileHeader,

53_2_00B8F354

Contains functionality to record screenshots

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: 53_2_00B8FA80 GetObjectW,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

53_2_00B8FA80

Contains functionality to retrieve information about pressed keystrokes

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: 53_2_00BBF7EC GetMessagePos,GetKeyboardState,

53_2_00BBF7EC

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\META-INF\is-8GVK8.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\META-INF\is-OLCR1.tmp			Jump to dropped file

DDoS

Too many similar processes found

Source: taskkill.exe

Process created: 40

System Summary

Contains functionality to call native functions

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0042F178 NtdllDefWindowProc_A,	51_2_0042F178
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00423B6C NtdllDefWindowProc_A,	51_2_00423B6C
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004563D8 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	51_2_004563D8
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004125C0 NtdllDefWindowProc_A,	51_2_004125C0
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004771E0 NtdllDefWindowProc_A,	51_2_004771E0

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_0042E780: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

51_2_0042E780

Contains functionality to delete services

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDB4B0 OpenSCManagerW,OpenServiceW,CloseServiceHandle,CloseServiceHandle,OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,GetLastError,MessageBoxW,DeleteService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,MessageBoxW,

56_2_00DDB4B0

Contains functionality to shutdown / reboot the system

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_00409420 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		50_2_00409420
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00454800 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		51_2_00454800

Detected potential crypto function

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_004083E4	50_2_004083E4
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00466728	51_2_00466728
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00434900	51_2_00434900
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0047EB9C	51_2_0047EB9C
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0046F304	51_2_0046F304
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004440A8	51_2_004440A8
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0045E468	51_2_0045E468
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0045A510	51_2_0045A510
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004447A0	51_2_004447A0
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004687A0	51_2_004687A0
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00430B40	51_2_00430B40
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00444BAC	51_2_00444BAC
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00484C90	51_2_00484C90
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00450D1C	51_2_00450D1C
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0043D388	51_2_0043D388
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00443B00	51_2_00443B00
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00485BC4	51_2_00485BC4
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00433BFC	51_2_00433BFC
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0042FFB4	51_2_0042FFB4
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B52474	53_2_00B52474
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00BDEBBC	53_2_00BDEBBC
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B56EF0	53_2_00B56EF0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B8D5A8	53_2_00B8D5A8
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B876A0	53_2_00B876A0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00BAF684	53_2_00BAF684
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B9DAD8	53_2_00B9DAD8
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A19BB	53_2_693A19BB
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693988A0	53_2_693988A0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A1D8D	53_2_693A1D8D
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A7C60	53_2_693A7C60
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_69396FF0	53_2_69396FF0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A2175	53_2_693A2175
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A71BE	53_2_693A71BE
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A1188	53_2_693A1188
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A9074	53_2_693A9074
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A833C	53_2_693A833C
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A770F	53_2_693A770F
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693A161D	53_2_693A161D
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6940E910	53_2_6940E910
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694129B0	53_2_694129B0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693F0B20	53_2_693F0B20
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6948CBD0	53_2_6948CBD0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694CEADB	53_2_694CEADB
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6940ACA0	53_2_6940ACA0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693FCCD0	53_2_693FCCD0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693D4170	53_2_693D4170
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6940A1E0	53_2_6940A1E0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694CE053	53_2_694CE053
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6940A350	53_2_6940A350
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694122C0	53_2_694122C0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694B45E0	53_2_694B45E0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6940C4E0	53_2_6940C4E0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694C2677	53_2_694C2677
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693FC640	53_2_693FC640
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6949C690	53_2_6949C690
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694BDA76	53_2_694BDA76
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_69411DA0	53_2_69411DA0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CDC00	53_2_693CDC00
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_69411F10	53_2_69411F10
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693EFF90	53_2_693EFF90
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6940DED0	53_2_6940DED0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693F11E0	53_2_693F11E0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Code function: 54_2_04F34ECA	54_2_04F34ECA
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Code function: 54_2_04F843F6	54_2_04F843F6
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Code function: 54_2_02831FE8	54_2_02831FE8
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Code function: 54_2_02831FD8	54_2_02831FD8
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Code function: 54_2_04F35CD0	54_2_04F35CD0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DCDD90	56_2_00DCDD90
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF10F0	56_2_00DF10F0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DE6060	56_2_00DE6060
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF2000	56_2_00DF2000
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF4180	56_2_00DF4180
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DC31B0	56_2_00DC31B0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DEB2D0	56_2_00DEB2D0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF2240	56_2_00DF2240
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E0425D	56_2_00E0425D
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF1260	56_2_00DF1260
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E0321F	56_2_00E0321F
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF94F0	56_2_00DF94F0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E0D46C	56_2_00E0D46C
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DEA589	56_2_00DEA589
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF1700	56_2_00DF1700
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF08F0	56_2_00DF08F0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF3889	56_2_00DF3889
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF1870	56_2_00DF1870
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DC1990	56_2_00DC1990
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E0D9B0	56_2_00E0D9B0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DEC970	56_2_00DEC970
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF1A80	56_2_00DF1A80
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DEAAA9	56_2_00DEAAA9
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DE9B70	56_2_00DE9B70
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DC1B30	56_2_00DC1B30
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DE0B20	56_2_00DE0B20
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF2CE0	56_2_00DF2CE0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E0FC4C	56_2_00E0FC4C
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF1C16	56_2_00DF1C16
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DEFDC0	56_2_00DEFDC0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E0EEEB	56_2_00E0EEEB
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF2EE0	56_2_00DF2EE0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DEBE80	56_2_00DEBE80
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF0E80	56_2_00DF0E80
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E01E9A	56_2_00E01E9A
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DC1E50	56_2_00DC1E50
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF2FB0	56_2_00DF2FB0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DECFA0	56_2_00DECFA0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DEDF40	56_2_00DEDF40
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF3F60	56_2_00DF3F60
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E0CF28	56_2_00E0CF28
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_100096E0	56_2_100096E0

Found potential string decryption / allocating functions

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: String function: 00DF0360 appears 32 times
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: String function: 00DF02D0 appears 43 times
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: String function: 00DF0210 appears 208 times
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: String function: 10002731 appears 63 times
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: String function: 00DC59C0 appears 114 times
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: String function: 00DF0240 appears 175 times
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: String function: 1000267A appears 44 times
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: String function: 00DFE65C appears 55 times
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: String function: 694BD0A0 appears 38 times
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: String function: 00B58708 appears 69 times
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: String function: 00B55CD0 appears 93 times
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: String function: 693C41B0 appears 132 times
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: String function: 6939DAC0 appears 33 times
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: String function: 69461B10 appears 133 times
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: String function: 693C6400 appears 32 times
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: String function: 693CD3E0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00405964 appears 108 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00406AA4 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 0044540C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 004456DC appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 004526A4 appears 89 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00433B14 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00456D64 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 004078D4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00456B58 appears 93 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00403494 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00408BEC appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: String function: 00403684 appears 163 times

PE file contains executable resources (Code or Archives)

Source: free-youtube-downloader_full384.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: free-youtube-downloader_full384.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-MRPUM.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-MRPUM.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Sample file is different than original file name gathered from version info

Source: free-youtube-downloader_setup_full384.exe, 00000000.00000000.1641913459.0000000000B80000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWAC Downloader.exe> vs free-youtube-downloader_setup_full384.exe
Source: free-youtube-downloader_setup_full384.exe, 00000000.00000000.1641866561.0000000000B6C000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNFWCHK.exe0 vs free-youtube-downloader_setup_full384.exe
Source: free-youtube-downloader_setup_full384.exe	Binary or memory string: OriginalFilenameNFWCHK.exe0 vs free-youtube-downloader_setup_full384.exe
Source: free-youtube-downloader_setup_full384.exe	Binary or memory string: OriginalFilenameWAC Downloader.exe> vs free-youtube-downloader_setup_full384.exe

Uses 32bit PE files

Source: free-youtube-downloader_setup_full384.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: is-GBHF6.tmp.8.dr, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: is-GBHF6.tmp.8.dr, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'

Source: classification engine

Classification label: sus32.phis.evad.winEXE@108/2052@126/42

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: 53_2_00B8C7A8 GetLastError,FormatMessageW,

53_2_00B8C7A8

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_00409420 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		50_2_00409420
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00454800 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		51_2_00454800

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_00455028 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

51_2_00455028

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: OpenSCManagerW,CloseServiceHandle,OpenServiceW,CloseServiceHandle,CloseServiceHandle,GetModuleFileNameW,OpenSCManagerW,MessageBoxW,CreateServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,	56_2_00DDB310
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: _RhInstallDriver@8,GetFullPathNameW,CreateFileW,CloseHandle,OpenSCManagerW,GetLastError,GetLastError,OpenServiceW,GetLastError,GetLastError,GetLastError,CreateServiceW,GetLastError,StartServiceW,DeleteService,CloseServiceHandle,CloseServiceHandle,	56_2_1000A520
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: _RtlInstallService@12,OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,GetLastError,GetLastError,CreateServiceW,GetLastError,StartServiceW,DeleteService,CloseServiceHandle,CloseServiceHandle,DeleteService,CloseServiceHandle,GetLastError,	56_2_10009D80

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDD3A0 LogD,KillTimer,VirtualQuery,GetCurrentProcessId,CreateToolhelp32Snapshot,LogD,_memset,Module32FirstW,__wcsicoll,Module32NextW,

56_2_00DDD3A0

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDD0F0 CoCreateInstance,

56_2_00DDD0F0

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe

Code function: 50_2_00409BC4 FindResourceA,SizeofResource,LoadResource,LockResource,

50_2_00409BC4

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDC5F0 RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,StartServiceCtrlDispatcherW,GetLastError,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,

56_2_00DDC5F0

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDC5F0 RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,StartServiceCtrlDispatcherW,GetLastError,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,

56_2_00DDC5F0

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

File created: C:\Program Files (x86)\Wondershare

Jump to behavior

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

File created: C:\Users\Public\Documents\Wondershare\

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5376:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4904:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Mutant created: \Sessions\1\BaseNamedObjects\MutexCBSClientCompactSetup
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Mutant created: \Sessions\1\BaseNamedObjects\Custom Server Platform Compact
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5844:120:WilError_03

Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe

File created: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp

Jump to behavior

Source: Yara match	File source: 57.0.KVYDUrlProtocol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.Wondershare Helper Compact.tmp.2920000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 53.0.WSHelper.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 51.3.Wondershare Helper Compact.tmp.2920000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000039.00000000.2589975690.0000000000401000.00000020.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match	File source: 00000035.00000000.2547642375.0000000000401000.00000020.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000003.2560443028.0000000002920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-80KG4.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-5QFBO.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-KSIMO.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-4J6FD.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-RFB4B.tmp, type: DROPPED

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Command line argument: P%		56_2_00E024A0
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Command line argument: ws2_32.dll		56_2_00DDC860

Source: free-youtube-downloader_setup_full384.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: free-youtube-downloader_setup_full384.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "ScreenCapture.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RegFloatButton.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "PluginInstallForExe.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "BrowserPlugInHelper.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "URLReqService.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "WsConverter.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "WsMediaInfo.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "DriverInstall.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "PluginInstaller.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "CreateLib.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "FreeYouTubeDownloaderUpdateHelper.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "kv_dr.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sniffer.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "FreeYouTubeDownloader.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iexplore.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "URLReqService.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "DelayPluginI.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "pluginInstall.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "BrowserPlugInHelper.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "PluginInstallForExe.exe")

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: WSHelper.exe	String found in binary or memory: jis_c6229-1984-hand-add
Source: WSHelper.exe	String found in binary or memory: jis_c6229-1984-b-add
Source: CreateLib.exe	String found in binary or memory: {72FC5BA4-24F9-4011-9F3F-ADD27AFAD818}
Source: free-youtube-downloader_setup_full384.exe	String found in binary or memory: content: %s%Y-%m-%d %H:%M:%SSoftware\Wondershare%ls\%lsPIDInstallInfo%d.%d.%d.%dSoftware\Wondershare\Wondershare Helper CompactSoftware\Wondershare\Wondershare Helper Compact\%d\%sJoinUserExperienceSOFTWARE\Microsoft\.NETFramework\policy\v2.0SOFTWARE\Microsoft\.NETFramework\policy\v2.0.50727SOFTWARE\Microsoft\.NETFramework\InstallRootNoGuiFromShim_full_trialWondersharePROCESSOR_ARCHITEW6432ProgramFiles(x86)ProgramFiles.net/http_get failed, url: %swsrpstatus/?client_sign=&product_id=downloaderruntimenameversioninstall_urldownload_urldownload_url_with_frameworkdownload_url_netdownload_url_net_with_frameworkframework_versionmajorminorbanner_urlhard_bounditempidsoft_boundYou must be logged in as administrator when installing this program.ENGERRORGetProductDownUrlFromExe failedLiveBootDownloaderLog.logDownTask_%d.xml{1DCC2C65-1109-45f8-AD2C-1CE27709ED3F}%s_%d/VERYSILENT /LANG= /NOPAGE /installpath: " /ISBind12%%s

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

File read: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe "C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe"
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Users\Public\Documents\Wondershare\NFWCHK.exe C:\Users\Public\Documents\Wondershare\NFWCHK.exe
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe "C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\"
Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	Process created: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp "C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp" /SL5="$1401F6,39165086,132096,C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\"
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM ScreenCapture.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM RegFloatButton.exe
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstallForExe.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM BrowserPlugInHelper.exe
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM URLReqService.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsConverter.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsMediaInfo.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM DriverInstall.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstaller.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM CreateLib.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM FreeYouTubeDownloaderUpdateHelper.exe
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM kv_dr.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM sniffer.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM FreeYouTubeDownloader.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM iexplore.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM URLReqService.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM DelayPluginI.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM pluginInstall.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM BrowserPlugInHelper.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM PluginInstallForExe.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe" /VERYSILENT
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Process created: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp "C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp" /SL5="$204C4,2101139,54272,C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Process created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" /regserver
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe" -add "Free YouTube Downloader" -folders "" -icon "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe"
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe" /regserver
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe"
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe" -i
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe" "register" "Allmytube" "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe"
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1832,i,1599047514705652765,13031441271017139671,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Users\Public\Documents\Wondershare\NFWCHK.exe C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe "C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\"	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	Process created: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp "C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp" /SL5="$1401F6,39165086,132096,C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM ScreenCapture.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM RegFloatButton.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstallForExe.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM BrowserPlugInHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM URLReqService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsConverter.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsMediaInfo.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM DriverInstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM CreateLib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM FreeYouTubeDownloaderUpdateHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM kv_dr.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM sniffer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM FreeYouTubeDownloader.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM iexplore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM URLReqService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM DelayPluginI.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM pluginInstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM BrowserPlugInHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM PluginInstallForExe.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe" -add "Free YouTube Downloader" -folders "" -icon "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe" /regserver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe" -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe" "register" "Allmytube" "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe"	Jump to behavior
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Process created: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp "C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp" /SL5="$204C4,2101139,54272,C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Process created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" /regserver
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1832,i,1599047514705652765,13031441271017139671,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dxtrans.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: ddrawex.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: ddraw.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: dxtmsft.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Section loaded: urlmon.dll

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32

Jump to behavior

Source: Wondershare Free YouTube Downloader.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe
Source: Wondershare Free YouTube Downloader.lnk0.8.dr	LNK file: ..\..\..\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe
Source: Wondershare Free YouTube Downloader.lnk1.8.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

File written: C:\ProgramData\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.ini

Jump to behavior

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

Window found: window name: TMainForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Automated click: Accept and Install

Uses Rich Edit Controls

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Window detected: Installation folder:C:\Program Files (x86)\Wondershare\Free ...ChangeWondershare License AgreementJoin Wondershare's customer experience improvement plan.Accept and Install

PE / OLE file has a valid certificate

Source: free-youtube-downloader_setup_full384.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: free-youtube-downloader_setup_full384.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: free-youtube-downloader_setup_full384.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: free-youtube-downloader_setup_full384.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: free-youtube-downloader_setup_full384.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: free-youtube-downloader_setup_full384.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: free-youtube-downloader_setup_full384.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: free-youtube-downloader_setup_full384.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: free-youtube-downloader_setup_full384.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: D:\CI\jenkins\workspace\Git-DownloadCore\VideoDownloader\win\PDB\Release\URLReqService.pdb source: URLReqService.exe, 00000038.00000000.2589657000.0000000000E12000.00000002.00000001.01000000.00000022.sdmp, URLReqService.exe, 00000038.00000002.2591192690.0000000000E12000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: D:\CI\jenkins\workspace\AgileTrans\Src\SymbolTable\Release\ImageProc.pdb`eI source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003B4F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WorkFolder\ID3Info\ID3InfoSolution\Newtonsoft.Json\tags\6.0.3\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: PluginInstaller.exe, 0000003A.00000002.2619694009.0000000004DC2000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: E:\svn_code\MemberCenterClient\Trunk\Src\English_Release\AutoDownloader_en.pdb source: free-youtube-downloader_setup_full384.exe
Source:	Binary string: D:\Enlistments\WPFOOB\src\wpfoob\WindowsApiCodePack\Main\Win7\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb@ source: CreateLib.exe, 00000036.00000002.2587171774.0000000004F32000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\CI\jenkins\workspace\Git-DownloadCore\VideoDownloader\win\PDB\Release\URLReqService.pdb0 source: URLReqService.exe, 00000038.00000000.2589657000.0000000000E12000.00000002.00000001.01000000.00000022.sdmp, URLReqService.exe, 00000038.00000002.2591192690.0000000000E12000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: E:\svn_code\CommonUI\CBS_Client\Trunk\Src\US1.0\DAQExp\Release\DAQExp.pdb source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: E:\Mobile\MobileMaster\TempBranch\MobileGoNew\PC\Setup\Framework_Lite\DotNetChecker\obj\x86\Release\NFWCHK.pdb source: free-youtube-downloader_setup_full384.exe
Source:	Binary string: E:\svn_code\CommonUI\CBS_Client\Trunk\Src\US1.0\DAQExp\Release\usExp.pdb source: is-E28Q8.tmp.8.dr
Source:	Binary string: p[,C:\Users\martin\34\python\PCbuild\unicodedata.pdb)6 source: is-9GJV1.tmp.8.dr
Source:	Binary string: C:\Users\martin\34\python\PCbuild\unicodedata.pdb source: is-9GJV1.tmp.8.dr
Source:	Binary string: D:\Enlistments\WPFOOB\src\wpfoob\WindowsApiCodePack\Main\Win7\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb source: CreateLib.exe, CreateLib.exe, 00000036.00000002.2587171774.0000000004F32000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\Enlistments\WPFOOB\src\wpfoob\WindowsApiCodePack\Main\Win7\WindowsAPICodePack\Shell\obj\Release\Microsoft.WindowsAPICodePack.Shell.pdb source: CreateLib.exe, CreateLib.exe, 00000036.00000002.2587379108.0000000004F82000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\KPByName\Release\KPByName.pdb source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp, Wondershare Helper Compact.tmp, 00000033.00000002.2561731574.000000000018F000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\My Document\Downloads\easyhook-69709\trunk\Release\x86\EasyHook32.pdb source: URLReqService.exe, 00000038.00000002.2593535891.000000001000E000.00000002.00000001.01000000.00000024.sdmp, is-O8S3K.tmp.8.dr
Source:	Binary string: D:\CI\jenkins\workspace\AgileTrans\Src\SymbolTable\Release\ImageProc.pdb source: free-youtube-downloader_full384.tmp, 00000008.00000003.2623466402.0000000003B4F000.00000004.00001000.00020000.00000000.sdmp

PE file contains a valid data directory to section mapping

Source: free-youtube-downloader_setup_full384.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: free-youtube-downloader_setup_full384.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: free-youtube-downloader_setup_full384.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: free-youtube-downloader_setup_full384.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: free-youtube-downloader_setup_full384.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_00447B64 LoadLibraryExA,LoadLibraryA,GetProcAddress,

51_2_00447B64

PE file contains an invalid checksum

Source: is-9GJV1.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0xc4bd8
Source: is-LQ3JT.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x23979
Source: is-9G0V2.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x1361d
Source: is-L2V8E.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x19dd0
Source: is-GKG02.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x4d26
Source: is-QKDCE.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x226e2
Source: WSUtilities.dll.8.dr	Static PE information: real checksum: 0x37717 should be: 0x3b89a
Source: is-0EHU0.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x75f5
Source: is-4RV1N.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0xd7e3
Source: _setup64.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x6a87
Source: is-8G1K8.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0xa776
Source: is-QVUL5.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x18d4c
Source: is-GUK5Q.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x23082
Source: is-GOHUU.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0xf0a9b
Source: is-22CKM.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x1487ca

Uses code obfuscation techniques (call, push, ret)

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_00406590 push 004065CDh; ret	50_2_004065C5
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_004080DC push ecx; mov dword ptr [esp], eax	50_2_004080E1
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_004040B5 push eax; ret	50_2_004040F1
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_00404185 push 00404391h; ret	50_2_00404389
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_00404206 push 00404391h; ret	50_2_00404389
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_0040C218 push eax; ret	50_2_0040C219
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_004042E8 push 00404391h; ret	50_2_00404389
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_00404283 push 00404391h; ret	50_2_00404389
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: 50_2_00408F10 push 00408F43h; ret	50_2_00408F3B
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0040992C push 00409969h; ret	51_2_00409961
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0040A027 push ds; ret	51_2_0040A028
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00476228 push ecx; mov dword ptr [esp], edx	51_2_00476229
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004062CC push ecx; mov dword ptr [esp], eax	51_2_004062CD
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0045866C push 004586B0h; ret	51_2_004586A8
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004106B8 push ecx; mov dword ptr [esp], edx	51_2_004106BD
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0040A77C push C00040C3h; ret	51_2_0040A781
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00412910 push 00412973h; ret	51_2_0041296B
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00442A78 push ecx; mov dword ptr [esp], ecx	51_2_00442A7C
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00450B58 push 00450B8Bh; ret	51_2_00450B83
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00450D1C push ecx; mov dword ptr [esp], eax	51_2_00450D21
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00456E00 push 00456E38h; ret	51_2_00456E30
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00492EC8 push ecx; mov dword ptr [esp], ecx	51_2_00492ECD
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0040D010 push ecx; mov dword ptr [esp], edx	51_2_0040D012
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0045F0C0 push ecx; mov dword ptr [esp], ecx	51_2_0045F0C4
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0040546D push eax; ret	51_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0040F570 push ecx; mov dword ptr [esp], edx	51_2_0040F572
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00483538 push ecx; mov dword ptr [esp], ecx	51_2_0048353D
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0040553D push 00405749h; ret	51_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004055BE push 00405749h; ret	51_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0040563B push 00405749h; ret	51_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004056A0 push 00405749h; ret	51_2_00405741

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\SSL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_ssl.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-UTV22.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Zip.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_hashlib.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\usExp.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File created: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\_counter.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-Q6QUF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\winrandom.pyd (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File created: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\unicodedata.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSProducstInfo.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\TempkillProcess.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-6090L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\strxor.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Users\user\AppData\Local\Temp\is-72P03.tmp\WSUtilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\KPByName.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\select.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-5QCJ0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File created: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe.~P2S	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-5SP36.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-GUK5Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-9G0V2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-SRV69.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CBSProductClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\is-I3H0J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-L2V8E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Ctrls.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_ctypes.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-E28Q8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-JMUOS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-VO72Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-GKG02.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-J909I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\EasyHook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-1UPAE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\VanMail.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-9GJV1.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	File created: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\KPByName.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-QKDCE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-545DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-QVUL5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-73IGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-235DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-VPARC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-7FPIH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-M9KTS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-ABAD5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-4RV1N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-RFB4B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_lzma.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-0EHU0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Localization.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-MRPUM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Users\user\AppData\Local\Temp\is-72P03.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-8G1K8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\EasyHook32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-4J6FD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_bz2.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\is-O8S3K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-80KG4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-NH10N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-D0T43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Users\user\AppData\Local\Temp\is-72P03.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-22CKM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-AE5UE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-O47MQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_socket.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\TempkillProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-5QFBO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-GOHUU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-P1945.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-M241L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\pyexpat.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_sqlite3.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	File created: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-LQ3JT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-GBHF6.tmp	Jump to dropped file
Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	File created: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	File created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-KSIMO.tmp	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

File created: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe.~P2S

Jump to dropped file

Creates install or setup log file

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PluginInstaller.exe.log

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare\Free YouTube Downloader\Wondershare Free YouTube Downloader.lnk

Jump to behavior

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDC5F0 RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,StartServiceCtrlDispatcherW,GetLastError,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,

56_2_00DDC5F0

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Wondershare Helper Compact.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Wondershare Helper Compact.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Wondershare Helper Compact.exe
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Wondershare Helper Compact.exe

Hooking and other Techniques for Hiding and Protection

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00423BF4 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	51_2_00423BF4
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00423BF4 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	51_2_00423BF4
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0042417C IsIconic,SetActiveWindow,	51_2_0042417C
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004241C4 IsIconic,SetActiveWindow,SetFocus,	51_2_004241C4
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_0041836C IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	51_2_0041836C
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00422844 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	51_2_00422844
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00417580 IsIconic,GetCapture,	51_2_00417580
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00481878 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	51_2_00481878
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00417CB6 IsIconic,SetWindowPos,	51_2_00417CB6
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00417CB8 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	51_2_00417CB8
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B94128 IsIconic,GetWindowPlacement,GetWindowRect,	53_2_00B94128
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00BC244C IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	53_2_00BC244C
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B9AE8C GetWindowLongW,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongW,SetWindowLongW,ShowWindow,ShowWindow,	53_2_00B9AE8C
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00BC2E14 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongW,GetWindowLongW,GetWindowLongW,ScreenToClient,ScreenToClient,	53_2_00BC2E14
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B9AE0C IsIconic,	53_2_00B9AE0C
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00BC1ADC IsIconic,GetCapture,	53_2_00BC1ADC
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B9DAD8 IsIconic,SetFocus,GetParent,SaveDC,RestoreDC,GetWindowDC,SaveDC,RestoreDC,	53_2_00B9DAD8

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_0044AC90 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

51_2_0044AC90

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2631577543.000000000445A000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2634510796.00000000034EF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES (X86)\WONDERSHARE\FREE YOUTUBE DOWNLOADER\SNIFFER.EXE
Source: free-youtube-downloader_full384.tmp, 00000008.00000002.2916493258.00000000046C6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2630693156.00000000046C2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2631785329.00000000046C6000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2631524437.00000000046C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OWNLOADER\SNIFFER.EXEC:\PROGRAM FILES (X86)\WONDERSHARE\FREE YOUTUBE DOWNLO}
Source: free-youtube-downloader_full384.tmp, 00000008.00000002.2912899264.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES (X86)\WONDERSHARE\FREE YOUTUBE DOWNLOADER\SNIFFER.EXEJ+
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2632777177.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2637874671.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES (X86)\WONDERSHARE\FREE YOUTUBE DOWNLOADER\SNIFFER.EXE}
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2633321956.000000000327B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES (X86)\WONDERSHARE\FREE YOUTUBE DOWNLOADER\SNIFFER.EXE.CONFIG
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.00000000022FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {APP}\SNIFFER.EXE.CONFIG
Source: free-youtube-downloader_full384.exe, 00000007.00000003.2917684385.000000000214D000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.exe, 00000007.00000003.2232280069.0000000002350000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.00000000021F0000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2633321956.000000000327B000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2634510796.00000000033EC000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: /F /IM SNIFFER.EXE
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0{APP}\SNIFFER.EXE.CONFIG
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2236687316.00000000031E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "{APP}\SNIFFER.EXE
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.0000000002313000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {APP}\SNIFFER.EXE
Source: free-youtube-downloader_full384.tmp, 00000008.00000003.2633321956.0000000003225000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MC:\PROGRAM FILES (X86)\WONDERSHARE\FREE YOUTUBE DOWNLOADER\SNIFFER.EXE.CONFIG

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 6720000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 69E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 6A40000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 6AA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 6B00000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 6BA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 6C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 6D80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 6DE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: A0A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: BFE0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: C000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5210000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5AF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5B30000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5B50000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5B70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5B90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5230000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5BB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5230000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5BB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5230000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5BB0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5230000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Memory allocated: 5D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Memory allocated: 10C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Memory allocated: 2F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Memory allocated: 1AF70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Memory allocated: 2830000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Memory allocated: 29A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Memory allocated: 49A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Memory allocated: 2660000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Memory allocated: 28C0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Memory allocated: 27C0000 memory reserve \| memory write watch

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DF7100 rdtsc

56_2_00DF7100

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDD3A0 LogD,KillTimer,VirtualQuery,GetCurrentProcessId,CreateToolhelp32Snapshot,LogD,_memset,Module32FirstW,__wcsicoll,Module32NextW,

56_2_00DDD3A0

Contains functionality to detect sandboxes (mouse cursor move detection)

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,

53_2_00BA4844

Contains long sleeps (>= 3 min)

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Window / User API: threadDelayed 4496			Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Window / User API: threadDelayed 5156			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\SSL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_ssl.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-UTV22.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_hashlib.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Zip.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\usExp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\_counter.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-Q6QUF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\winrandom.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\unicodedata.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\TempkillProcess.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\strxor.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-72P03.tmp\WSUtilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\KPByName.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\select.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-5QCJ0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-5SP36.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-GUK5Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-9G0V2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CBSProductClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-SRV69.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\is-I3H0J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-L2V8E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Ctrls.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_ctypes.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-E28Q8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-JMUOS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-VO72Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-GKG02.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-J909I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\EasyHook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-1UPAE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\VanMail.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-9GJV1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\KPByName.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-QKDCE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-545DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-QVUL5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-73IGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-235DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-VPARC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-7FPIH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-M9KTS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-ABAD5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-4RV1N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-RFB4B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_lzma.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-0EHU0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Localization.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-72P03.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-8G1K8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_bz2.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\is-O8S3K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-80KG4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-NH10N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-D0T43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-72P03.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-22CKM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-O47MQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-AE5UE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_socket.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\TempkillProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-GOHUU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-P1945.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-M241L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\pyexpat.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_sqlite3.pyd (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-LQ3JT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-GBHF6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-KSIMO.tmp	Jump to dropped file

Found evasive API chain (date check)

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_50-5885

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_53-115699

Found large amount of non-executed APIs

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	API coverage: 3.0 %
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	API coverage: 4.0 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe TID: 1440	Thread sleep time: -4496000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe TID: 1440	Thread sleep time: -5156000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe TID: 1620	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe TID: 7216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe TID: 7020	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp TID: 6444	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe TID: 6184	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe TID: 6736	Thread sleep time: -922337203685477s >= -30000s

Queries keyboard layouts

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Windows\System32\conhost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00473B80 FindFirstFileA,FindNextFileA,FindClose,	51_2_00473B80
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00451DC0 FindFirstFileA,GetLastError,	51_2_00451DC0
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004963A0 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	51_2_004963A0
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00463080 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	51_2_00463080
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_004634FC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	51_2_004634FC
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: 51_2_00461AF4 FindFirstFileA,FindNextFileA,FindClose,	51_2_00461AF4
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B5C018 FindFirstFileW,GetLastError,	53_2_00B5C018
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_00B5729C GetModuleHandleW,GetProcAddress,lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	53_2_00B5729C
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_69400120 FindFirstFileA,FindNextFileA,FindClose,	53_2_69400120
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CC0F0 FindFirstFileA,FindNextFileA,FindClose,	53_2_693CC0F0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693F2350 FindFirstFileA,FindClose,	53_2_693F2350
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694003B0 FindFirstFileA,FindNextFileA,FindClose,	53_2_694003B0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CC270 FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	53_2_693CC270
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_69400540 FindFirstFileA,FindNextFileA,FindClose,	53_2_69400540
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693D5930 __itoa_s,FindFirstFileA,FindNextFileA,FindClose,	53_2_693D5930
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693C7BE0 FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,	53_2_693C7BE0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CBBE0 FindFirstFileA,FindNextFileA,FindClose,	53_2_693CBBE0
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CBD70 FindFirstFileA,FindNextFileA,FindClose,	53_2_693CBD70
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693CBF30 FindFirstFileA,FindNextFileA,FindClose,	53_2_693CBF30
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693C71A0 FindFirstFileA,DeleteFileA,DeleteFileA,FindNextFileA,FindClose,	53_2_693C71A0

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe

Code function: 50_2_00409B08 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

50_2_00409B08

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior

Source: free-youtube-downloader_full384.tmp, 00000008.00000002.2912899264.0000000000673000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: free-youtube-downloader_full384.tmp, 00000008.00000002.2915474517.0000000004467000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2631577543.0000000004463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW4
Source: NFWCHK.exe, 00000001.00000002.1956796339.000000001BCCC000.00000004.00000020.00020000.00000000.sdmp, NFWCHK.exe, 00000001.00000002.1956796339.000000001BC99000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2631577543.0000000004463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CreateLib.exe, 00000036.00000002.2585244488.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}?
Source: WSHelper.exe, 00000035.00000002.2557160635.000000000085E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

API call chain: ExitProcess graph end node

graph_53-115290

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DF7100 rdtsc

56_2_00DF7100

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: 53_2_6939CFA1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

53_2_6939CFA1

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDD3A0 LogD,KillTimer,VirtualQuery,GetCurrentProcessId,CreateToolhelp32Snapshot,LogD,_memset,Module32FirstW,__wcsicoll,Module32NextW,

56_2_00DDD3A0

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DF98DC VirtualProtect ?,-00000001,00000104,?

56_2_00DF98DC

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_00447B64 LoadLibraryExA,LoadLibraryA,GetProcAddress,

51_2_00447B64

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: 53_2_694CFF21 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

53_2_694CFF21

Enables debug privileges

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_6939CFA1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_6939CFA1
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_693982C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	53_2_693982C3
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694B9FD9 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_694B9FD9
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: 53_2_694B3E1E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	53_2_694B3E1E
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF864E _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	56_2_00DF864E
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DDC860 SetUnhandledExceptionFilter,LoadLibraryW,GetCommandLineW,	56_2_00DDC860
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E0080B __NMSG_WRITE,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_00E0080B
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00E08D33 SetUnhandledExceptionFilter,	56_2_00E08D33
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_00DF7F66 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	56_2_00DF7F66
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_1000452C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	56_2_1000452C
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_100037B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	56_2_100037B3
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_10006CF2 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	56_2_10006CF2
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: 56_2_10007D25 SetUnhandledExceptionFilter,	56_2_10007D25

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_100096E0 _RhCreateStealthRemoteThread@16,OpenProcess,GetLastError,GetLastError,GetLastError,GetLastError,_RhIsX64Process@8,GetLastError,CreateToolhelp32Snapshot,GetLastError,Thread32First,GetLastError,OpenThread,GetCurrentThreadId,OpenThread,SuspendThread,ResumeThread,Thread32Next,GetLastError,GetThreadContext,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateEventW,CreateEventW,CreateEventW,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,DuplicateHandle,GetCurrentProcess,DuplicateHandle,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,GetLastError,WriteProcessMemory,GetLastError,SetThreadContext,GetLastError,ResumeThread,WaitForSingleObject,GetLastError,ReadProcessMemory,GetLastError,GetLastError,GetCurrentProcess,DuplicateHandle,GetLastError,SetEvent,GetLastError,GetLastError,SetEvent,CloseHandle,CloseHandle,ResumeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,

56_2_100096E0

Contains functionality to inject threads in other processes

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_10008D90 _RhInjectLibrary@28,GetLastError,IsBadReadPtr,FatalAppExitW,GetCurrentProcessId,GetLastError,GetLastError,GetLastError,OpenProcess,GetLastError,GetLastError,GetLastError,GetLastError,_RhIsX64Process@8,GetFullPathNameW,HeapAlloc,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,VirtualAllocEx,GetCurrentProcessId,WriteProcessMemory,CreateEventW,GetCurrentProcess,DuplicateHandle,WriteProcessMemory,_RhCreateStealthRemoteThread@16,WaitForMultipleObjects,GetExitCodeThread,SetLastError,CreateRemoteThread,GetLastError,CloseHandle,HeapFree,CloseHandle,CloseHandle,

56_2_10008D90

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM ScreenCapture.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM RegFloatButton.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstallForExe.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM BrowserPlugInHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM URLReqService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsConverter.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsMediaInfo.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM DriverInstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM CreateLib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM FreeYouTubeDownloaderUpdateHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM kv_dr.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM sniffer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM FreeYouTubeDownloader.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM iexplore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM URLReqService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM DelayPluginI.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM pluginInstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM BrowserPlugInHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM PluginInstallForExe.exe	Jump to behavior

Contains functionality to launch a program with higher privileges

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_00476C24 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

51_2_00476C24

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Users\Public\Documents\Wondershare\NFWCHK.exe C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe "C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\"	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM ScreenCapture.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM RegFloatButton.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstallForExe.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM BrowserPlugInHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM URLReqService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsConverter.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsMediaInfo.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM DriverInstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM CreateLib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM FreeYouTubeDownloaderUpdateHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM kv_dr.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM sniffer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM FreeYouTubeDownloader.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM iexplore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM URLReqService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM DelayPluginI.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM pluginInstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM BrowserPlugInHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM PluginInstallForExe.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe" -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe" "register" "Allmytube" "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe"	Jump to behavior

Uses taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM ScreenCapture.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM RegFloatButton.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstallForExe.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM BrowserPlugInHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM URLReqService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsConverter.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM WsMediaInfo.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM DriverInstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM PluginInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM CreateLib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM FreeYouTubeDownloaderUpdateHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM kv_dr.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /F /IM sniffer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM FreeYouTubeDownloader.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM iexplore.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM URLReqService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM DelayPluginI.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM pluginInstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM BrowserPlugInHelper.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\TASKKILL.exe" /F /IM PluginInstallForExe.exe	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	Process created: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp "c:\users\user\appdata\local\temp\is-11upv.tmp\free-youtube-downloader_full384.tmp" /sl5="$1401f6,39165086,132096,c:\users\public\documents\wondershare\free-youtube-downloader_full384.exe" /verysilent /lang=eng /nopage /installpath: "c:\program files (x86)\wondershare\free youtube downloader\"
Source: C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe	Process created: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp "c:\users\user\appdata\local\temp\is-11upv.tmp\free-youtube-downloader_full384.tmp" /sl5="$1401f6,39165086,132096,c:\users\public\documents\wondershare\free-youtube-downloader_full384.exe" /verysilent /lang=eng /nopage /installpath: "c:\program files (x86)\wondershare\free youtube downloader\"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_0045BF5C GetVersion,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,AllocateAndInitializeSid,GetLastError,LocalFree,

51_2_0045BF5C

Source: Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002920000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, 00000035.00000000.2547642375.0000000000401000.00000020.00000001.01000000.0000001A.sdmp, is-4J6FD.tmp.51.dr

Binary or memory string: Shell_TrayWndSVWU

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: 53_2_69410620 cpuid

53_2_69410620

Contains functionality to query locales information (e.g. system language)

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: GetLocaleInfoA,	50_2_004051D4
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe	Code function: GetLocaleInfoA,	50_2_00405220
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: GetLocaleInfoA,	51_2_00408548
Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp	Code function: GetLocaleInfoA,	51_2_00408594
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetModuleFileNameW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,	53_2_00B57498
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoW,	53_2_00B77130
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: lstrcpynW,GetThreadLocale,GetLocaleInfoW,lstrlenW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,lstrcpynW,LoadLibraryExW,	53_2_00B575D3
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoW,	53_2_00B5FDF4
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoW,	53_2_00B5FE40
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	53_2_693A0B61
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	53_2_693A0A6C
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoA,	53_2_6939BDEC
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	53_2_693A0C08
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	53_2_693A0C63
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	53_2_693A4F3B
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	53_2_693A0F5B
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	53_2_693A0F97
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	53_2_693A0E34
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	53_2_693A4E61
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	53_2_693A0EF4
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	53_2_693A52D7
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	53_2_694C6A3E
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	53_2_694C6AE1
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	53_2_694C6AA5
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	53_2_694C6588
Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe	Code function: GetLocaleInfoA,	53_2_694C7194
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe	Code function: GetLocaleInfoA,	56_2_00E0ECEE

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe	Queries volume information: C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Queries volume information: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe VolumeInformation
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Queries volume information: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Microsoft.WindowsAPICodePack.Shell.dll VolumeInformation
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Queries volume information: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Microsoft.WindowsAPICodePack.dll VolumeInformation
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Queries volume information: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe VolumeInformation
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe	Queries volume information: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Newtonsoft.Json.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_00457964 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

51_2_00457964

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe

Code function: 50_2_004026C4 GetSystemTime,

50_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Code function: 51_2_004547B8 GetUserNameA,

51_2_004547B8

Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

Code function: 53_2_693F2070 GetTimeZoneInformation,

53_2_693F2070

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe

Code function: 50_2_00405CBC GetVersionExA,

50_2_00405CBC

Source: C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies Internet Explorer zone settings

Source: C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 1208

Jump to behavior

Stealing of Sensitive Information

Searches for user specific document files

Source: C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Directory queried: C:\Users\Public\Documents\Wondershare

Jump to behavior

Remote Access Functionality

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe

Code function: 56_2_00DDA6E0 LogD,socket,setsockopt,inet_addr,htons,bind,getsockname,listen,closesocket,_calloc,

56_2_00DDA6E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	221 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	12 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	1 DLL Search Order Hijacking	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	13 Command and Scripting Interpreter	14 Windows Service	1 DLL Search Order Hijacking	2 Obfuscated Files or Information	Security Account Manager	14 File and Directory Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 DLL Side-Loading	NTDS	47 System Information Discovery	Distributed Component Object Model	1 Screen Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	14 Windows Service	1 DLL Search Order Hijacking	LSA Secrets	1 Query Registry	SSH	11 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	213 Process Injection	12 Masquerading	Cached Domain Credentials	161 Security Software Discovery	VNC	1 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	213 Process Injection	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	3 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
free-youtube-downloader_setup_full384.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSProducstInfo.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\KPByName.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\SSL.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\TempkillProcess.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-235DL.tmp	4%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-4J6FD.tmp	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-545DF.tmp	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-5QCJ0.tmp	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-AE5UE.tmp	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-M9KTS.tmp	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-O47MQ.tmp	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-P1945.tmp	0%	ReversingLabs
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.exe (copy)	4%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-5QFBO.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CBSProductClient.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\Chaffing.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\KDF.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\is-JE6PN.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\is-O5JLA.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\DSA.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\ElGamal.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\RSA.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\_DSA.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\_RSA.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\_slowmath.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-3B835.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-8AM0C.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-CQ7BI.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-DSONI.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-FSVIP.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-MHV7O.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-SMI90.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\pubkey.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\FortunaAccumulator.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\FortunaGenerator.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\SHAd256.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\is-3L959.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\is-K4AA4.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\is-MUU9J.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\fallback.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-0EHU0.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-0SL2S.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-30ESG.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-AID46.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-M348A.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\nt.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\posix.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\rng_base.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\winrandom.pyd (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\_UserFriendlyRNG.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\__init__.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\is-756JV.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\is-9LLFR.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\is-IULV5.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\random.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\__init__.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\common.py (copy)	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-23AP2.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-70177.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-7N2U9.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-CT78S.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-FBGT6.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-FL0GK.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-GGEIJ.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-LKVES.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-NNKR4.tmp	0%	ReversingLabs
C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-QHTMS.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://123movies.co/movie/baby-driver-free112/?watching=HNGgShnEZp/watching.html	0%	Avira URL Cloud	safe
http://www.videofy.me/thisisvideofyme/1100701	0%	Avira URL Cloud	safe
http://whereismyip.com/	0%	Avira URL Cloud	safe
http://vas.sim-technik.de/vas/live/v2/videos	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://www.nerdcubed.co.uk/feed.json	0%	Avira URL Cloud	safe
http://news.cts.com.tw/action/test_mp4feed.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
lantern.roeyecdn.com	216.137.45.128	true	false	unknown
cdn.avmws.com	108.138.85.117	true	false	unknown
tjzuh.com	3.218.217.33	true	false	unknown
trk.indoleads.com	104.248.96.70	true	false	high
gtm-cn-4590x3tmp05.gtm-a2b4.com	47.254.51.125	true	false	unknown
1376624012.rsc.cdn77.org	89.187.167.3	true	false	unknown
stats.g.doubleclick.net	172.217.215.154	true	false	high
common-info.wondershare.com	47.254.50.103	true	false	high
pagestates-tracking.crazyegg.com	18.165.98.69	true	false	high
lenkmio.com	3.218.217.33	true	false	high
scontent.xx.fbcdn.net	31.13.65.7	true	false	high
idsync.rlcdn.com	35.244.154.8	true	false	high
utt.impactcdn.com	35.186.249.72	true	false	unknown
www.google.com	108.177.122.147	true	false	high
delivery.consentmanager.net	87.230.98.78	true	false	unknown
ut.linksynergy.com	34.98.67.3	true	false	high
pafutos.com	3.218.217.33	true	false	unknown
z.asbmit.com	3.218.217.33	true	false	unknown
d2pbcviywxotf2.cloudfront.net	3.163.101.90	true	false	high
star-mini.c10r.facebook.com	31.13.65.36	true	false	high
www.linkconnector.com	172.67.22.39	true	false	high
tag.rmp.rakuten.com	34.102.147.248	true	false	high
ad.admitad.com	52.72.78.243	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
analytics-alv.google.com	216.239.36.181	true	false	high
gtm-cn-wwo31enga0c.gtm-a2b4.com	47.88.25.126	true	false	unknown
app.partnerboost.com	47.243.241.30	true	false	unknown
www3.l.google.com	142.250.105.138	true	false	high
lantern.roeye.com	34.252.42.217	true	false	unknown
googleads.g.doubleclick.net	74.125.138.157	true	false	high
d210mxruddtl0f.cloudfront.net	18.165.98.11	true	false	high
assets-tracking.crazyegg.com	18.244.202.7	true	false	high
td.doubleclick.net	173.194.219.154	true	false	high
gtm-cn-4590x3tmp01.gtm-a2b4.com	47.88.25.126	true	false	unknown
b.delivery.consentmanager.net	87.230.98.78	true	false	unknown
googlehosted.l.googleusercontent.com	173.194.219.132	true	false	high
tracking.crazyegg.com	3.131.76.57	true	false	high
platform.wondershare.com	unknown	unknown	false	high
ut.rd.linksynergy.com	unknown	unknown	false	high
dlinst.wondershare.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
script.crazyegg.com	unknown	unknown	false	high
download.wondershare.com	unknown	unknown	false	high
www.wondershare.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
cdn.consentmanager.net	unknown	unknown	false	unknown
www.dwin1.com	unknown	unknown	false	unknown
analytics.webgains.io	unknown	unknown	false	unknown
connect.facebook.net	unknown	unknown	false	high
tags.rd.linksynergy.com	unknown	unknown	false	high
cbs.wondershare.com	unknown	unknown	false	high
chrome.google.com	unknown	unknown	false	high
images.wondershare.com	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://dlinst.wondershare.com/player/ytd384/02.png?t=20151911	false		high
https://tag.rmp.rakuten.com/120272.ct.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.nbcnews.com/widget/video-embed/701714499682	is-EVHLK.tmp.8.dr	false		high
http://www.wondershare.com/pro/video-converter-ultimate.html?utm_source=suite-windows&utm_medium	Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://whereismyip.com/	Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, WSHelper.exe, WSHelper.exe, 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmp	false	Avira URL Cloud: safe	unknown
https://store.wondershare.com/shop/buy/buy-mac-video-converter-ultimate.html	free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.prosieben.de/tv/circus-halligalli/videos/218-staffel-2-episode-18-jahresrueckblick-ganze-	is-DGCGF.tmp.8.dr	false		high
https://www.adultswim.com/api/shows/v1/videos/	is-ESJI5.tmp.8.dr	false		high
http://news.cts.com.tw/action/test_mp4feed.php	is-CU7PP.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	is-02OLJ.tmp.8.dr	false	Avira URL Cloud: safe	unknown
https://usd.swreg.org/cgi-bin/s.cgi?s=46637&p=46637-WDR001&q=1&v=15&d=0?utm_source=s	Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://play-api.acast.com/splash/%s/%s	is-F2B86.tmp.8.dr	false		high
https://www.twitch.tv/spamfish/videos/past-broadcasts	is-RTUM8.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?m=upgrade_info&pid=	is-L99G6.tmp.8.dr	false		high
https://hitsmediaweb.h-its.org/mediasite/Play/2db6c271-681e-4f19-9af3-c60d1f82869b1d	is-EKJ2Q.tmp.8.dr	false		high
http://docs.brightcove.com/en/video-cloud/brightcove-player/guides/publish-video.html#tag	is-60Q6B.tmp.8.dr	false		high
http://www.nickelodeon.hu/musorok/spongyabob-kockanadrag/videok/episodes/buborekfujas-az-elszakadt-n	is-G4FR5.tmp.8.dr	false		high
https://m.twitch.tv/spamfish/videos/highlights	is-RTUM8.tmp.8.dr	false		high
https://www.aol.com/video/view/u-s--official-warns-of-largest-ever-irs-phone-scam/518167793/	is-5B00F.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?m=ck&pid=384&num=1435	free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cnn.com/video/?/video/	is-DJT4C.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1430&m=C1230=11	free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.mail.ru/	is-2KM8D.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1396&m=C103014h	free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452656072.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452261742.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069F0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gist.github.com/bluec0re/cafd3764412967417fd3	is-GBOPJ.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=384&m=schz	free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069EB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2454037505.00000000069EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://token.vrt.be	is-NOOU2.tmp.8.dr	false		high
https://www.aol.jp/video/playlist/5a28e936a1334d000137da0c/5a28f3151e642219fde19831/	is-5B00F.tmp.8.dr	false		high
https://www.wondershare.com/fr/	free-youtube-downloader_full384.tmp, 00000008.00000003.2630793163.00000000044F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2631409265.000000000452B000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611489655.00000000069F2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611932539.0000000006A1C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.dailymotion.com/user/%s/%s	is-CHBKK.tmp.8.dr	false		high
http://vas.sim-technik.de/vas/live/v2/videos	is-DGCGF.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://cbs.wondershare.com/go.php?pid=1430&m=bf%	free-youtube-downloader_full384.tmp, 00000008.00000003.2623269522.00000000045D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cbs.wondershare.com/go.php?pid=1430&m=bf:	free-youtube-downloader_full384.tmp, 00000008.00000003.2451781553.00000000069E2000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452036399.00000000069E5000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssh.com/txt/socks4.protocol	is-GBOPJ.tmp.8.dr	false		high
http://www.twitch.tv/belkao_o/v/11230755	is-RTUM8.tmp.8.dr	false		high
https://images.wondershare.com/images/drfone_logoImg.png	free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11nd.1	free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452119161.00000000069F0000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2452004527.00000000069ED000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.pornhub.com/video?page=3	is-D711J.tmp.8.dr	false		high
https://www.dailymotion.com/player/metadata/video/%s	is-CHBKK.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1430&m=scM	free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cbs.wondershare.com/go.php?pid=1364&m=bty	free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drfone.wondershare.com/	free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.nationalgeographic.com/tv/watch/6a875e6e734b479beda26438c9f21138/	is-TO0Q8.tmp.8.dr	false		high
http://play.rmcnmv.naver.com/vod/play/v2.0/	is-CCLHC.tmp.8.dr	false		high
http://www.videofy.me/thisisvideofyme/1100701	is-OI4JR.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://9gag.com/tv/p/Kk2X5/people-are-awesome-2013-is-absolutely-awesome	is-886R8.tmp.8.dr	false		high
http://www.pornhub.com/users/rushandlia/videos	is-7OVTE.tmp.8.dr, is-D711J.tmp.8.dr	false		high
https://plays.tv/video/56af17f56c95335490/when-you-outplay-the-azir-wall	is-7O181.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1430&m=scb	free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.aol.com/video/view/donald-trump-spokeswoman-tones-down-megyn-kelly-attacks/519442220/	is-5B00F.tmp.8.dr	false		high
http://www.dmax.de/programme/storage-hunters-uk/videos/storage-hunters-uk-episode-6/	is-JA8LC.tmp.8.dr	false		high
https://github.com/ytdl-org/youtube-dl/issues/7826	is-CHBKK.tmp.8.dr	false		high
http://www.symauth.com/rpa00	Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002B19000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_setup_full384.exe, is-4J6FD.tmp.51.dr	false		high
https://www.adultswim.com/api/search	is-ESJI5.tmp.8.dr	false		high
http://cleveland.cbslocal.com/2016/05/16/indians-score-season-high-15-runs-in-blowout-win-over-reds-	is-MEP2B.tmp.8.dr	false		high
http://me.ign.com/ar/angry-birds-2/106533/video/lrd-ldyy-lwl-lfylm-angry-birds	is-N2NIV.tmp.8.dr	false		high
https://graphql.api.dailymotion.com	is-CHBKK.tmp.8.dr	false		high
https://vice-web-statics-cdn.vice.com/vice-player/player-embed.js	is-8TPIL.tmp.8.dr	false		high
http://www.nerdcubed.co.uk/feed.json	is-PFHFI.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://my.mail.ru/corp/hitech/video/news_hi-tech_mail_ru/1263.html	is-2KM8D.tmp.8.dr	false		high
http://dlinst.wondershare.com/player/ytd384/02.png?t=20151911...Tl	free-youtube-downloader_setup_full384.exe, 00000000.00000003.1929003753.00000000059F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cbs.wondershare.com/go.php?pid=384&m=C9cy	free-youtube-downloader_full384.tmp, 00000008.00000003.2453752530.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451923903.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451594847.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ustream.tv/recorded/20274954	is-0GFDC.tmp.8.dr	false		high
http://watch.nba.com/video/channels/playoffs/2015/05/20/0041400301-cle-atl-recap.nba	is-OSF6C.tmp.8.dr	false		high
https://images.wondershare.com/style/images/download_icon.png	free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ok.ru/web-api/video/moviePlayer/20079905452	is-8EAS5.tmp.8.dr	false		high
http://www.dailymotion.com/video/x149uew_katy-perry-roar-official_musi	is-CHBKK.tmp.8.dr	false		high
http://www.c-span.org/video/?104517-1/immigration-reforms-needed-protect-skilled-american-workers	is-PBT7D.tmp.8.dr	false		high
http://9gag.com/tv/embed/a5Dmvl	is-886R8.tmp.8.dr	false		high
http://gb.napster.com/artist/madness/album/keep-moving-salvo/track/wings-of-a-dove	is-8HMJU.tmp.8.dr	false		high
http://www.pornoxo.com/videos/7564/striptease-from-sexy-secretary.html	is-02DMS.tmp.8.dr	false		high
http://www.wondershare.com/pro/youtube-downloader.html	free-youtube-downloader_full384.exe, 00000007.00000003.2917684385.000000000214D000.00000004.00001000.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2635917435.00000000021F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.mdr.de/kultur/audio1312272_zc-15948bad_zs-86171fdd.html	is-TSR7J.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1364&m=oti	free-youtube-downloader_full384.tmp, 00000008.00000003.2451679296.00000000069E9000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.twitch.tv/spamfish/videos/all	is-RTUM8.tmp.8.dr	false		high
http://www.nbcnews.com/feature/dateline-full-episodes/full-episode-family-business-n285156	is-EVHLK.tmp.8.dr	false		high
http://www.adultswim.com/videos/tim-and-eric-awesome-show-great-job/dr-steve-brule-for-your-wine/	is-ESJI5.tmp.8.dr	false		high
https://www.edrawsoft.com/orgcharting/	free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.twitch.tv/login	is-RTUM8.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1396&m=C6P	free-youtube-downloader_full384.tmp, 00000008.00000003.2622452938.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://my.mail.ru/cgi-bin/my/ajax	is-2KM8D.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1364&m=otu	free-youtube-downloader_full384.tmp, 00000008.00000003.2453812857.00000000069E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://123movies.co/movie/baby-driver-free112/?watching=HNGgShnEZp/watching.html	is-3BLM6.tmp.8.dr	false	Avira URL Cloud: safe	unknown
http://www.camdemy.com/folder/450	is-HUQPK.tmp.8.dr	false		high
http://money.cnn.com/.element/apps/cvp2/cfg/config.xml	is-DJT4C.tmp.8.dr	false		high
http://platform.wondershare.com/interface.php?m=newtips	WSHelper.exe, 00000035.00000003.2552219662.0000000002D44000.00000004.00001000.00020000.00000000.sdmp	false		high
https://images.wondershare.com/guide/images/free-youtube-downloader/settings.jpg	free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://player.ooyala.com/player.js?embedCode=%s	is-PMOFB.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1430&m=wrn	free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ok.ru/video/%s	is-8EAS5.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?m=ck&pid=384&num=11	free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cbs.wondershare.com/go.php?m=ck&pid=384&num=13	free-youtube-downloader_full384.tmp, 00000008.00000003.2622707668.00000000045DB000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2451537163.00000000069E1000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.kika.de/sendungen/einzelsendungen/weihnachtsprogramm/einzelsendung2534.html	is-TSR7J.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?m=ck&pid=384&num=14	free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	false		high
http://download.wondershare.com/dvd-ripper-platinum_full48.exe	Wondershare Helper Compact.tmp, 00000033.00000003.2560443028.0000000002E6E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cbs.wondershare.com/go.php?pid=1396&m=C1253E3E770035	free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2622660200.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/rg3/youtube-dl/issues/6057#issuecomment-126129799)	is-4EAAL.tmp.8.dr	false		high
http://noco.tv/emission/11538/nolife/ami-ami-idol-hello-france/	is-9JPKD.tmp.8.dr	false		high
http://cbs.wondershare.com/go.php?pid=1396&m=C8j	free-youtube-downloader_full384.tmp, 00000008.00000003.2451468457.00000000069F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recoverit.wondershare.com	free-youtube-downloader_full384.tmp, 00000008.00000003.2611750149.0000000006A55000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611643935.0000000006A6C000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611238446.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611333158.0000000006A28000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.0000000006A06000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2610923511.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, free-youtube-downloader_full384.tmp, 00000008.00000003.2611140735.00000000069F2000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
47.254.50.103	common-info.wondershare.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
74.125.138.157	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.215.103	unknown	United States	15169	GOOGLEUS	false
108.138.85.117	cdn.avmws.com	United States	16509	AMAZON-02US	false
35.244.154.8	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
142.250.105.138	www3.l.google.com	United States	15169	GOOGLEUS	false
173.194.219.154	td.doubleclick.net	United States	15169	GOOGLEUS	false
87.230.98.78	delivery.consentmanager.net	Germany	61157	PLUSSERVER-ASN1DE	false
18.165.98.69	pagestates-tracking.crazyegg.com	United States	3	MIT-GATEWAYSUS	false
34.252.42.217	lantern.roeye.com	United States	16509	AMAZON-02US	false
3.218.217.33	tjzuh.com	United States	14618	AMAZON-AESUS	false
52.72.78.243	ad.admitad.com	United States	14618	AMAZON-AESUS	false
18.165.98.11	d210mxruddtl0f.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
34.102.147.248	tag.rmp.rakuten.com	United States	15169	GOOGLEUS	false
47.243.241.30	app.partnerboost.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
34.199.45.162	unknown	United States	14618	AMAZON-AESUS	false
108.177.122.147	www.google.com	United States	15169	GOOGLEUS	false
31.13.65.36	star-mini.c10r.facebook.com	Ireland	32934	FACEBOOKUS	false
173.194.219.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.244.202.78	unknown	United States	16509	AMAZON-02US	false
3.131.76.57	tracking.crazyegg.com	United States	16509	AMAZON-02US	false
18.244.202.7	assets-tracking.crazyegg.com	United States	16509	AMAZON-02US	false
47.88.25.126	gtm-cn-wwo31enga0c.gtm-a2b4.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
104.22.48.169	unknown	United States	13335	CLOUDFLARENETUS	false
216.137.45.128	lantern.roeyecdn.com	United States	16509	AMAZON-02US	false
89.187.167.3	1376624012.rsc.cdn77.org	Czech Republic	60068	CDN77GB	false
34.98.67.3	ut.linksynergy.com	United States	15169	GOOGLEUS	false
89.187.167.4	unknown	Czech Republic	60068	CDN77GB	false
47.254.51.125	gtm-cn-4590x3tmp05.gtm-a2b4.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
172.67.22.39	www.linkconnector.com	United States	13335	CLOUDFLARENETUS	false
172.217.215.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
3.163.101.90	d2pbcviywxotf2.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.215.156	unknown	United States	15169	GOOGLEUS	false
104.248.96.70	trk.indoleads.com	United States	14061	DIGITALOCEAN-ASNUS	false
216.239.36.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
52.0.201.85	unknown	United States	14618	AMAZON-AESUS	false
142.250.105.99	unknown	United States	15169	GOOGLEUS	false
31.13.65.7	scontent.xx.fbcdn.net	Ireland	32934	FACEBOOKUS	false
35.186.249.72	utt.impactcdn.com	United States	15169	GOOGLEUS	false
18.165.98.71	unknown	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431869
Start date and time:	2024-04-25 22:23:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	63
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	free-youtube-downloader_setup_full384.exe
Detection:	SUS
Classification:	sus32.phis.evad.winEXE@108/2052@126/42
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 92% Number of executed functions: 194 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 23.40.205.26, 23.40.205.35, 192.229.211.108, 96.7.224.82, 96.7.224.56, 23.6.117.10, 23.6.117.34, 74.125.138.94, 108.177.122.102, 108.177.122.100, 108.177.122.138, 108.177.122.113, 108.177.122.139, 108.177.122.101, 64.233.176.84, 104.76.210.10, 104.76.210.14, 142.250.9.97, 34.104.35.123, 104.19.147.8, 104.19.148.8, 204.79.197.237, 13.107.21.237, 172.217.215.95, 172.253.124.95, 142.250.9.95, 64.233.176.95, 108.177.122.95, 142.250.105.95, 173.194.219.95, 64.233.185.95, 64.233.177.95, 74.125.136.95, 74.125.138.95, 142.251.15.95, 173.194.219.139, 173.194.219.113, 173.194.219.102, 173.194.219.100, 173.194.219.138, 173.194.219.101, 142.250.9.113, 142.250.9.100, 142.250.9.101, 142.250.9.138, 142.250.9.102, 142.250.9.139, 64.233.177.157, 64.233.177.154, 64.233.177.156, 64.233.177.155
Excluded domains from analysis (whitelisted): bat-bing-com.dual-a-0034.a-msedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, script.crazyegg.com.cdn.cloudflare.net, clients2.google.com, ocsp.digicert.com, a1168.g.akamai.net, www.googletagmanager.com, bat.bing.com, www.google-analytics.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com, a1737.d.akamai.net, www.googleapis.com, pagead2.googlesyndication.com, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, edgedl.me.gvt1.com, dual-a-0034.a-msedge.net, wondershare.com.edgesuite.net, clients.l.google.com, wondershare.cn.edgesuite.net
Execution Graph export aborted for target NFWCHK.exe, PID 3264 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: free-youtube-downloader_setup_full384.exe

Simulations

Behavior and APIs

Time	Type	Description
21:25:11	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Wondershare Helper Compact.exe C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\ASHelper.exe
22:24:23	API Interceptor	393532x Sleep call for process: free-youtube-downloader_setup_full384.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
47.254.50.103	https://www.hipdf.com/download-file?share_id=TJFSlUuhm3TrYHMFvuLGhA	Get hash	malicious	Unknown	Browse
47.254.50.103	https://www.hipdf.com/download-file?share_id=TJFSlUuhm3TrYHMFvuLGhA	Get hash	malicious	Unknown	Browse
87.230.98.78	http://www.chaduco.com/.	Get hash	malicious	Unknown	Browse
	https://plankjock.com	Get hash	malicious	Unknown	Browse
	http://file.zdf.it	Get hash	malicious	Unknown	Browse
	https://iyfbodn.com/	Get hash	malicious	Unknown	Browse
	https://nalders.uk/dq.PDF	Get hash	malicious	Unknown	Browse
18.165.98.11	https://cloudflare-ipfs.com/ipfs/QmWhG4PY6RXe5T7UakJVFDfTnjN6pte6LhpzoEmpDK7232#drusso@he-equipment.com	Get hash	malicious	Unknown	Browse
18.165.98.11	https://www.edrawmax.com/online/share.html?code=6ff2799ebde611ee80880a54be41f961	Get hash	malicious	Unknown	Browse
18.165.98.69	https://kristie-mancell-s-school.teachable.com/p/centerforfamilylife	Get hash	malicious	Unknown	Browse
	http://track.redrebelnews.com/?xtl=1vds7g1b0kkc3nlynp6ntp65642kf41zo415tjwk7c0fme2j06ieygrbuj0aw1elwycducyqfym9ytp8zi53yta3neno981l7wup11q0rzjhglbza6xsgdzs8v8fob99z0vuq1oj7d06vcof84ubmaa3k5nx8252bj2t3sbzcrj6scibc8slwu5i2qt50uungi5up2ccfcezn3e09zti7dkhd81bgrpq4tn9n1rpkvatrwdk6wbjcfqe17rj2epyuzteuio89r3k9qiughu2dte4cgitnco9zowrnyrowg3uo7fxiaougtjgzk8kp9rqfu7swnlqjqp2nzgdgx6geh8pv5pg32zuto61t1d6z0qbxkn6kxo605mclx5ywxjho7hbajc8og9ybfa8xnn846xwsuhd7bhbrvc9lhvg77q2on5cnrhwykm52zhsn6m8y3v7y8h4vcljt&eih=1wlita4m575llogpx0ojzus55azhlcj&__stmp=s9yj6a	Get hash	malicious	Unknown	Browse
	https://www.ilborgobandb.it/REYO/intreduction.php	Get hash	malicious	Unknown	Browse
	https://www.edrawmax.com/online/share.html?code=6ff2799ebde611ee80880a54be41f961	Get hash	malicious	Unknown	Browse
	http://blackboardconnect.com	Get hash	malicious	Unknown	Browse
	https://newgamingcodes.com/elemental-dungeons-codes/	Get hash	malicious	Unknown	Browse
239.255.255.250	https://falic.co/office/office_cookies/main/	Get hash	malicious	Unknown	Browse
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	http://papajoeschicago.com	Get hash	malicious	Unknown	Browse
	https://lide.alosalca.fun/highbox#joeblow@xyz.com	Get hash	malicious	HTMLPhisher	Browse
	http://welcome.visionaryyouth.org	Get hash	malicious	Unknown	Browse
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse
	https://u18727881.ct.sendgrid.net/ls/click?upn=u001.C98xKppRPMcm9u3MCGfzKZoMS1OpBvTt67698T0dL36uvjeaIcwJCGWCF40JX0jTgfIq_7OnzmxzMpUZLpDhO-2FIQbFKADvzXAOcu2Z6qDokXjolLBB1Q9VRzsF9K8mIjVEFl-2BHay6WBbN5WlzpyVSr4HVkHTzvzCtmwku69-2FJZyLx3-2B4ShTXTnPqinKBtOGbSRbSYGRG3Lt22AUmt-2BZ99sH-2B6Jqf0nt-2BFsnaCp0VSm16eoPdzoH74Sn7jINM2DWCxglARpPWuPOE3iiXY03LGL6ko4g-3D-3D	Get hash	malicious	Unknown	Browse
	http://asana.wf	Get hash	malicious	Unknown	Browse
	http://neoparts.com.br./driz/oybe/am9sZW5lLmJ1cm5zQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t$?utp=consumer&	Get hash	malicious	HTMLPhisher	Browse
	http://free.filesearch.club/?q=grade+9+core+french+textbook	Get hash	malicious	Unknown	Browse
108.138.85.117	https://2n8w.app.link/?~channel=Email&~feature=ConfirmationEmail--BenerailETicket&~campaign=WebToApp&~tags=locale=nl_NL&~tags=version=1&~tags=marketing_code=BSH3675&$android_url=https://play.google.com/store/apps/details?id=com.thetrainline&hl=nl-NL&$android_deepview=false&$android_passive_deepview=false&$ios_url=https://itunes.apple.com/NL/app/thetrainline/id334235181&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=trackapp%E3%80%82sldproducts%E3%80%82effexhost%E3%80%82com/css/2BYOsHP6NGBF6P3ewtcJO2an7icRJGYYjza2CpXA-2FwaAKBpmAtKZi9jIwt6P9rh34GoOuzdEzhjr-2F2xqM9RVx18j7F0zdQvP4E-2FA3RbFylZ6HaiOh-2/ZGhpbGxpbmdAaWthc2ludGVybmF0aW9uYWwuY29t#A7UYyAgFfbgiVFKE3MfthpoJP6vU22c3HXX7-2Fr3IIElVxCduQu0IMwxzHhPoeVW5fw-3D	Get hash	malicious	Unknown	Browse
	http://url7564.dahlboms.se/ls/click?upn=O5-2F-2FZBEDzXm-2F7e9o0m42WX1pcIIkEnIaWzMP-2FO5873-2B-2FLzcTOCMYdBE5zKL3WRKd8tvm_EIGm-2BLW0OhhXv2vaDO5x-2BP9-2B5DZqQBB9ORKBGno0rw4Iy4bF3NJ0pgsAaNF0GBieWKbgZlZKjp7uKkUY2zHiXyuscdlHT-2FGjZreAOcBuB0f6WiyBcncRcis-2FVhsHRojRBcrA-2B1F6PLcBqYhBiPibb7VtR0Kug3j3IF869b3gqb2Buw9MfPcvihbHrC9C1nYl-2Btfir9pFkkeZuUw80S6Z5AQoThVfkhqGv3y6FazBOrM-3D	Get hash	malicious	Unknown	Browse
	https://trk.klclick3.com/ls/click?upn=71mZQkQNS6qn2E00Vo0gQcdqdIxewCP46NpAm3tOAONwx1DiJpFF0v7vdwGKs59Uov9aNYfoaAM1uf94ijQDrBE83VVQj0-2F2S3shOQmD-2FeJ3VBotv8Ll8lWJpPtaDsFHzGTF_MMEqZLjJl-2Fqp-2FvyxaNrqv9Bx8RkLcOdYw-2FJWOTXYvPqkTYVLBE7IeRG8qJhrqW3nMILiVRcMu2QcsM7nyJrj3Ypa3c8WEA7qxcDLqCrl6PCmExTKzPvF8P34ApvQf5SH5ugt0HK6-2BD3nYEsTvZzq60JMQHxR6d6QVJX-2FDLm7eC5VKJ9SAcqtlSztdvUToHITtht9EH3UYoIsoh3yqCSoPU2jgmZDpHV8hem4trmtbpqWIDesdewqpI4jKEASCSuDkynXfz71mLvVjtJID4Rn8LTWnokch-2F3RlzUZVMIPRGwt9T4CvwXt0w04ENjEJPl4	Get hash	malicious	Unknown	Browse
47.243.241.30	https://repairit.wondershare.com/video-repair/cut-video-in-windows-media-player.html	Get hash	malicious	Unknown	Browse
47.243.241.30	https://repairit.wondershare.com/email-repair/fix-shared-mailbox-not-showing-in-outlook.html	Get hash	malicious	Unknown	Browse
18.244.202.78	https://kristie-mancell-s-school.teachable.com/p/centerforfamilylife	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
trk.indoleads.com	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.248.96.70
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.248.96.70
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.248.96.70
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.248.96.70
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.248.96.70
	https://www.edrawmax.com/online/share.html?code=6ff2799ebde611ee80880a54be41f961	Get hash	malicious	Unknown	Browse	104.248.96.70
	https://repairit.wondershare.com/video-repair/cut-video-in-windows-media-player.html	Get hash	malicious	Unknown	Browse	104.248.96.70
	https://repairit.wondershare.com/email-repair/fix-shared-mailbox-not-showing-in-outlook.html	Get hash	malicious	Unknown	Browse	104.248.96.70
	https://drfoneair.wondershare.com/	Get hash	malicious	Unknown	Browse	104.248.96.70
	drfone_repair_setup_full3358.dmg	Get hash	malicious	Unknown	Browse	104.248.96.70
cdn.avmws.com	SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe	Get hash	malicious	PureLog Stealer	Browse	18.164.124.78
	SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe	Get hash	malicious	PureLog Stealer	Browse	18.164.124.46
	SecuriteInfo.com.Program.Unwanted.5412.8929.16808.exe	Get hash	malicious	PureLog Stealer	Browse	18.65.25.81
	SecuriteInfo.com.Program.Unwanted.5412.881.13731.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	65.8.248.82
	SecuriteInfo.com.Program.Unwanted.5412.881.13731.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	65.8.248.80
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	3.163.101.45
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	3.163.101.72
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	3.163.101.72
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	65.8.248.82
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.160.172.30
gtm-cn-4590x3tmp05.gtm-a2b4.com	drfone_repair_setup_full3358.dmg	Get hash	malicious	Unknown	Browse	47.91.89.199
	4r4WFkpvvq.exe	Get hash	malicious	RedLine	Browse	47.91.89.199
	SAlxtNmHFR.exe	Get hash	malicious	RedLine Xmrig	Browse	47.91.89.199
	SecuriteInfo.com.generic.ml.7966.exe	Get hash	malicious	Amadey RedLine	Browse	47.91.89.199
tjzuh.com	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	44.199.140.135
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.209.131.203
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.209.131.203
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.209.131.203
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.209.131.203
	https://www.edrawmax.com/online/share.html?code=6ff2799ebde611ee80880a54be41f961	Get hash	malicious	Unknown	Browse	18.209.131.203
	https://repairit.wondershare.com/video-repair/cut-video-in-windows-media-player.html	Get hash	malicious	Unknown	Browse	18.232.143.141
lantern.roeyecdn.com	https://onlinecheckwriter.com	Get hash	malicious	Unknown	Browse	13.249.98.59
	https://qr.de/login	Get hash	malicious	Unknown	Browse	108.138.128.45
	https://qr.de/login	Get hash	malicious	Unknown	Browse	108.138.128.45
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	216.137.45.74
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	216.137.45.70
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	216.137.45.36
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.238.132.117
	https://www.edrawmax.com/online/share.html?code=235a0cc4c01511eeb72a0a951ba8b83d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	108.138.64.58
	https://www.edrawmax.com/online/share.html?code=6ff2799ebde611ee80880a54be41f961	Get hash	malicious	Unknown	Browse	108.138.64.58
	https://repairit.wondershare.com/video-repair/cut-video-in-windows-media-player.html	Get hash	malicious	Unknown	Browse	13.226.52.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLUSSERVER-ASN1DE	Remittance. #U0440df.html	Get hash	malicious	HTMLPhisher	Browse	151.106.103.153
	PO#1277.exe	Get hash	malicious	AgentTesla	Browse	151.106.103.198
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	185.171.217.114
	wOJU643xno.elf	Get hash	malicious	Mirai	Browse	62.138.220.17
	http://www.chaduco.com/.	Get hash	malicious	Unknown	Browse	87.230.98.78
	SecuriteInfo.com.Program.MeshAgent.2.11568.22903.exe	Get hash	malicious	Unknown	Browse	195.252.194.7
	SecuriteInfo.com.Program.MeshAgent.2.22213.5544.exe	Get hash	malicious	Unknown	Browse	195.252.194.7
	SecuriteInfo.com.Program.MeshAgent.2.8754.15415.exe	Get hash	malicious	Unknown	Browse	195.252.194.7
	SecuriteInfo.com.Program.MeshAgent.2.2756.20082.exe	Get hash	malicious	Unknown	Browse	195.252.194.7
	SecuriteInfo.com.Program.MeshAgent.2.7386.30462.exe	Get hash	malicious	Unknown	Browse	195.252.194.7
AMAZON-02US	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.154.227.62
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	34.213.75.202
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	3.161.136.95
	http://neoparts.com.br./driz/oybe/am9sZW5lLmJ1cm5zQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t$?utp=consumer&	Get hash	malicious	HTMLPhisher	Browse	108.156.152.27
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.21
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.21
	https://sigtn.com////////utils/emt.cfm?client_id=9195153&campaign_id=73466&link=neoparts%E3%80%82com.br./dayo/fks6/TWFncm8uWXVkZWdvLkphdmllckBkZW1lLWdyb3VwLmNvbQ==$	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	3.17.89.142
	OTpMIf3qBf.elf	Get hash	malicious	Mirai, Okiru	Browse	34.249.145.219
	EQYrfnHzXO.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	http://www.mh3solaroh.com/	Get hash	malicious	HTMLPhisher	Browse	44.225.38.235
MIT-GATEWAYSUS	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.160.18.96
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	18.64.153.203
	https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	Get hash	malicious	HTMLPhisher	Browse	18.164.78.99
	0tfJECfbEP.elf	Get hash	malicious	Mirai	Browse	18.56.189.88
	http://www.mh3solaroh.com/	Get hash	malicious	HTMLPhisher	Browse	18.165.116.61
	tw7rloKDkG.elf	Get hash	malicious	Mirai	Browse	19.221.246.15
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	18.164.78.6
	https://runrun.it/share/portal/x1pWDYC5l2f72kuw	Get hash	malicious	HTMLPhisher	Browse	18.164.78.72
	http://seattlend.com	Get hash	malicious	Unknown	Browse	18.160.15.172
	https://app.milanote.com/1RZbnl1zfBXuaf?p=r2B66sphbV4	Get hash	malicious	Unknown	Browse	18.64.155.6
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	FTG_PD_04024024001.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Doc_004024024001.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Ordine_doc_419024001904.wsf	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	8.222.188.22
	PO_La-Tanerie04180240124.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Pedido02304024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	147.139.212.194
	b3astmode.x86.elf	Get hash	malicious	Unknown	Browse	8.220.214.169
	PO_La-Tannerie04190240419.vbs	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
	Ordine_doc_419024001904.bat	Get hash	malicious	FormBook, GuLoader	Browse	47.91.88.207
AMAZON-02US	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.154.227.62
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	34.213.75.202
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	3.161.136.95
	http://neoparts.com.br./driz/oybe/am9sZW5lLmJ1cm5zQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t$?utp=consumer&	Get hash	malicious	HTMLPhisher	Browse	108.156.152.27
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.21
	SecuriteInfo.com.MSExcel.CVE_2017_0199.DDOC.exploit.32374.20351.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.21
	https://sigtn.com////////utils/emt.cfm?client_id=9195153&campaign_id=73466&link=neoparts%E3%80%82com.br./dayo/fks6/TWFncm8uWXVkZWdvLkphdmllckBkZW1lLWdyb3VwLmNvbQ==$	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	3.17.89.142
	OTpMIf3qBf.elf	Get hash	malicious	Mirai, Okiru	Browse	34.249.145.219
	EQYrfnHzXO.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	http://www.mh3solaroh.com/	Get hash	malicious	HTMLPhisher	Browse	44.225.38.235

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://microsoft-microsoft-microsoft-microsoft-microsoft.glowlaundry.com/?office=bWhhc2Vscm90aEBuZXhwb2ludC5jb20	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	https://falic.co/office/office_cookies/main/	Get hash	malicious	Unknown	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	http://papajoeschicago.com	Get hash	malicious	Unknown	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	https://lide.alosalca.fun/highbox#joeblow@xyz.com	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	http://welcome.visionaryyouth.org	Get hash	malicious	Unknown	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	https://www.bing.com/ck/a?!&&p=8c604c2d3901cb1eJmltdHM9MTcxMjc5MzYwMCZpZ3VpZD0wODdjNjgyYy00N2ZlLTYyOGQtMzA1ZC03YmVmNDY5NTYzNjUmaW5zaWQ9NTE2MQ&ptn=3&ver=2&hsh=3&fclid=087c682c-47fe-628d-305d-7bef46956365&u=a1aHR0cHM6Ly9rZWljb3NlY3VyaXR5LmNvbS5teC8&ntb=1	Get hash	malicious	Unknown	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	http://asana.wf	Get hash	malicious	Unknown	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	http://neoparts.com.br./driz/oybe/am9sZW5lLmJ1cm5zQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t$?utp=consumer&	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	http://free.filesearch.club/?q=grade+9+core+french+textbook	Get hash	malicious	Unknown	Browse	52.165.165.26 184.31.62.93 173.222.162.32
	https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.31.62.93 173.222.162.32

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll (copy)	4r4WFkpvvq.exe	Get hash	malicious	RedLine	Browse
	SAlxtNmHFR.exe	Get hash	malicious	RedLine Xmrig	Browse
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll (copy)	PDF_stD7-a8KHOmO.cMd	Get hash	malicious	Unknown	Browse
	factura.20003802.YIs.cMd	Get hash	malicious	Unknown	Browse
	4r4WFkpvvq.exe	Get hash	malicious	RedLine	Browse
	SAlxtNmHFR.exe	Get hash	malicious	RedLine Xmrig	Browse
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSProducstInfo.dll (copy)	PDF_stD7-a8KHOmO.cMd	Get hash	malicious	Unknown	Browse
	factura.20003802.YIs.cMd	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137728
Entropy (8bit):	6.519276632911069
Encrypted:	false
SSDEEP:	3072:oyuMDW7FLRn4ctpQzp9wgqiCqxkGkcCmFhhOZIA:oyuMDiFLhlbQwgSykdc7hYI
MD5:	30EBDC01D3AB9FB3772445CB4A9EBBBA
SHA1:	F0EEE5C8A4F416673EE5A0698075C124AEFC5D14
SHA-256:	0EA512EAC7298ED72E8D47DA4DB8D73557599CD2411F69657CC374CD0704E8E8
SHA-512:	4BE686006D169DCD1F18DD85B0CBF0C13E1E6CFE6EC60F9CEA32BA1AFAE811C0DD232DE2D569DE164A7C5A1108960551B04C28600F8959A51FC0BDED78CA3FA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 4r4WFkpvvq.exe, Detection: malicious, Browse Filename: SAlxtNmHFR.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.!E'.rE'.rE'.rQ\|rQ'.rQIrj'.rQHr+'.rL_qr@'.rE'.r.'.rQMr@'.rQyrD'.rQ.rD'.rRichE'.r................PE..L...Z..Q...........!................~........................................p............@......................... ...].......<....@.......................P..(................................... ...@...............8............................text...S........................... ..`.rdata..}Q.......R..................@..@.data....7..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSProducstInfo.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	708608
Entropy (8bit):	6.46030877161514
Encrypted:	false
SSDEEP:	12288:qETlpkPPcE+qXW/fLXeKGVQHL+63jcxsf+SxWWfW+XYNfCJN4C/5AWPty0Da888Y:XJWPEZ8W/fLXPGVQHL+63jEsf+SxWWfV
MD5:	6CD81E6343AB21A1D118243AF54833A8
SHA1:	BBE1A06BD85AF7099FB111AC13D19DF5F7F22CC0
SHA-256:	306970A9D265A45ABBD2EFAF61002980695B2DE7961504CF71E2833F415E82A9
SHA-512:	295446E3732281B3AFB6B06684E2642A79E6B284608305291CC01967C45D2BA5892EF687DE084DBC9A22180233F1602A8C2236EC969DDDA34C25D4F4E6691328
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PDF_stD7-a8KHOmO.cMd, Detection: malicious, Browse Filename: factura.20003802.YIs.cMd, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...H*.X..........................................@.....................................................................r........4..................................................................................<................................text...@........................... ..`.itext.............................. ..`.data....1.......2..................@....bss.....R...0...........................idata...4.......6..................@....edata..r............<..............@..@.reloc...............>..............@..B.rsrc...............................@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1506304
Entropy (8bit):	6.548348952325719
Encrypted:	false
SSDEEP:	24576:ffMWltiJhYpFd0xsgDUZXW/Xt33nETMiZGwQvABbgYBO3wTgoyTG0Q0dp:TtiJhASK5Z4XWTMiAzEgYBOATgoyTG0t
MD5:	B16AD0DD6C69C0C117C9D3647517786C
SHA1:	825A54040C8E8DFE9FFB243796DF806EE5B05708
SHA-256:	E8EACE4E643BA86E5C4D1B966037A47E53836B5D328F2295713184613A72020F
SHA-512:	23512007A593D62C446923C446B07D64476CECF9F7EA22DBDBE48965DAA482517C7F3F50A55B7B6ED3989BE3DF2F96004CAFE3BB2204BCDE401AAE00FFD44632
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PDF_stD7-a8KHOmO.cMd, Detection: malicious, Browse Filename: factura.20003802.YIs.cMd, Detection: malicious, Browse Filename: 4r4WFkpvvq.exe, Detection: malicious, Browse Filename: SAlxtNmHFR.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$.[.E...E...E.......E..;....E...=...E...=..!E...E.."E...=...E...=...E...=...E...=...E.......E...=...E..Rich.E..................PE..L....).X...........!.....>...........r.......P...............................`............@.........................p...L............P.......................`..L... S...............................7..@............P..d............................text...\=.......>.................. ..`.rdata...g...P...h...B..............@..@.data...(........R..................@....rsrc........P......................@..@.reloc..v....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\KPByName.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	6.012459225737119
Encrypted:	false
SSDEEP:	768:lQ8ZQKneCKmzF5Ltgl6nPhbyDGnTEDtP6FPBvU+Kw:i6e+ln5Ossy0+Kw
MD5:	4EF13E267EBBF804DD4157B447AA7059
SHA1:	B9507C5B02BBAE456AE5DE7132EBAFD27206B944
SHA-256:	2476D897A6D20653578FCB98737C85CCD96A42E57F67843FFBC431C0D05909A7
SHA-512:	81DF3F309B6A734FAE2E824A4535D9A7251D94885593C7C37EE70853F7C721062023D0D22BA1C92845C6FD14356048478B83C132AA9CEC9360690A65B74BF360
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@..'...t...t...t..5t...tk..t...tk.3t...tk..t8..t..>t...t...tH..tk..t...tk.6t...tk.0t...tRich...t........PE..L...eq.R...........!.....P...8...............`............................................@.........................p........z..<...............................(...Pa...............................x..@............`..$............................text...4O.......P.................. ..`.rdata...!...`..."...T..............@..@.data................v..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Languages\English.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7060
Entropy (8bit):	3.53605810128347
Encrypted:	false
SSDEEP:	96:MrFjxZ5DWmgDD6+ANF9Go+t5SaHRcDI8EMDkDMDdr8rw72+C/DIAhDtzDqD6FAke:Q/Z5aDWnj+t5SYcNgoP7U/hhBzW26kCV
MD5:	F49B3DC0407D545259D7518171970C52
SHA1:	9246CDA22F90D743128250CCBDBCF06929C55D4B
SHA-256:	516482B3719D639BDE4E134B09E227B51610D307EA9B53C425D70BC705043934
SHA-512:	809867A7CE7D4C784DE7F51F3CBD61FBD5AC724C0745A327D51887D5140F26DE2815B04BEEA4A76AB73057752EE443B865BEE0D594A81D3D8227285BF1D28C65
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.". .s.t.a.n.d.a.l.o.n.e.=.".y.e.s.".?.>.....<.L.a.n.g.u.a.g.e.R.e.s.o.u.r.c.e. .I.d.=.".E.N.U.". .n.a.m.e.=.".E.n.g.l.i.s.h.". .L.o.c.a.l.e.N.a.m.e.=.".E.n.g.l.i.s.h.". .V.e.r.s.i.o.n.=.".1...1.". .L.a.n.g.I.D.=.".0.x.0.4.0.9.". .C.o.d.e.P.a.g.e.=.".1.2.5.2.". .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...D.a.n.i.u.s.o.f.t...c.o.m./.".>..... . .<.D.e.f.a.u.l.t.>..... . . . .<.F.o.n.t. .S.i.z.e.=.".8.". .C.h.a.r.s.e.t.=.".A.N.S.I._.C.H.A.R.S.E.T.".>.<./.F.o.n.t.>..... . .<./.D.e.f.a.u.l.t.>..... . .<.S.t.r.i.n.g.s.>.......<.P.r.o.g.r.a.m.N.a.m.e.>.C.u.s.t.o.m. .S.e.r.v.i.c.e. .P.l.a.t.f.o.r.m.<./.P.r.o.g.r.a.m.N.a.m.e.>.......<.I.N.F._.D.o.w.n.l.o.a.d.F.i.l.e.N.o.t.E.x.i.s.t.>.S.o.r.r.y.,. .a.n. .e.r.r.o.r. .i.n. .t.h.e. .d.o.w.n.l.o.a.d.i.n.g. .f.i.l.e.!. .P.l.e.a.s.e. .c.o.n.t.a.c.t. .c.u.s.t.o.m.e.r. .s.e.r.v.i.c.e. .f.o.r. .h.e.l.p...<./.I.N.F._.D.o.w.n.l.o.a.d.F.i.l.e.N.o.t.E.x.i.s.t.>.......<.I.N.F._.T.i.m.e.O.u.t.>.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Languages\is-R7B0L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7060
Entropy (8bit):	3.53605810128347
Encrypted:	false
SSDEEP:	96:MrFjxZ5DWmgDD6+ANF9Go+t5SaHRcDI8EMDkDMDdr8rw72+C/DIAhDtzDqD6FAke:Q/Z5aDWnj+t5SYcNgoP7U/hhBzW26kCV
MD5:	F49B3DC0407D545259D7518171970C52
SHA1:	9246CDA22F90D743128250CCBDBCF06929C55D4B
SHA-256:	516482B3719D639BDE4E134B09E227B51610D307EA9B53C425D70BC705043934
SHA-512:	809867A7CE7D4C784DE7F51F3CBD61FBD5AC724C0745A327D51887D5140F26DE2815B04BEEA4A76AB73057752EE443B865BEE0D594A81D3D8227285BF1D28C65
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.". .s.t.a.n.d.a.l.o.n.e.=.".y.e.s.".?.>.....<.L.a.n.g.u.a.g.e.R.e.s.o.u.r.c.e. .I.d.=.".E.N.U.". .n.a.m.e.=.".E.n.g.l.i.s.h.". .L.o.c.a.l.e.N.a.m.e.=.".E.n.g.l.i.s.h.". .V.e.r.s.i.o.n.=.".1...1.". .L.a.n.g.I.D.=.".0.x.0.4.0.9.". .C.o.d.e.P.a.g.e.=.".1.2.5.2.". .x.m.l.n.s.=.".h.t.t.p.:././.w.w.w...D.a.n.i.u.s.o.f.t...c.o.m./.".>..... . .<.D.e.f.a.u.l.t.>..... . . . .<.F.o.n.t. .S.i.z.e.=.".8.". .C.h.a.r.s.e.t.=.".A.N.S.I._.C.H.A.R.S.E.T.".>.<./.F.o.n.t.>..... . .<./.D.e.f.a.u.l.t.>..... . .<.S.t.r.i.n.g.s.>.......<.P.r.o.g.r.a.m.N.a.m.e.>.C.u.s.t.o.m. .S.e.r.v.i.c.e. .P.l.a.t.f.o.r.m.<./.P.r.o.g.r.a.m.N.a.m.e.>.......<.I.N.F._.D.o.w.n.l.o.a.d.F.i.l.e.N.o.t.E.x.i.s.t.>.S.o.r.r.y.,. .a.n. .e.r.r.o.r. .i.n. .t.h.e. .d.o.w.n.l.o.a.d.i.n.g. .f.i.l.e.!. .P.l.e.a.s.e. .c.o.n.t.a.c.t. .c.u.s.t.o.m.e.r. .s.e.r.v.i.c.e. .f.o.r. .h.e.l.p...<./.I.N.F._.D.o.w.n.l.o.a.d.F.i.l.e.N.o.t.E.x.i.s.t.>.......<.I.N.F._.T.i.m.e.O.u.t.>.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\error.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.40869069843009
Encrypted:	false
SSDEEP:	24:hMNmlB0spgPkQd/RYtiFRbv3/27FRbvd7FRbvylzJXRhO8ocosrG:Im3vpgsQd/StMBv3/uBvbBvyvHG
MD5:	B4CE7824900DB5D316B0D480F15543E3
SHA1:	293A4A84741D7A3F5B0258285C21B47F6C731545
SHA-256:	5C1207FF67E880026A49053DA8B1A28D6941ACA42CDC78699923303E688A7AB4
SHA-512:	135A3AB13DC9CFD2DD4D1602A5ADA507655D6107F4B5532F773CC666097372A14F387351DC04A5E7ACDC53568D9D0096FCE231F1FCF97F7FFD8234BCA1223C66
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>.....</title>.<style>.html{overflow-x:hidden;}..window{..width:837px;..padding-top:20px;..padding-left:50px;.}..window .warning_image{..float:left;..width:150px;..height:200px;.}..window .warning_text{..float:left;..padding-left:20px;.}..title{..font-size:18px;..font-weight:bold;..font-family:Arial, Helvetica, sans-serif;.}..title_1{..font-size:16px;..margin:20px 0px;..font-family:Arial, Helvetica, sans-serif;.}..item{..font-size:14px;..font-weight:bold;..margin:10px 0px;..font-family:Arial, Helvetica, sans-serif;.}..clear{..clear:both;.}.</style>..</head>..<body>.<div class="window">..<div class="warning_image"><img src="error.png" /></div>. <div class="warning_text">. <span class="title">Oops! It looks like something went

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 117 x 117, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12443
Entropy (8bit):	7.968410137817272
Encrypted:	false
SSDEEP:	192:wS0tKg9E05TkVpuNtyLEES29Xay68AoB9+EmOb3NvfHfS2uHO42ogULGIp:0XE05dN4LEX2tay2WdvfHCr2oD/
MD5:	F98BB37E0D8C60449BF62CA30C823FBB
SHA1:	E9F1A33A0236B959148EBF1D7B015CDA2F445050
SHA-256:	292F246205B4776D7200B268CDE0ED8264D960014DA81E0D244840A13B962AF3
SHA-512:	6F6243E60A0635A9088971A6318CB425A845BBC33D5236B355416895FF022C5F9583B8952AA9552AE59E56B9207A494932C00F5586C192AF3F0C2CBDDE2F1CF0
Malicious:	false
Preview:	.PNG........IHDR...u...u.....p.......pHYs..........o.d...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\is-JIB4R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 117 x 117, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12443
Entropy (8bit):	7.968410137817272
Encrypted:	false
SSDEEP:	192:wS0tKg9E05TkVpuNtyLEES29Xay68AoB9+EmOb3NvfHfS2uHO42ogULGIp:0XE05dN4LEX2tay2WdvfHCr2oD/
MD5:	F98BB37E0D8C60449BF62CA30C823FBB
SHA1:	E9F1A33A0236B959148EBF1D7B015CDA2F445050
SHA-256:	292F246205B4776D7200B268CDE0ED8264D960014DA81E0D244840A13B962AF3
SHA-512:	6F6243E60A0635A9088971A6318CB425A845BBC33D5236B355416895FF022C5F9583B8952AA9552AE59E56B9207A494932C00F5586C192AF3F0C2CBDDE2F1CF0
Malicious:	false
Preview:	.PNG........IHDR...u...u.....p.......pHYs..........o.d...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\is-V9H4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.40869069843009
Encrypted:	false
SSDEEP:	24:hMNmlB0spgPkQd/RYtiFRbv3/27FRbvd7FRbvylzJXRhO8ocosrG:Im3vpgsQd/StMBv3/uBvbBvyvHG
MD5:	B4CE7824900DB5D316B0D480F15543E3
SHA1:	293A4A84741D7A3F5B0258285C21B47F6C731545
SHA-256:	5C1207FF67E880026A49053DA8B1A28D6941ACA42CDC78699923303E688A7AB4
SHA-512:	135A3AB13DC9CFD2DD4D1602A5ADA507655D6107F4B5532F773CC666097372A14F387351DC04A5E7ACDC53568D9D0096FCE231F1FCF97F7FFD8234BCA1223C66
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>.....</title>.<style>.html{overflow-x:hidden;}..window{..width:837px;..padding-top:20px;..padding-left:50px;.}..window .warning_image{..float:left;..width:150px;..height:200px;.}..window .warning_text{..float:left;..padding-left:20px;.}..title{..font-size:18px;..font-weight:bold;..font-family:Arial, Helvetica, sans-serif;.}..title_1{..font-size:16px;..margin:20px 0px;..font-family:Arial, Helvetica, sans-serif;.}..item{..font-size:14px;..font-weight:bold;..margin:10px 0px;..font-family:Arial, Helvetica, sans-serif;.}..clear{..clear:both;.}.</style>..</head>..<body>.<div class="window">..<div class="warning_image"><img src="error.png" /></div>. <div class="warning_text">. <span class="title">Oops! It looks like something went

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\Thumbs.db (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	7.940478928269019
Encrypted:	false
SSDEEP:	3072:Z3eJ0ByiYPG+PzScfONVkzR8P7YIwpyyqUKOiSwWLvNPI/IAboX:ZOJ0BtkPzSIVFIyq2GWLeBbK
MD5:	D2C420E76DE50364A60A21754D274FCE
SHA1:	6DFECDF2501CF35C87CE7462A5644B9825963CE5
SHA-256:	CF1B7502EAB212A61C1D20E48DD3FFD91B7DA51C164349130E5171A52A4C3CEB
SHA-512:	04EB6AAA240ECB85C227E4B5113921E8ED03C364C22EDCA5762BEA187B919073BC1E7B6550E7C95B18B0862BC9AFEA2FD0FB92EBBB59442AF6594BA0DCAF9BDD
Malicious:	false
Preview:	......................>.......................................................O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...........Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\data-recovery-box-bg.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29279
Entropy (8bit):	7.987430486869946
Encrypted:	false
SSDEEP:	768:zoSVGOGMeaCGvo2WSzC4oET5VvgtNDmPMFMKuO6wYO9hyrOQXA:zBsOGol/LoET59gHEKuOLd
MD5:	87128272A00531EDABF18839D1A78B7A
SHA1:	7E63BF78ED95242D65D5E54276688FFEA8B3FB6F
SHA-256:	1D28C70A59DC75B341D05B54EC3168F44DC2728FE157C6EF8CFF3F7C49AD0ABB
SHA-512:	B94D5F3AB7FA63551AAC0B35DA5CBB93B6A1C0AFF932E59898E328EC98B0D27B389A46CAC7FFD4D716219E86D3F060522AAC6D36089F8A27DF2F1371FFE708FB
Malicious:	false
Preview:	.PNG........IHDR...............g-....tEXtSoftware.Adobe ImageReadyq.e<..r.IDATx....dWu&..S.n.o.V+'$...!Y....`l.m..{>{x.03...x...~...08...,.m.$$!........n..V>....9....Bv./.\|.;].T.s.....RJ..?!...$...j......6~.7....\|.....h..}.{.O}.C..L...GUh..).Vh+.....Es..N....5.8...<..+..K...s...v...7..'%...??...t..z..FC...m...7....c>.....+++.s......f...h..\|.%...K.v9...........O....W2.+....1.w.<.....6k@. .3...1._2.K...../.}..i.......T...z.W.K..0.K.k.........o.<i@)..'....8m...5s...PZ...H._.L$~...............0.X..3...I......J..q..o..k..t+5.FE.t]1.1..:...g.......h:&C.Y.U.Y....`7..V......&..A....x.j5..S.O.W..3.v. ..vv`t..[...a...h....P_'.... ..D.'........k..........'.@].l.]6.W.`..q.11j..@saH..A......[XZB...v.&.`.W.Rk.Z.a.$..'....Oc...i..;6.c.!\.c......f;.7g._.O.l..C......?oAM...vU...Z...m....@T.Y.s.\4._6.K1@W.Ml_..o;.{..=.L.#.}}7.I.OL(.jM.C.c %..D:.....'...I..e..X..O.G........>\.m.W..H.....1d.M@..............g.Z...../...r./B.......+.V..M...5..I1k.Us....E..

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\dvd-slideshow-builder-deluxe-box-bg.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	33188
Entropy (8bit):	7.990206358197219
Encrypted:	true
SSDEEP:	768:pch2gfMMt8hKXUK/c/EVmRYsPjdBd5FOPkmXnL7Ta:Gwg0WNXUK/eEciPhn3Ta
MD5:	744AE28C6E88A985EBC1EB367BD8FF57
SHA1:	A6F93D80AC03EEA9AB9F6DA7AA4E0029DE15B036
SHA-256:	0A51F95D27C4A86EFE3EC70FA9FB836B0822B6ACD344F735666E01AE5A94BD0C
SHA-512:	30193066BCEC50307F880C9DE6A4A0EBE0C3F7E47E8841624A0F7AE64B81182DC7EAA05A6DA43916F75E8C0A1123E45AB3FAFFB0FFD9B2D3F7C9319C04F57270
Malicious:	false
Preview:	.PNG........IHDR...............g-....tEXtSoftware.Adobe ImageReadyq.e<...FIDATx......y%x+....972@"..H. E.J4EK....v-...k{.=.....\|v.xek.`K.#YV..s.3..D.s.....U..B...A.2.G...+.....w...T...............N.{w7n4....n.........C.=..w/\|&....?............omkk......^?...0.'......S\|..>....\..X,.P(.r...#..bff........3....q.....s..[x..:88......D.Ql..._.<......]]]...V.+........f........T.s...L&...}..J%.{r.e{./.@.>..._W...~7.H.......n..t:...r..6fgg!V.f...........T..d.6.8d..../....}...O....O.........?..<...E....L..9Ir..(w.....y....q3q....8._...<.....(......Y.v..m.T~.....h.Q'L.....#?.....#...M.B..F.....2 .......1X....<pS..)..&.L.!&...t.. 8G...\@..{..K....v.)`W1..P.xz..........~...$.x1.---.L...3%..8..y...!.y.....2...yVL..Q.#4gQ..0.;...C.....v.....$.........Vk.~z.W......Fm.)....".&&X......,s..E.?...T....~._...i.q.......5.Ps....^.t.[r.}$...l....4....f[[[#.,.\|m..>..c.8s.\.......k....?e....<.@......5.C...B.7.\$...r.r..4".....J,.YQ.5s.n..Z......gUA..a

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-FBAKU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29169
Entropy (8bit):	7.988124874474133
Encrypted:	false
SSDEEP:	768:tiUJhGlFlcs6w40/53ItWPNI6wLPte2QNRk/UGzHjbtSwHD:tikhGfZrxoW66wLFw6sGbjpSO
MD5:	3563BC5CBA3A3D36E77CE5B45C8456E8
SHA1:	BE39CA79CAF2178C9A40D3541A0E9EF316E3C895
SHA-256:	0136B0C6BD109EA7656E7821278B8185E60CEACC168AF066A91278E51A0BA210
SHA-512:	987646C827A5BFBB915A989CDE4E6D111D05A20419377093A640C297685F3362462CF5C0D4E4825A117006414BD13719A74F3449D12C0AE171B20F3BD3FBBE90
Malicious:	false
Preview:	.PNG........IHDR...............g-....tEXtSoftware.Adobe ImageReadyq.e<..q.IDATx....$.U&...=......Vwk.e-..}_.1...x..~.7....{....0+....y..vc0....[^d.l.j..V.[..^YY.oq.9......jlKV.\.Pe.........s........w....!...w.'..#<..t... ..A).v.-..m.qX8..%_..4....W.../\|..N.V.."m5...-.V......d...+.._...............u=..vo......l.....H.m~O..?.j.g.E<nN.....7........o..w.....E.R)$.I..y.._...7.y..w:.....v..y.........<0..{,..]...K......-..u{...F[..p....o..]....U......K....E....\...\n.5..'+.rx..Wr...D..q.].O...dAZs.3.g..t....]..[..l.{...v........O&......%.....WV........4}.?..a.].O.1...J....F..e.w..U..k.."..w..E.]...H.)~.........^............-..k.Uk.z.......?.._...0FFG111...ql..S.S...x!w..P.n.._.f......U.Z...-.V-.2H.x...7....2H.6..tX..c 7.....{....7..d~!?..?.7.V,.R....9W.qX..Ja..?...`>.I...l..CC.......1M@......4v...rX.[R..$.0...........g.Z.6..^g.3s...F.....n.H...t.....W..Jre....Th+..Z..^......4<<..2...*..U.x.v...z:..<..@>O..........XY-......#O .N.'6..2../.....}.ahp.;...s.,v..X...

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-H5E9E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36757
Entropy (8bit):	7.988097688838413
Encrypted:	false
SSDEEP:	768:S35OFxgy0DDfNRRoUHumrGIVkgIDZ56NFMFTGY7VTLls2cTAr7:LFiZDDnqUN7kFDZXx37V12Tq
MD5:	99F55783C61E593D428A6C9FD3A3D094
SHA1:	75B0684D096FC141C9F74985817ED6FF7EE6CA49
SHA-256:	E8F23D7604C8BC62238069200840C270A209D670BE210D67FC3C703ED6A681B6
SHA-512:	5BF5A7981520DA38E3D3F757E164E92F0430F10E6EB39F801451F474DC62F8EEE8D0FCEEA3355C89925739982F7C42F3DD4095F6A4818198205DEA3F14DE48D9
Malicious:	false
Preview:	.PNG........IHDR...............g-....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-LMGRA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	33188
Entropy (8bit):	7.990206358197219
Encrypted:	true
SSDEEP:	768:pch2gfMMt8hKXUK/c/EVmRYsPjdBd5FOPkmXnL7Ta:Gwg0WNXUK/eEciPhn3Ta
MD5:	744AE28C6E88A985EBC1EB367BD8FF57
SHA1:	A6F93D80AC03EEA9AB9F6DA7AA4E0029DE15B036
SHA-256:	0A51F95D27C4A86EFE3EC70FA9FB836B0822B6ACD344F735666E01AE5A94BD0C
SHA-512:	30193066BCEC50307F880C9DE6A4A0EBE0C3F7E47E8841624A0F7AE64B81182DC7EAA05A6DA43916F75E8C0A1123E45AB3FAFFB0FFD9B2D3F7C9319C04F57270
Malicious:	false
Preview:	.PNG........IHDR...............g-....tEXtSoftware.Adobe ImageReadyq.e<...FIDATx......y%x+....972@"..H. E.J4EK....v-...k{.=.....\|v.xek.`K.#YV..s.3..D.s.....U..B...A.2.G...+.....w...T...............N.{w7n4....n.........C.=..w/\|&....?............omkk......^?...0.'......S\|..>....\..X,.P(.r...#..bff........3....q.....s..[x..:88......D.Ql..._.<......]]]...V.+........f........T.s...L&...}..J%.{r.e{./.@.>..._W...~7.H.......n..t:...r..6fgg!V.f...........T..d.6.8d..../....}...O....O.........?..<...E....L..9Ir..(w.....y....q3q....8._...<.....(......Y.v..m.T~.....h.Q'L.....#?.....#...M.B..F.....2 .......1X....<pS..)..&.L.!&...t.. 8G...\@..{..K....v.)`W1..P.xz..........~...$.x1.---.L...3%..8..y...!.y.....2...yVL..Q.#4gQ..0.;...C.....v.....$.........Vk.~z.W......Fm.)....".&&X......,s..E.?...T....~._...i.q.......5.Ps....^.t.[r.}$...l....4....f[[[#.,.\|m..>..c.8s.\.......k....?e....<.@......5.C...B.7.\$...r.r..4".....J,.YQ.5s.n..Z......gUA..a

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-MPHO2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	7.940478928269019
Encrypted:	false
SSDEEP:	3072:Z3eJ0ByiYPG+PzScfONVkzR8P7YIwpyyqUKOiSwWLvNPI/IAboX:ZOJ0BtkPzSIVFIyq2GWLeBbK
MD5:	D2C420E76DE50364A60A21754D274FCE
SHA1:	6DFECDF2501CF35C87CE7462A5644B9825963CE5
SHA-256:	CF1B7502EAB212A61C1D20E48DD3FFD91B7DA51C164349130E5171A52A4C3CEB
SHA-512:	04EB6AAA240ECB85C227E4B5113921E8ED03C364C22EDCA5762BEA187B919073BC1E7B6550E7C95B18B0862BC9AFEA2FD0FB92EBBB59442AF6594BA0DCAF9BDD
Malicious:	false
Preview:	......................>.......................................................O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...........Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-P4DSA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.985443931985525
Encrypted:	false
SSDEEP:	768:oVHMfQgNFrnMqMWkpCQbfXP5QXkxjmAHzMo6jfB:fF7FRs3fXx/6GMl
MD5:	8E337433EA25FE5683C5E9FF968B6A1C
SHA1:	5CB4FAB6DC7C127B416EF6BE7722FD7A092BFC88
SHA-256:	6A4BE297CEDE19FAB3C75E231D54DB5F8A5C6C0EBB11A63B8E77D4F47AD516B7
SHA-512:	B4FBEC2DE5D87A68E52633EFEA3B1795A185B982349C78D8354C21561ABE76078B85737A3316FFE801EBC6D6F8B3F089E384785EECF3C6C4579311805CAAD434
Malicious:	false
Preview:	.PNG........IHDR...............g-....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-T1G8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29279
Entropy (8bit):	7.987430486869946
Encrypted:	false
SSDEEP:	768:zoSVGOGMeaCGvo2WSzC4oET5VvgtNDmPMFMKuO6wYO9hyrOQXA:zBsOGol/LoET59gHEKuOLd
MD5:	87128272A00531EDABF18839D1A78B7A
SHA1:	7E63BF78ED95242D65D5E54276688FFEA8B3FB6F
SHA-256:	1D28C70A59DC75B341D05B54EC3168F44DC2728FE157C6EF8CFF3F7C49AD0ABB
SHA-512:	B94D5F3AB7FA63551AAC0B35DA5CBB93B6A1C0AFF932E59898E328EC98B0D27B389A46CAC7FFD4D716219E86D3F060522AAC6D36089F8A27DF2F1371FFE708FB
Malicious:	false
Preview:	.PNG........IHDR...............g-....tEXtSoftware.Adobe ImageReadyq.e<..r.IDATx....dWu&..S.n.o.V+'$...!Y....`l.m..{>{x.03...x...~...08...,.m.$$!........n..V>....9....Bv./.\|.;].T.s.....RJ..?!...$...j......6~.7....\|.....h..}.{.O}.C..L...GUh..).Vh+.....Es..N....5.8...<..+..K...s...v...7..'%...??...t..z..FC...m...7....c>.....+++.s......f...h..\|.%...K.v9...........O....W2.+....1.w.<.....6k@. .3...1._2.K...../.}..i.......T...z.W.K..0.K.k.........o.<i@)..'....8m...5s...PZ...H._.L$~...............0.X..3...I......J..q..o..k..t+5.FE.t]1.1..:...g.......h:&C.Y.U.Y....`7..V......&..A....x.j5..S.O.W..3.v. ..vv`t..[...a...h....P_'.... ..D.'........k..........'.@].l.]6.W.`..q.11j..@saH..A......[XZB...v.&.`.W.Rk.Z.a.$..'....Oc...i..;6.c.!\.c......f;.7g._.O.l..C......?oAM...vU...Z...m....@T.Y.s.\4._6.K1@W.Ml_..o;.{..=.L.#.}}7.I.OL(.jM.C.c %..D:.....'...I..e..X..O.G........>\.m.W..H.....1d.M@..............g.Z...../...r./B.......+.V..M...5..I1k.Us....E..

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\mobilego-bg.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36757
Entropy (8bit):	7.988097688838413
Encrypted:	false
SSDEEP:	768:S35OFxgy0DDfNRRoUHumrGIVkgIDZ56NFMFTGY7VTLls2cTAr7:LFiZDDnqUN7kFDZXx37V12Tq
MD5:	99F55783C61E593D428A6C9FD3A3D094
SHA1:	75B0684D096FC141C9F74985817ED6FF7EE6CA49
SHA-256:	E8F23D7604C8BC62238069200840C270A209D670BE210D67FC3C703ED6A681B6
SHA-512:	5BF5A7981520DA38E3D3F757E164E92F0430F10E6EB39F801451F474DC62F8EEE8D0FCEEA3355C89925739982F7C42F3DD4095F6A4818198205DEA3F14DE48D9
Malicious:	false
Preview:	.PNG........IHDR...............g-....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\pdf-converter-pro-box-bg.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.985443931985525
Encrypted:	false
SSDEEP:	768:oVHMfQgNFrnMqMWkpCQbfXP5QXkxjmAHzMo6jfB:fF7FRs3fXx/6GMl
MD5:	8E337433EA25FE5683C5E9FF968B6A1C
SHA1:	5CB4FAB6DC7C127B416EF6BE7722FD7A092BFC88
SHA-256:	6A4BE297CEDE19FAB3C75E231D54DB5F8A5C6C0EBB11A63B8E77D4F47AD516B7
SHA-512:	B4FBEC2DE5D87A68E52633EFEA3B1795A185B982349C78D8354C21561ABE76078B85737A3316FFE801EBC6D6F8B3F089E384785EECF3C6C4579311805CAAD434
Malicious:	false
Preview:	.PNG........IHDR...............g-....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\video-converter-ultimate-bg.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29169
Entropy (8bit):	7.988124874474133
Encrypted:	false
SSDEEP:	768:tiUJhGlFlcs6w40/53ItWPNI6wLPte2QNRk/UGzHjbtSwHD:tikhGfZrxoW66wLFw6sGbjpSO
MD5:	3563BC5CBA3A3D36E77CE5B45C8456E8
SHA1:	BE39CA79CAF2178C9A40D3541A0E9EF316E3C895
SHA-256:	0136B0C6BD109EA7656E7821278B8185E60CEACC168AF066A91278E51A0BA210
SHA-512:	987646C827A5BFBB915A989CDE4E6D111D05A20419377093A640C297685F3362462CF5C0D4E4825A117006414BD13719A74F3449D12C0AE171B20F3BD3FBBE90
Malicious:	false
Preview:	.PNG........IHDR...............g-....tEXtSoftware.Adobe ImageReadyq.e<..q.IDATx....$.U&...=......Vwk.e-..}_.1...x..~.7....{....0+....y..vc0....[^d.l.j..V.[..^YY.oq.9......jlKV.\.Pe.........s........w....!...w.'..#<..t... ..A).v.-..m.qX8..%_..4....W.../\|..N.V.."m5...-.V......d...+.._...............u=..vo......l.....H.m~O..?.j.g.E<nN.....7........o..w.....E.R)$.I..y.._...7.y..w:.....v..y.........<0..{,..]...K......-..u{...F[..p....o..]....U......K....E....\...\n.5..'+.rx..Wr...D..q.].O...dAZs.3.g..t....]..[..l.{...v........O&......%.....WV........4}.?..a.].O.1...J....F..e.w..U..k.."..w..E.]...H.)~.........^............-..k.Uk.z.......?.._...0FFG111...ql..S.S...x!w..P.n.._.f......U.Z...-.V-.2H.x...7....2H.6..tX..c 7.....{....7..d~!?..?.7.V,.R....9W.qX..Ja..?...`>.I...l..CC.......1M@......4v...rX.[R..$.0...........g.Z.6..^g.3s...F.....n.H...t.....W..Jre....Th+..Z..^......4<<..2...*..U.x.v...z:..<..@>O..........XY-......#O .N.'6..2../.....}.ahp.;...s.,v..X...

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\is-27N8U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	HTML document, ASCII text, with very long lines (420), with CRLF line terminators
Category:	dropped
Size (bytes):	18197
Entropy (8bit):	5.093622606898989
Encrypted:	false
SSDEEP:	384:SIMdWoYHGAf6mBST6/ueHdMcpEOXHqNDfaC12KYD64RXRNWZ9FDmumc:SVMoYHGAf6mBST6/uemMEOXHqNDfaw2C
MD5:	7738DD9E28BC3A7FDE75840FB8BA830E
SHA1:	74D297F724809679DF141006917C02AE1CF98D8B
SHA-256:	4DBF25243BB4F96BC44CEE4B476B47BA3FE2D1A251AB15813C580EE4B5C8FF19
SHA-512:	A66BFE8842F96A51100BB98C1AFD7200096A41F914B75296EB3C3FE5B6AC15CEA7CDBA0D2A0DB7D1346D3869621868CC32AA6E668A39B901978B15D4CF0BD285
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />..<title>Wondershare Suite for Windows</title>..<link href="style/style.css" rel="stylesheet" type="text/css" />..</head>..<body>..<div class="main">...<div class="mainNav">.. .<ul>.. <li class="curr">Video&DVD</li>.. .<li>Photo</li> .. <li>PDF</li>.. <li>Utilities</li>.. <li>Mobile</li>.. </ul>.. </div>.. ..<div class="content">..<div class="pro-img">.. <a href="http://www.wondershare.com/pro/video-converter-ultimate.html?utm_source=suite-windows&utm_medium=pro&utm_campaign=pro" target="_blank"><img src="images/video-converter-ultimate-bg.png" width="145" /></a>.. <div class="price">$69.95</div>.. </div>.. <div class="pro-info">..

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\Thumbs.db (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	7.0565364084181
Encrypted:	false
SSDEEP:	384:uZmf3+04ses8g573m5LYgJcdcsaeeymDF4C+LDl:uEfu00FgZ3mR9JwtteyUnUR
MD5:	F60AECD251029C1E7C53F277713113D5
SHA1:	476712D4AED3FA243B33E066083AC32061D043C7
SHA-256:	81930E5D0BE9EE2693C53418C8FA0AAD15DBE574C9F92380130E2CAAD57C7AD7
SHA-512:	B11E52F2B762363AA92F22F629260A5C54FC2A0B1B6C04D04A8BC4878279D1BA4731C7BB35B7C34FC0B942041ADBA64CC2CDCE4570A48DB451F65F81E74ECD53
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\adv-bg_20.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 30 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	421
Entropy (8bit):	7.252912681588048
Encrypted:	false
SSDEEP:	6:6v/lhPInDs/HdCVLAOjgdk1M+lhWaydrdSq5r1H2skr9K2BFLlcHBkYPFdJ0KeRR:6v/7v/HISkW0WHdrdZ5rd097LeKjXyH4
MD5:	FA0B6022B2457751A6B9A6BCE5EDC4D7
SHA1:	6B002BC002B3FD8916D9274851FD0735D08FDFD7
SHA-256:	CCECAC72F0B02FF87F44018C25218B51FF20A3F3E8BC6361385573B7410DC39B
SHA-512:	334506AA1108F1BAF6FB8F35734EF6D81728BFC62F6DC62885AA8AAC2AE82D0ED8A17F318983596E619459C365F059E8AA27121ACCBE7EF28220F65518CA4430
Malicious:	false
Preview:	.PNG........IHDR.......(.....fq.E....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx.b........@.`b...5.~F...{.%E....f.r.@P.M.fW6......A.4.FVYMNC...-.v2..f.V.2........L..7.UR...&...?..dj.."".m.D.2../.....F3.I.8D.....Bs2u.f...q..Iy.....A}..x....iR......M...mChU7~.<.VF..........}...V...7O}?..V.w.....M....\|.i.LZ..>n.............i...zt=0Ji..%....../.h40.\|9..R.R...a].0.ib40..S.....4.L.41..3... ....]...1s....IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\btn.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 155 x 130, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6600
Entropy (8bit):	7.954166057346744
Encrypted:	false
SSDEEP:	192:9pjwKLcBkKtuFzQLKF35E+yQLzc8NfEe6HU:9uKLS4sKFyLQ/TfOU
MD5:	8FDF7C8E139CD02B6740B0DCF6A2D48C
SHA1:	85DBF8C76B7B5CA62C76F2B5D09D15CD953EF394
SHA-256:	904B7E4ED2A00C07F846D4FB7ACCF0C69547F88791F9A55424BA4BA0A39529FA
SHA-512:	82B3263B948A635A1C2DFE7A6AB928895DB972FCB34A60B2C7E2B5D0E564D23602968B7DD7F806F621A179974E982537276D2E1E0F97001971400F1AC9D96324
Malicious:	false
Preview:	.PNG........IHDR.............Q.......tEXtSoftware.Adobe ImageReadyq.e<...jIDATx..].\U.._..et....".C.HR......z>{Z.J3}....l..9....>.Y~eY..."Z. ..2;....Y.r.....p/\...\%......i.....>.T.x....V...^.......mx..<.....z..W.e.=;...%Wu...[j.k.....$0.jj.=..3XY[. .\....l,...`{.-....R....h.D"<..L.d.G....d......''s..^....\`.n.....z.b.Q......[%.;.Au]9.W......;....S.l..............&.r.i8...........S.....{8..S...7...[.L...w.}Ww..~HO.....lM....nhI.*..t./.b...3.v$...yfU......{WA......%../.S...........w..V-B@e.LdI.........S...[.....8!y%.P][vGrz8..;k...$.y.p.c..v.~. $5..FQ..!...z.I.%..n..A. 9..<...v.....k.Q.i...5.....{.......W5)..A6...d....].IW....`..`.fV6q....K?....,.`....>.m......>.'?.'J.J.'..~...i,..%~Y.2....K..}y.n..'.d.>H&..^.`...?..R~.A.d.Hd....^g.0...ZD........@w.o..'....&.}.h..,.B..YM..=.6Z.s"6..k........(.6...V^K~.Y.F...S..{^q.......?!.8...'..CV@..H.9.c..@T.&...v..yzw..$lGi.&i}.'..\|.q2VN9...."o-y\|......g..D......SX..c/.e.......K{._z.yV.G..Fo..._.K...\g.Z

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\buy_28.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	233
Entropy (8bit):	6.406523223418046
Encrypted:	false
SSDEEP:	6:6v/lhP8AMlgjnDspKJzkqYHWgeAczMO+tjwU/Pt36KSOmdmUfdAjjp:6v/7kAMlg8YtYleAcGtj7ntOdd8N
MD5:	5E5E811C4EFFAF00E4CBE9A6084A25A0
SHA1:	F9865E91D07999C2AEE230E52A31690EDF22210D
SHA-256:	AFBA1129138C7F76C4AF7609D7D2945D640DD562526DFF79E754E7D56B2F8632
SHA-512:	F58FF75EEC7B40BDE32CA5DBFE9EFC4E74A9BE531DB414CEF46F41D06472BA01A649C40FB620F1C31B40E36EE82E81F621533947E1D473E49C79263B97B257F9
Malicious:	false
Preview:	.PNG........IHDR...............w&....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b\|.).....2..1..LP.D.. ...@lL.b.P..3....9....!...A...q......HQ\|...;@...u.....B.......<...@..... <...@...9@..S......G .d5(....z...`........#....IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\down_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 8 x 10, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	170
Entropy (8bit):	6.026418667542106
Encrypted:	false
SSDEEP:	3:yionv//thPlvpebtHRthwkBDsTBZtpBxdNnPhOssXVLn6+S4k/2/8SgDJOH3Jk/1:6v/lhPyp5nDsppB5nPcNFW+S4k/a8SuP
MD5:	553AC54E2A9A72921BA02EC1E6CC7090
SHA1:	67C79B0C45188F56FE18508A36241BA2869F968A
SHA-256:	FFEC7E45DC3882DC928DFF5178EB3F3E54674EA7B695A8F7A2518D8146446596
SHA-512:	B3AA6B56768BCC38A7797758B3D08CA2F701AF3D0CC6F3763FF33F8A8801C5B39D4542125CE1D54DE24B321D09248FC91AFE8361B0B2CE09209CA01DC4AF483D
Malicious:	false
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...LIDATx.b.lUg.......D01...Qp...07].)p..;X...A.^..'.......j7 ...n0SYp...h_.......-.U......IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\hot_20.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 27 x 11, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	233
Entropy (8bit):	6.65744029072975
Encrypted:	false
SSDEEP:	6:6v/lhPDKGjnDspK0lEWMll7bzxVnBa4xyXgTtBSAQUVp:6v/7rKG8Yc/Mll7bdVB9EcQU7
MD5:	D1922E2D52230EF82CF93F8716F96677
SHA1:	F7444FB70B5825B945AFD7B992F5F06AB31E97AE
SHA-256:	373C08334190AD9D0F6754156A6B9B25044461929F0B219DC85491D65CECFEE8
SHA-512:	C9DB0174923307F6C00AE46C74B1990489E381BD46F9561BD36D8FA3573D685DA7C130E4743D246AF2B6C82B2F1182F94601085D238FB5CED6CD0C51F05E3A77
Malicious:	false
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...d......f........h.s C.......,....l.\...~n.....I.>.O>...9..o.Q8.a.a..T.!..r.L..#..N.`...........2Z......)52...S:...dY.(..:C....0.2.7...O....IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-5J6H1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	GIF image data, version 89a, 5 x 1
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9990210737063383
Encrypted:	false
SSDEEP:	3:Czl6bYMSQ/7/lLllnaCe:oobiYPe
MD5:	BF141F9FC3CD2EDDE4BBF5FE9A313F47
SHA1:	432CF4FE19265F24AABDB76343F8F12F090288E4
SHA-256:	FAE8732560690C1CAFDCC29B18D63A3896806ECDE9EFEAD86F068467B5AE973D
SHA-512:	BCB96942BEA7ADB470ACC72C5218F1F4BE601941A69A4A89C9C64690697DB1B1551A20476898CCC531ECA9EE49785739579E45D30B2500C9AD3A7D3CACC857A5
Malicious:	false
Preview:	GIF89a.......05819=29;...!.......,.............S.;

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-6DCVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 155 x 130, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6600
Entropy (8bit):	7.954166057346744
Encrypted:	false
SSDEEP:	192:9pjwKLcBkKtuFzQLKF35E+yQLzc8NfEe6HU:9uKLS4sKFyLQ/TfOU
MD5:	8FDF7C8E139CD02B6740B0DCF6A2D48C
SHA1:	85DBF8C76B7B5CA62C76F2B5D09D15CD953EF394
SHA-256:	904B7E4ED2A00C07F846D4FB7ACCF0C69547F88791F9A55424BA4BA0A39529FA
SHA-512:	82B3263B948A635A1C2DFE7A6AB928895DB972FCB34A60B2C7E2B5D0E564D23602968B7DD7F806F621A179974E982537276D2E1E0F97001971400F1AC9D96324
Malicious:	false
Preview:	.PNG........IHDR.............Q.......tEXtSoftware.Adobe ImageReadyq.e<...jIDATx..].\U.._..et....".C.HR......z>{Z.J3}....l..9....>.Y~eY..."Z. ..2;....Y.r.....p/\...\%......i.....>.T.x....V...^.......mx..<.....z..W.e.=;...%Wu...[j.k.....$0.jj.=..3XY[. .\....l,...`{.-....R....h.D"<..L.d.G....d......''s..^....\`.n.....z.b.Q......[%.;.Au]9.W......;....S.l..............&.r.i8...........S.....{8..S...7...[.L...w.}Ww..~HO.....lM....nhI.*..t./.b...3.v$...yfU......{WA......%../.S...........w..V-B@e.LdI.........S...[.....8!y%.P][vGrz8..;k...$.y.p.c..v.~. $5..FQ..!...z.I.%..n..A. 9..<...v.....k.Q.i...5.....{.......W5)..A6...d....].IW....`..`.fV6q....K?....,.`....>.m......>.'?.'J.J.'..~...i,..%~Y.2....K..}y.n..'.d.>H&..^.`...?..R~.A.d.Hd....^g.0...ZD........@w.o..'....&.}.h..,.B..YM..=.6Z.s"6..k........(.6...V^K~.Y.F...S..{^q.......?!.8...'..CV@..H.9.c..@T.&...v..yzw..$lGi.&i}.'..\|.q2VN9...."o-y\|......g..D......SX..c/.e.......K{._z.yV.G..Fo..._.K...\g.Z

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-7PD52.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 8 x 10, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	170
Entropy (8bit):	6.026418667542106
Encrypted:	false
SSDEEP:	3:yionv//thPlvpebtHRthwkBDsTBZtpBxdNnPhOssXVLn6+S4k/2/8SgDJOH3Jk/1:6v/lhPyp5nDsppB5nPcNFW+S4k/a8SuP
MD5:	553AC54E2A9A72921BA02EC1E6CC7090
SHA1:	67C79B0C45188F56FE18508A36241BA2869F968A
SHA-256:	FFEC7E45DC3882DC928DFF5178EB3F3E54674EA7B695A8F7A2518D8146446596
SHA-512:	B3AA6B56768BCC38A7797758B3D08CA2F701AF3D0CC6F3763FF33F8A8801C5B39D4542125CE1D54DE24B321D09248FC91AFE8361B0B2CE09209CA01DC4AF483D
Malicious:	false
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...LIDATx.b.lUg.......D01...Qp...07].)p..;X...A.^..'.......j7 ...n0SYp...h_.......-.U......IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-ABE8M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 30 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	421
Entropy (8bit):	7.252912681588048
Encrypted:	false
SSDEEP:	6:6v/lhPInDs/HdCVLAOjgdk1M+lhWaydrdSq5r1H2skr9K2BFLlcHBkYPFdJ0KeRR:6v/7v/HISkW0WHdrdZ5rd097LeKjXyH4
MD5:	FA0B6022B2457751A6B9A6BCE5EDC4D7
SHA1:	6B002BC002B3FD8916D9274851FD0735D08FDFD7
SHA-256:	CCECAC72F0B02FF87F44018C25218B51FF20A3F3E8BC6361385573B7410DC39B
SHA-512:	334506AA1108F1BAF6FB8F35734EF6D81728BFC62F6DC62885AA8AAC2AE82D0ED8A17F318983596E619459C365F059E8AA27121ACCBE7EF28220F65518CA4430
Malicious:	false
Preview:	.PNG........IHDR.......(.....fq.E....tEXtSoftware.Adobe ImageReadyq.e<...GIDATx.b........@.`b...5.~F...{.%E....f.r.@P.M.fW6......A.4.FVYMNC...-.v2..f.V.2........L..7.UR...&...?..dj.."".m.D.2../.....F3.I.8D.....Bs2u.f...q..Iy.....A}..x....iR......M...mChU7~.<.VF..........}...V...7O}?..V.w.....M....\|.i.LZ..>n.............i...zt=0Ji..%....../.h40.\|9..R.R...a].0.ib40..S.....4.L.41..3... ....]...1s....IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-CLTLP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	7.0565364084181
Encrypted:	false
SSDEEP:	384:uZmf3+04ses8g573m5LYgJcdcsaeeymDF4C+LDl:uEfu00FgZ3mR9JwtteyUnUR
MD5:	F60AECD251029C1E7C53F277713113D5
SHA1:	476712D4AED3FA243B33E066083AC32061D043C7
SHA-256:	81930E5D0BE9EE2693C53418C8FA0AAD15DBE574C9F92380130E2CAAD57C7AD7
SHA-512:	B11E52F2B762363AA92F22F629260A5C54FC2A0B1B6C04D04A8BC4878279D1BA4731C7BB35B7C34FC0B942041ADBA64CC2CDCE4570A48DB451F65F81E74ECD53
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-LMLS6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 27 x 11, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	233
Entropy (8bit):	6.65744029072975
Encrypted:	false
SSDEEP:	6:6v/lhPDKGjnDspK0lEWMll7bzxVnBa4xyXgTtBSAQUVp:6v/7rKG8Yc/Mll7bdVB9EcQU7
MD5:	D1922E2D52230EF82CF93F8716F96677
SHA1:	F7444FB70B5825B945AFD7B992F5F06AB31E97AE
SHA-256:	373C08334190AD9D0F6754156A6B9B25044461929F0B219DC85491D65CECFEE8
SHA-512:	C9DB0174923307F6C00AE46C74B1990489E381BD46F9561BD36D8FA3573D685DA7C130E4743D246AF2B6C82B2F1182F94601085D238FB5CED6CD0C51F05E3A77
Malicious:	false
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...d......f........h.s C.......,....l.\...~n.....I.>.O>...9..o.Q8.a.a..T.!..r.L..#..N.`...........2Z......)52...S:...dY.(..:C....0.2.7...O....IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-PSKLH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	troff or preprocessor input, ASCII text, with very long lines (387), with CRLF line terminators
Category:	dropped
Size (bytes):	3182
Entropy (8bit):	5.220759501145059
Encrypted:	false
SSDEEP:	48:zyF8jZooaerM+GHWH5j6Mn1+wP9yhEI7Wz0eO:+wjlrmWZj6MowPUhERz0N
MD5:	BEDBCED040A411F959953A2D2D4D1B25
SHA1:	434958541B3A98C9ABAB187262B0EF5DEE66C8AA
SHA-256:	40FAC6B92DED90B1F8D35433C4B2503BF9ECA05E15816B3AA03A5497695BF6DF
SHA-512:	DEE03676EF738E6F17981C8AA3A6F961B22EE1BD5D30E46C4E2DE0EEDE945DACBA3C944F93C9C934322DFCC5884E3ADDD71C089805742FBD5C11BA196543D9BB
Malicious:	false
Preview:	@charset "utf-8";../* CSS Document /..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td {margin:0;padding:0;}..table {border-collapse:collapse;border-spacing:0;}..img {border:0;vertical-align:middle;}..address,caption,cite,code,dfn,th,var {font-style:normal;font-weight:normal;}..ol,ul {list-style:none;}..caption,th {text-align:left;}..h1,h2,h3,h4,h5,h6 {font-size:100%;font-weight:normal;}..a{ text-decoration:none;color:#464646;}..a:hover{text-decoration:underline;}...downBtn{ display:block; background:url(btn.png) no-repeat; width:135px; height:30px; margin-right:10px;}...downBtn:hover{ background-position:0 -30px;}...buyBtn{ display:block; width:95px; height:30px; background:url(btn.png) no-repeat 0 -60px; margin-right:10px;}...buyBtn:hover{ background-position:0 -90px;}../==============basic================*/...fl {float:left;}...fr {float:right;}...clr{ clear:both; }...ml20{ margin-left:20px !important;}...mt23{ margin-top:23px !impo

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-S49BF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	233
Entropy (8bit):	6.406523223418046
Encrypted:	false
SSDEEP:	6:6v/lhP8AMlgjnDspKJzkqYHWgeAczMO+tjwU/Pt36KSOmdmUfdAjjp:6v/7kAMlg8YtYleAcGtj7ntOdd8N
MD5:	5E5E811C4EFFAF00E4CBE9A6084A25A0
SHA1:	F9865E91D07999C2AEE230E52A31690EDF22210D
SHA-256:	AFBA1129138C7F76C4AF7609D7D2945D640DD562526DFF79E754E7D56B2F8632
SHA-512:	F58FF75EEC7B40BDE32CA5DBFE9EFC4E74A9BE531DB414CEF46F41D06472BA01A649C40FB620F1C31B40E36EE82E81F621533947E1D473E49C79263B97B257F9
Malicious:	false
Preview:	.PNG........IHDR...............w&....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b\|.).....2..1..LP.D.. ...@lL.b.P..3....9....!...A...q......HQ\|...;@...u.....B.......<...@..... <...@...9@..S......G .d5(....z...`........#....IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-UAM44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	72326
Entropy (8bit):	5.368228822954085
Encrypted:	false
SSDEEP:	1536:zTN+GpiGWMNWnprcooA6p0yYiUTUybQ9TGA3eEEYSH+cYjnhjy6GeuqvEsD:zTXYGwcAo5lcyyguqvEsD
MD5:	A8A2A48DDAA95527C6D3DB763E2B7809
SHA1:	D5168C9A86579D1FC2C5C3F0706EBE3AC14DFE46
SHA-256:	1ADEB9B7455C164E01A88173D356742BE2A4B5DC4977F0F64FEE5B5D4B38E0B3
SHA-512:	EB77A9BC7D317D2413AC896E2C61D26198B07614971A953586963F5A66C4FA52CECD41B5B2531A1A4A56EB573243F58777F4CA6686B2C5352D19F2B3BE98B518
Malicious:	false
Preview:	/!.. jQuery JavaScript Library v1.4.2.. * http://jquery.com/.. .. Copyright 2010, John Resig.. * Dual licensed under the MIT or GPL Version 2 licenses... * http://jquery.org/license.. .. Includes Sizzle.js.. * http://sizzlejs.com/.. * Copyright 2010, The Dojo Foundation.. * Released under the MIT, BSD, and GPL Licenses... .. Date: Sat Feb 13 22:33:48 2010 -0500.. */..(function(A,w){function ma(){if(!c.isReady){try{s.documentElement.doScroll("left")}catch(a){setTimeout(ma,1);return}c.ready()}}function Qa(a,b){b.src?c.ajax({url:b.src,async:false,dataType:"script"}):c.globalEval(b.text\|\|b.textContent\|\|b.innerHTML\|\|"");b.parentNode&&b.parentNode.removeChild(b)}function X(a,b,d,f,e,j){var i=a.length;if(typeof b==="object"){for(var o in b)X(a,o,b[o],f,e,d);return a}if(d!==w){f=!j&&f&&c.isFunction(d);for(o=0;o<i;o++)e(a[o],b,f?d.call(a[o],o,e(a[o],b)):d,j);return a}return i?..e(a[0],b):w}function J(){return(new Date).getTime()}function Y(){return false}function Z(){return true}fun

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-V1CBT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 1 x 41, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	134
Entropy (8bit):	5.729085343472167
Encrypted:	false
SSDEEP:	3:yionv//thPlEWtn/E+9RthwkBDsTBZtNBxdRI80/3obNeK2rcXB1p:6v/lhP3y+jnDspNBn03q8wTp
MD5:	91125391486CE3DDBC1156EB12CFCBD1
SHA1:	F6D1D49976D6038D2BC3B0917251763227B83C95
SHA-256:	8496D0F16C7FD66AA06F02DC6281F6AB75BFF22A507B91A52B3B8AC52EE96AAF
SHA-512:	B62F1179797F11F5D07DDE744557DD01BD5914827ECFF6A3A9BBAEE2D04C827C57C78E5CF228CCE9F6C26C9F5783F2C78EA81BF315EE7E1C879811106B23D341
Malicious:	false
Preview:	.PNG........IHDR.......).....{......tEXtSoftware.Adobe ImageReadyq.e<...(IDATx.b...c...?.300.12...&.M.!..ht1(. ..4.L"z..+....IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\jquery-1.4.2.js (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	72326
Entropy (8bit):	5.368228822954085
Encrypted:	false
SSDEEP:	1536:zTN+GpiGWMNWnprcooA6p0yYiUTUybQ9TGA3eEEYSH+cYjnhjy6GeuqvEsD:zTXYGwcAo5lcyyguqvEsD
MD5:	A8A2A48DDAA95527C6D3DB763E2B7809
SHA1:	D5168C9A86579D1FC2C5C3F0706EBE3AC14DFE46
SHA-256:	1ADEB9B7455C164E01A88173D356742BE2A4B5DC4977F0F64FEE5B5D4B38E0B3
SHA-512:	EB77A9BC7D317D2413AC896E2C61D26198B07614971A953586963F5A66C4FA52CECD41B5B2531A1A4A56EB573243F58777F4CA6686B2C5352D19F2B3BE98B518
Malicious:	false
Preview:	/!.. jQuery JavaScript Library v1.4.2.. * http://jquery.com/.. .. Copyright 2010, John Resig.. * Dual licensed under the MIT or GPL Version 2 licenses... * http://jquery.org/license.. .. Includes Sizzle.js.. * http://sizzlejs.com/.. * Copyright 2010, The Dojo Foundation.. * Released under the MIT, BSD, and GPL Licenses... .. Date: Sat Feb 13 22:33:48 2010 -0500.. */..(function(A,w){function ma(){if(!c.isReady){try{s.documentElement.doScroll("left")}catch(a){setTimeout(ma,1);return}c.ready()}}function Qa(a,b){b.src?c.ajax({url:b.src,async:false,dataType:"script"}):c.globalEval(b.text\|\|b.textContent\|\|b.innerHTML\|\|"");b.parentNode&&b.parentNode.removeChild(b)}function X(a,b,d,f,e,j){var i=a.length;if(typeof b==="object"){for(var o in b)X(a,o,b[o],f,e,d);return a}if(d!==w){f=!j&&f&&c.isFunction(d);for(o=0;o<i;o++)e(a[o],b,f?d.call(a[o],o,e(a[o],b)):d,j);return a}return i?..e(a[0],b):w}function J(){return(new Date).getTime()}function Y(){return false}function Z(){return true}fun

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\li.gif (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	GIF image data, version 89a, 5 x 1
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9990210737063383
Encrypted:	false
SSDEEP:	3:Czl6bYMSQ/7/lLllnaCe:oobiYPe
MD5:	BF141F9FC3CD2EDDE4BBF5FE9A313F47
SHA1:	432CF4FE19265F24AABDB76343F8F12F090288E4
SHA-256:	FAE8732560690C1CAFDCC29B18D63A3896806ECDE9EFEAD86F068467B5AE973D
SHA-512:	BCB96942BEA7ADB470ACC72C5218F1F4BE601941A69A4A89C9C64690697DB1B1551A20476898CCC531ECA9EE49785739579E45D30B2500C9AD3A7D3CACC857A5
Malicious:	false
Preview:	GIF89a.......05819=29;...!.......,.............S.;

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\nav-_10.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 1 x 41, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	134
Entropy (8bit):	5.729085343472167
Encrypted:	false
SSDEEP:	3:yionv//thPlEWtn/E+9RthwkBDsTBZtNBxdRI80/3obNeK2rcXB1p:6v/lhP3y+jnDspNBn03q8wTp
MD5:	91125391486CE3DDBC1156EB12CFCBD1
SHA1:	F6D1D49976D6038D2BC3B0917251763227B83C95
SHA-256:	8496D0F16C7FD66AA06F02DC6281F6AB75BFF22A507B91A52B3B8AC52EE96AAF
SHA-512:	B62F1179797F11F5D07DDE744557DD01BD5914827ECFF6A3A9BBAEE2D04C827C57C78E5CF228CCE9F6C26C9F5783F2C78EA81BF315EE7E1C879811106B23D341
Malicious:	false
Preview:	.PNG........IHDR.......).....{......tEXtSoftware.Adobe ImageReadyq.e<...(IDATx.b...c...?.300.12...&.M.!..ht1(. ..4.L"z..+....IEND.B`.

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\style.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	troff or preprocessor input, ASCII text, with very long lines (387), with CRLF line terminators
Category:	dropped
Size (bytes):	3182
Entropy (8bit):	5.220759501145059
Encrypted:	false
SSDEEP:	48:zyF8jZooaerM+GHWH5j6Mn1+wP9yhEI7Wz0eO:+wjlrmWZj6MowPUhERz0N
MD5:	BEDBCED040A411F959953A2D2D4D1B25
SHA1:	434958541B3A98C9ABAB187262B0EF5DEE66C8AA
SHA-256:	40FAC6B92DED90B1F8D35433C4B2503BF9ECA05E15816B3AA03A5497695BF6DF
SHA-512:	DEE03676EF738E6F17981C8AA3A6F961B22EE1BD5D30E46C4E2DE0EEDE945DACBA3C944F93C9C934322DFCC5884E3ADDD71C089805742FBD5C11BA196543D9BB
Malicious:	false
Preview:	@charset "utf-8";../* CSS Document /..body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td {margin:0;padding:0;}..table {border-collapse:collapse;border-spacing:0;}..img {border:0;vertical-align:middle;}..address,caption,cite,code,dfn,th,var {font-style:normal;font-weight:normal;}..ol,ul {list-style:none;}..caption,th {text-align:left;}..h1,h2,h3,h4,h5,h6 {font-size:100%;font-weight:normal;}..a{ text-decoration:none;color:#464646;}..a:hover{text-decoration:underline;}...downBtn{ display:block; background:url(btn.png) no-repeat; width:135px; height:30px; margin-right:10px;}...downBtn:hover{ background-position:0 -30px;}...buyBtn{ display:block; width:95px; height:30px; background:url(btn.png) no-repeat 0 -60px; margin-right:10px;}...buyBtn:hover{ background-position:0 -90px;}../==============basic================*/...fl {float:left;}...fr {float:right;}...clr{ clear:both; }...ml20{ margin-left:20px !important;}...mt23{ margin-top:23px !impo

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\windows.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	HTML document, ASCII text, with very long lines (420), with CRLF line terminators
Category:	dropped
Size (bytes):	18197
Entropy (8bit):	5.093622606898989
Encrypted:	false
SSDEEP:	384:SIMdWoYHGAf6mBST6/ueHdMcpEOXHqNDfaC12KYD64RXRNWZ9FDmumc:SVMoYHGAf6mBST6/uemMEOXHqNDfaw2C
MD5:	7738DD9E28BC3A7FDE75840FB8BA830E
SHA1:	74D297F724809679DF141006917C02AE1CF98D8B
SHA-256:	4DBF25243BB4F96BC44CEE4B476B47BA3FE2D1A251AB15813C580EE4B5C8FF19
SHA-512:	A66BFE8842F96A51100BB98C1AFD7200096A41F914B75296EB3C3FE5B6AC15CEA7CDBA0D2A0DB7D1346D3869621868CC32AA6E668A39B901978B15D4CF0BD285
Malicious:	false
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />..<title>Wondershare Suite for Windows</title>..<link href="style/style.css" rel="stylesheet" type="text/css" />..</head>..<body>..<div class="main">...<div class="mainNav">.. .<ul>.. <li class="curr">Video&DVD</li>.. .<li>Photo</li> .. <li>PDF</li>.. <li>Utilities</li>.. <li>Mobile</li>.. </ul>.. </div>.. ..<div class="content">..<div class="pro-img">.. <a href="http://www.wondershare.com/pro/video-converter-ultimate.html?utm_source=suite-windows&utm_medium=pro&utm_campaign=pro" target="_blank"><img src="images/video-converter-ultimate-bg.png" width="145" /></a>.. <div class="price">$69.95</div>.. </div>.. <div class="pro-info">..

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\SSL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1022976
Entropy (8bit):	6.689063197737343
Encrypted:	false
SSDEEP:	24576:83sW3IA0tY+uLkPW71nW7lqEPal9g6G0TxkaDbauvULHNDLpDL:YsW3I3Y+mkPkn9E5X0xbapLtDLpDL
MD5:	107D82480CC7C1DF5424E3C48637693A
SHA1:	B626BB98FE888A243FBB768392ABA5062FFAA043
SHA-256:	0B987BA1E09E1675E211F876D382F5AADF0AD4FE39082444B98F030C841897B4
SHA-512:	B2B304B3C5EB0C157B89E7D85B15FE4A520D905725B240238A5BED59D9C90003821E51836DF45A3AC457859F26226E354F4B89BB32DC34774058E99C1BBA1BA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....pwF..........."...8.........4................tm......................... .......N........ ................................................................. $...................................................................................text...d...........................`..`.data...0...........................@....rdata..p...........................@..@.bss.....2...............................edata...............f..............@....idata...............h..............@....reloc.. $.......&...v..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\CommonCtrl.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 391 x 452, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	31901
Entropy (8bit):	7.959900830354397
Encrypted:	false
SSDEEP:	768:L35l6jbl9W1N+s89C9E3pDlTCrs05kdFgJFVdJczOg1ge:n6KUs89v5pv05kdYczr1ge
MD5:	D641AECFF4F41FA1FE8CFA3EA459C5F3
SHA1:	9868CB5799A2F3328EB27B49DAACC3FEB38B2420
SHA-256:	0988A969FE4CA1CC39F595789DF9C91A021C4908EACF2DB9EF31456CD26162A3
SHA-512:	B6B68F542ADDD13164857EA70C969D2AD743CB0E24F9961F9BB00FDC50290FAE96F0FB75E2FEF8EC52A808C2468C284129228A35BC2B4F083F8DFA4204CF3168
Malicious:	false
Preview:	.PNG........IHDR....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\CommonFrm.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 114 x 61, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3493
Entropy (8bit):	7.885862422080639
Encrypted:	false
SSDEEP:	96:/SDZ/I09Da01l+gmkyTt6Hk8nT14+DW6qh9:/SDS0tKg9E05T142DqX
MD5:	3FB8490ECF45957613EEC794E35FED90
SHA1:	11B150B5FFE37D433031225A150A5E178682ED95
SHA-256:	7AA791D4F7DD3E53AF76F2710F173E6AE8756A4BE7C58AB9BABE8F41B9DAB7FF
SHA-512:	416859FBA7910EA6A064524864443455F3F740F1AA2EBD1DFE1550ABF96D3A09FED710AD85CCA97E44DD5487038E0BCDC46A462301B1F37217DD1D99C17CF9FC
Malicious:	false
Preview:	.PNG........IHDR...r...=.....q.=.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\Controls.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	4.650938562338853
Encrypted:	false
SSDEEP:	192:M8H2b9YO0zNfNP+++TlllvnQJ2zRFigZX05Z7:M8H2RfO
MD5:	2CCD73AD418BC151D2CB71199C6B9810
SHA1:	2C1A2E7279EFDAE213830BDCB592663B68C225E2
SHA-256:	2F6A09A26FCF3C420688E3A26C53B88B90554B6A5A08776D5BF341D17526949C
SHA-512:	B8895BC4B2AD080C034F68584A910F41CD57BD9AED38254E2E10182FEE81BADF4AC5B7DABF7996F06878C5FF3F83BD2CC746406A6CBED466FB496D33981E677C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="Button">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="CommonCtrl.png" />.. <State Left="0" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. <State Left="18" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. <State Left="36" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. <State Left="54" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. <State Left="0" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. </Part>.. </Item>.. <Item Name="CheckBox">.. <Part id="0" Name="Checked" TransparentMode="Alpha">.. <Graphic Name="CommonCtrl.png" /

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\MenuButtons.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 290 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7721
Entropy (8bit):	7.961191289212695
Encrypted:	false
SSDEEP:	192:ZSDS0tKg9E05TaeOJyEvUr6ah7vSUj1WSDu5LCIXX:AJXE05+rJnsXhF4SDgLpX
MD5:	2317945E9F27309A011B1A4F5DC5B56A
SHA1:	8F251D40C83F9EC8F7AC24D92112F0B958EB6D45
SHA-256:	4CEBF152C29A1583E5FD2F5B207CEBC6B892041DB13E8329B6FACC2071FB4243
SHA-512:	A696CE096AD502D6CF6C1EF18F07252A3EFE77484DF00EF87E592E3DBFCB003B86C2F995CAF20274CA7B48BA85F863445C6B598E5E1209DC7E2A3968B1656DE6
Malicious:	false
Preview:	.PNG........IHDR..."...%............pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\TipFrm.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 443 x 567, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	67383
Entropy (8bit):	7.978164087183292
Encrypted:	false
SSDEEP:	1536:j2aNpxUuoJ9hqIFi13Y0LjTtrC/mYgyiriSRbFgtDn:jfXUuoJWV3Y0ztrC/ZWriSNy9
MD5:	BA5B9BAD41895362EDE08412E67FF671
SHA1:	68506624BE135EF0A1BCD07B755A9703C8F6C0A1
SHA-256:	B41B37188EB7CD4F43B07317BFE533F45082E7E82C24EEFA9AD0F5B347DE01C8
SHA-512:	66B1A66C49F47FDDBC77822D580BE9F9C849D4E6A5B31CDDB0733CFDDA8E1A741A53238528178F5F279C651881759E07923F5A5E99BB8B3969094F5D3301B1D6
Malicious:	false
Preview:	.PNG........IHDR.......7........ ....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\TipFrm.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2839
Entropy (8bit):	4.725168351031624
Encrypted:	false
SSDEEP:	48:3oNnggK1K4UoixPxdWTTwRHllCwLLLolCkULLLllCwLLL3lC4W:onjK1K4zHwRFm+FU
MD5:	4A65425E52CCB800479F50424C368DA1
SHA1:	8ADC6FD5077624CD38558ECC8194799680875B54
SHA-256:	C703EA1A52F1833D2498076460EA2A920713B8AF2AAAF8DBA8E1D07A7435D23F
SHA-512:	2229D2EB046B8F7830B593A20F0FF59DE011DE9A2F8A8C818A857FAAC82B4748CA2B894F3A3BBE5E5151A5242B590A0FFCFC8729681CF4B9CD9A62E39FC3B552
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="TipForm">.. <Part id="0" Name="Form" TransparentMode="Alpha">.. <Graphic Name="TipFrm.png" />.. <Shape type="Auto" />.. <Margins Scale="False" Left="1" Top="26" Right="1" Bottom="1" />.. <State Left="0" Top="0" Width="51" Height="60">.. <Margins Left="7" Top="27" Right="7" Bottom="7" />.. <Font Color="clMenuHighlight" />.. </State>.. <State Left="51" Top="0" Width="51" Height="60">.. <Margins Left="7" Top="27" Right="7" Bottom="7" />.. <Font Color="clMenuHighlight" />.. </State>.. </Part>.. <Part id="1" Name="Caption">.. <Position RelPos="5" Scale="False" X="8" Y="3" Height="16" />.. <Font Color="$00693100" />.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="$00693100" Style="bold" />.. </State>.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="$00693100" Style="bold"

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-1P2R3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 443 x 567, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	67383
Entropy (8bit):	7.978164087183292
Encrypted:	false
SSDEEP:	1536:j2aNpxUuoJ9hqIFi13Y0LjTtrC/mYgyiriSRbFgtDn:jfXUuoJWV3Y0ztrC/ZWriSNy9
MD5:	BA5B9BAD41895362EDE08412E67FF671
SHA1:	68506624BE135EF0A1BCD07B755A9703C8F6C0A1
SHA-256:	B41B37188EB7CD4F43B07317BFE533F45082E7E82C24EEFA9AD0F5B347DE01C8
SHA-512:	66B1A66C49F47FDDBC77822D580BE9F9C849D4E6A5B31CDDB0733CFDDA8E1A741A53238528178F5F279C651881759E07923F5A5E99BB8B3969094F5D3301B1D6
Malicious:	false
Preview:	.PNG........IHDR.......7........ ....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-5F9QV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 114 x 61, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3493
Entropy (8bit):	7.885862422080639
Encrypted:	false
SSDEEP:	96:/SDZ/I09Da01l+gmkyTt6Hk8nT14+DW6qh9:/SDS0tKg9E05T142DqX
MD5:	3FB8490ECF45957613EEC794E35FED90
SHA1:	11B150B5FFE37D433031225A150A5E178682ED95
SHA-256:	7AA791D4F7DD3E53AF76F2710F173E6AE8756A4BE7C58AB9BABE8F41B9DAB7FF
SHA-512:	416859FBA7910EA6A064524864443455F3F740F1AA2EBD1DFE1550ABF96D3A09FED710AD85CCA97E44DD5487038E0BCDC46A462301B1F37217DD1D99C17CF9FC
Malicious:	false
Preview:	.PNG........IHDR...r...=.....q.=.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-EMBUJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20112
Entropy (8bit):	4.650938562338853
Encrypted:	false
SSDEEP:	192:M8H2b9YO0zNfNP+++TlllvnQJ2zRFigZX05Z7:M8H2RfO
MD5:	2CCD73AD418BC151D2CB71199C6B9810
SHA1:	2C1A2E7279EFDAE213830BDCB592663B68C225E2
SHA-256:	2F6A09A26FCF3C420688E3A26C53B88B90554B6A5A08776D5BF341D17526949C
SHA-512:	B8895BC4B2AD080C034F68584A910F41CD57BD9AED38254E2E10182FEE81BADF4AC5B7DABF7996F06878C5FF3F83BD2CC746406A6CBED466FB496D33981E677C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="Button">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="CommonCtrl.png" />.. <State Left="0" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. <State Left="18" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. <State Left="36" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. <State Left="54" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. <State Left="0" Top="307" Width="18" Height="24">.. <Margins Left="4" Top="4" Right="3" Bottom="4" />.. </State>.. </Part>.. </Item>.. <Item Name="CheckBox">.. <Part id="0" Name="Checked" TransparentMode="Alpha">.. <Graphic Name="CommonCtrl.png" /

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-PGTNV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 290 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7721
Entropy (8bit):	7.961191289212695
Encrypted:	false
SSDEEP:	192:ZSDS0tKg9E05TaeOJyEvUr6ah7vSUj1WSDu5LCIXX:AJXE05+rJnsXhF4SDgLpX
MD5:	2317945E9F27309A011B1A4F5DC5B56A
SHA1:	8F251D40C83F9EC8F7AC24D92112F0B958EB6D45
SHA-256:	4CEBF152C29A1583E5FD2F5B207CEBC6B892041DB13E8329B6FACC2071FB4243
SHA-512:	A696CE096AD502D6CF6C1EF18F07252A3EFE77484DF00EF87E592E3DBFCB003B86C2F995CAF20274CA7B48BA85F863445C6B598E5E1209DC7E2A3968B1656DE6
Malicious:	false
Preview:	.PNG........IHDR..."...%............pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-PV0VS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2839
Entropy (8bit):	4.725168351031624
Encrypted:	false
SSDEEP:	48:3oNnggK1K4UoixPxdWTTwRHllCwLLLolCkULLLllCwLLL3lC4W:onjK1K4zHwRFm+FU
MD5:	4A65425E52CCB800479F50424C368DA1
SHA1:	8ADC6FD5077624CD38558ECC8194799680875B54
SHA-256:	C703EA1A52F1833D2498076460EA2A920713B8AF2AAAF8DBA8E1D07A7435D23F
SHA-512:	2229D2EB046B8F7830B593A20F0FF59DE011DE9A2F8A8C818A857FAAC82B4748CA2B894F3A3BBE5E5151A5242B590A0FFCFC8729681CF4B9CD9A62E39FC3B552
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="TipForm">.. <Part id="0" Name="Form" TransparentMode="Alpha">.. <Graphic Name="TipFrm.png" />.. <Shape type="Auto" />.. <Margins Scale="False" Left="1" Top="26" Right="1" Bottom="1" />.. <State Left="0" Top="0" Width="51" Height="60">.. <Margins Left="7" Top="27" Right="7" Bottom="7" />.. <Font Color="clMenuHighlight" />.. </State>.. <State Left="51" Top="0" Width="51" Height="60">.. <Margins Left="7" Top="27" Right="7" Bottom="7" />.. <Font Color="clMenuHighlight" />.. </State>.. </Part>.. <Part id="1" Name="Caption">.. <Position RelPos="5" Scale="False" X="8" Y="3" Height="16" />.. <Font Color="$00693100" />.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="$00693100" Style="bold" />.. </State>.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="$00693100" Style="bold"

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-V683G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PNG image data, 391 x 452, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	31901
Entropy (8bit):	7.959900830354397
Encrypted:	false
SSDEEP:	768:L35l6jbl9W1N+s89C9E3pDlTCrs05kdFgJFVdJczOg1ge:n6KUs89v5pv05kdYczr1ge
MD5:	D641AECFF4F41FA1FE8CFA3EA459C5F3
SHA1:	9868CB5799A2F3328EB27B49DAACC3FEB38B2420
SHA-256:	0988A969FE4CA1CC39F595789DF9C91A021C4908EACF2DB9EF31456CD26162A3
SHA-512:	B6B68F542ADDD13164857EA70C969D2AD743CB0E24F9961F9BB00FDC50290FAE96F0FB75E2FEF8EC52A808C2468C284129228A35BC2B4F083F8DFA4204CF3168
Malicious:	false
Preview:	.PNG........IHDR....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\TempkillProcess.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49664
Entropy (8bit):	6.0609486495517775
Encrypted:	false
SSDEEP:	768:b6p045/ija+1IhJVlwal5An6gfTDmyTX9i3UElSV2Zu+I3NKL4zG8x:b6G+J46gfeyw3rZzax
MD5:	2D8EF1F86C38696ABEF55D64942A2C4A
SHA1:	F6710BDDA76A1CDB2669F49796F6C3161A895973
SHA-256:	E6BE04C390CEE6B4955C8AF0C78221FDEA3907CA5D0FB5F4F256FE7B05E8A332
SHA-512:	F668C37D9F722CE8217B87FE6CF2183ECC16451A1402A9D8D143CEAC914E7B0056CF8D6ACA8F81889CB954C85F12AF304EFE6D5D9121D4287E47AEC2B6732DA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~...@......4.............@..........................@..........................................R............ ...............................................................................................................text....{.......\|.................. ..`.itext..L........................... ..`.data...............................@....bss....h2...............................idata..............................@....edata..R...........................@..@.reloc..............................@..B.rsrc........ ......................@..@.............@......................@..@........................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2133216
Entropy (8bit):	6.600212001108249
Encrypted:	false
SSDEEP:	24576:4CtqIkZmZI+NFCwGYt7hGxhZxGv/Ai3DRqz1ZALpqfWmA6Nt7CaG0lCfXCwyMlna:XrZjGYoM3qc3P3gRQTXT6Fdsbs7k+
MD5:	DB67E9196605D61D8278E5278777C71F
SHA1:	6FE39B3ACE96505269745ED2B81975ABB5AEA647
SHA-256:	9B5F85FB164D177A24A521DF6A9515F1DFB502D1B83581D37DAE8AC3F1AD9010
SHA-512:	D2A77D6C1C7771E714F5A19DB82823A8A4DD0F0402ACA0751D17E7B4D66219049AA33EAB3F3841DE251F7393F0D01E3C7664EF0AA17F5593BA0F569D2BFE7022
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R*.X.....................D......h$.......0....@.......................... !......A!..........@..............................&J.......J...........X ..4... ..D....................................................................................text............................... ..`.itext.............................. ..`.data........0......................@....bss.... d...@...........................idata..&J.......L..................@....tls....D............d...................rdata...............d..............@..@.reloc..D.... .......f..............@..B.rsrc....J.......J..................@..@............. !......X .............@..@................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Generic INItialization configuration [Settings]
Category:	modified
Size (bytes):	4746
Entropy (8bit):	4.6987290965548905
Encrypted:	false
SSDEEP:	96:Yo4L1y2RyVn5T1SEp2QttpA7JbOSiP89N0nn7WnHUGXlUGG8jn+vrC:YHyNbJTp3toVbJ9NMn7uHUGXlUGRL6+
MD5:	1C788692DDAF2A71FB9F63586C975E73
SHA1:	760466CAB4E227554D41623D9AA8D1F34C437A26
SHA-256:	94F4BD2BCADA78A669E71848A3910F3875B88F9757F3DD7AF20D7FD2E882E746
SHA-512:	D4B914C96D06BD9FB686B895B2D76ED1AEAB68BB3C29CB925813C6D3AF921D8BC56400CD20FE56C895F5625F0EEDFE457E5BEBE003E0245C42BF77867465CBA8
Malicious:	false
Preview:	[Product]..ProductName=Custom Server Platform Compact..DefLanguage=ENU..[Settings]..IsOpenHelperTag=1..IsShowTipTag=1..ShowTipsTypeTag=0..IsOnDesktopTag=0..IsMinimizeTag=1..IsImproveTag=1..BeginShowTips=60..ShowTipSInterval=60..UpdateTipsFormServer=3600..HttpGetTimeOut=120..ReDownloadBoundAndShowTip=86400....[Server]..PID=1025..HostAddress=114140585B111A4F0F5B431958400F571750144503525A095B07480143505304515A59484709454E4D02..InitDataPostURLTag=0C5C5D45460C075212465E04455D124A0A4D09581E4F4714461A551C5E4D4E195C4744550D440E024F1F491B5A174510405F40471F..InitDataErrorTag=Pages\error.html..TipsListURLTag=0F5F5E46450F045111455D07465E1149094E0A5B1D4C44174519561F5D4E4D1A5F4447560E470D014C1C4A1859144613440A59115C5D4F1C..UploadErrorURL=3D6D6C74773D366323776F35746C237B3B7C38692F7E7625772B642D6F7C7F286D7675643C753F337E2E782A6B26742174723B623E3C7F7720793F2B6D2C253A6D6B226B6A2E..UserDataURL=316160787B313A6F2F7B633978602F773770346523727A297B27682163707324617A79683079333F72227426672A782D787E376E3230737B

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHints.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14060
Entropy (8bit):	4.1718772678095695
Encrypted:	false
SSDEEP:	192:qRdV9jTIn9iJO8P+aaYEAhHnRhK024CuoRDqxiUz8TuTIDkaWMbqVdG6I:qrpA2HRsuCfUzID5qVg
MD5:	A1011938E30C32A9A62170E068732273
SHA1:	A0D4AF36E45AC5F3298E821DA8A16AC6D510A983
SHA-256:	355253435399FAFF914169207EF0426AFE24E80204534D72FEF6430165C70395
SHA-512:	131583325F357AA93CB60BD309C761A61294C862416DA8F785557D542B59E517366B8339A3AA3D12E6367D3FBD9752D7F6B29D2F77DD7C505C4C43EED8033A67
Malicious:	false
Preview:	..[.z.h.-.c.n.].....M.e.m.b.e.r. .Z.o.n.e.=.(u7b-N._....C.o.n.n.e.c.t.t.i.o.n. .t.i.m.e.o.u.t.=...c...e..........I.n.v.a.l.i.d. .e.m.a.i.l.=..`.v...{.b...[.x.........e{vU_.0....W.e.l.c.o.m.e. .b.a.c.k.=.m`.U.`{vF..b.R......A.c.t.i.v.a.t.e.d.=.m`.U...`S_MRo..N.].~.o;m:Nck._.r.`...`.S.N.O(uo..N.v@b.g.R...0....T.r.i.a.l.=..`S_MRo..N:N.(uHr...S...Y.O(u.N.T..R.R..../f&T.zsSGS.~......E.x.p.i.r.e.d.=..`.v..US.]..g...~9.KN.TMb...~.~.O(uF.u.l.l. .V.e.r.s.i.o.n.......R.e.f.u.n.d.=..`.v..US.].~..>k......e-.pNKN.T.Q.l.Q.0....E.x.c.e.e.d.=..`.vW.o.n.d.e.r.s.h.a.r.e. .I.D..].~..(u.N.Y.S:ghV.N.o;m.No..N.....S.e.f9e.[.x..v^nx.O&..S.[hQ.0&T.R(W...Q.g..O(uP.6RKN.T...`.v&..S.\.O...R.l...0....B.a.n.n.e.d.=..`.v...{.].~...ReQ..TUS...e.lck8^.o;mo..N.0.Y.g.u.....T..\|.b.N.0....[.z.h.-.h.k.].....M.e.m.b.e.r. .Z.o.n.e.=..g.T-N._....C.o.n.n.e.c.t.t.i.o.n. .t.i.m.e.o.u.t.=.#..c..Bf....f.....I.n.v.a.l.i.d. .e.m.a.i.l.=..`.v...{.b...[.x/........e{v...0....W.e.l.c.o.m.e. .b.a.c.k.=.m`.U.`{vx..b.R..

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-235DL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	723294
Entropy (8bit):	6.4919971377533034
Encrypted:	false
SSDEEP:	12288:1QtLeYXPEv4arPEn37TzH7A6p3xxu9yz/eERMY1VLJrNufs9RZM2wHOQyD362kS5:WtCUA4arPEn37TzH7A6nw9yzeESUFgHK
MD5:	A4A1B98720FA70874D30DE97F079F516
SHA1:	552E09860B9FBF43CEA58E8E54C23B9C6AF7A326
SHA-256:	6AE8EA4912A59413C78768592BC379D20483BC77A511A75C3CF11CC67B5886BB
SHA-512:	644C427F2E58EE406118C604CA314E41AC3FF655B6FF577419E34036136A1DF55D6231167E5D1D5B38B7D0D150582C3A4AECEFAC05489805D55D81C09E3B3DB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................b...........n............@..............................................@...............................%.......@..........................................................................................................CODE.....`.......b.................. ..`DATA.................f..............@...BSS..................x...................idata...%.......&...x..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc....@.......@..................@..P.....................j..............@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-4J6FD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2133216
Entropy (8bit):	6.600212001108249
Encrypted:	false
SSDEEP:	24576:4CtqIkZmZI+NFCwGYt7hGxhZxGv/Ai3DRqz1ZALpqfWmA6Nt7CaG0lCfXCwyMlna:XrZjGYoM3qc3P3gRQTXT6Fdsbs7k+
MD5:	DB67E9196605D61D8278E5278777C71F
SHA1:	6FE39B3ACE96505269745ED2B81975ABB5AEA647
SHA-256:	9B5F85FB164D177A24A521DF6A9515F1DFB502D1B83581D37DAE8AC3F1AD9010
SHA-512:	D2A77D6C1C7771E714F5A19DB82823A8A4DD0F0402ACA0751D17E7B4D66219049AA33EAB3F3841DE251F7393F0D01E3C7664EF0AA17F5593BA0F569D2BFE7022
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-4J6FD.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...R*.X.....................D......h$.......0....@.......................... !......A!..........@..............................&J.......J...........X ..4... ..D....................................................................................text............................... ..`.itext.............................. ..`.data........0......................@....bss.... d...@...........................idata..&J.......L..................@....tls....D............d...................rdata...............d..............@..@.reloc..D.... .......f..............@..B.rsrc....J.......J..................@..@............. !......X .............@..@................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-545DF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49664
Entropy (8bit):	6.0609486495517775
Encrypted:	false
SSDEEP:	768:b6p045/ija+1IhJVlwal5An6gfTDmyTX9i3UElSV2Zu+I3NKL4zG8x:b6G+J46gfeyw3rZzax
MD5:	2D8EF1F86C38696ABEF55D64942A2C4A
SHA1:	F6710BDDA76A1CDB2669F49796F6C3161A895973
SHA-256:	E6BE04C390CEE6B4955C8AF0C78221FDEA3907CA5D0FB5F4F256FE7B05E8A332
SHA-512:	F668C37D9F722CE8217B87FE6CF2183ECC16451A1402A9D8D143CEAC914E7B0056CF8D6ACA8F81889CB954C85F12AF304EFE6D5D9121D4287E47AEC2B6732DA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~...@......4.............@..........................@..........................................R............ ...............................................................................................................text....{.......\|.................. ..`.itext..L........................... ..`.data...............................@....bss....h2...............................idata..............................@....edata..R...........................@..@.reloc..............................@..B.rsrc........ ......................@..@.............@......................@..@........................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-5QCJ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137728
Entropy (8bit):	6.519276632911069
Encrypted:	false
SSDEEP:	3072:oyuMDW7FLRn4ctpQzp9wgqiCqxkGkcCmFhhOZIA:oyuMDiFLhlbQwgSykdc7hYI
MD5:	30EBDC01D3AB9FB3772445CB4A9EBBBA
SHA1:	F0EEE5C8A4F416673EE5A0698075C124AEFC5D14
SHA-256:	0EA512EAC7298ED72E8D47DA4DB8D73557599CD2411F69657CC374CD0704E8E8
SHA-512:	4BE686006D169DCD1F18DD85B0CBF0C13E1E6CFE6EC60F9CEA32BA1AFAE811C0DD232DE2D569DE164A7C5A1108960551B04C28600F8959A51FC0BDED78CA3FA9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.!E'.rE'.rE'.rQ\|rQ'.rQIrj'.rQHr+'.rL_qr@'.rE'.r.'.rQMr@'.rQyrD'.rQ.rD'.rRichE'.r................PE..L...Z..Q...........!................~........................................p............@......................... ...].......<....@.......................P..(................................... ...@...............8............................text...S........................... ..`.rdata..}Q.......R..................@..@.data....7..........................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-AE5UE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1022976
Entropy (8bit):	6.689063197737343
Encrypted:	false
SSDEEP:	24576:83sW3IA0tY+uLkPW71nW7lqEPal9g6G0TxkaDbauvULHNDLpDL:YsW3I3Y+mkPkn9E5X0xbapLtDLpDL
MD5:	107D82480CC7C1DF5424E3C48637693A
SHA1:	B626BB98FE888A243FBB768392ABA5062FFAA043
SHA-256:	0B987BA1E09E1675E211F876D382F5AADF0AD4FE39082444B98F030C841897B4
SHA-512:	B2B304B3C5EB0C157B89E7D85B15FE4A520D905725B240238A5BED59D9C90003821E51836DF45A3AC457859F26226E354F4B89BB32DC34774058E99C1BBA1BA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....pwF..........."...8.........4................tm......................... .......N........ ................................................................. $...................................................................................text...d...........................`..`.data...0...........................@....rdata..p...........................@..@.bss.....2...............................edata...............f..............@....idata...............h..............@....reloc.. $.......&...v..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-EQ8E1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Generic INItialization configuration [Settings]
Category:	dropped
Size (bytes):	4660
Entropy (8bit):	4.667892794410234
Encrypted:	false
SSDEEP:	96:Yo4Z1y2RyVn5T1SEp2QttpA7JbOSiP89N0nn7WnHUGXlUGG8jn+vX:YpyNbJTp3toVbJ9NMn7uHUGXlUGRL6X
MD5:	C3D37313BF465F6145BB6F9BD845622E
SHA1:	1A27DA4300E997E07DA73F2916483862F9FE1FA4
SHA-256:	1B74775C8D88A46C6F1727029A4ACBDA6DD9CD1BF5298A3746CE104E0DA8F8B6
SHA-512:	4E92EC23D618E8EF2559BE1C5D2CB243E2EB074AAD86FFB338E3584806953EFDD22856847A35BDFEE1AA77756DC2B34F526777BD6FEDAF5E4B982391D31AD2D6
Malicious:	false
Preview:	[Product]..ProductName=Custom Server Platform Compact..DefLanguage=ENU..[Settings]..IsOpenHelperTag=1..IsShowTipTag=1..ShowTipsTypeTag=0..IsOnDesktopTag=0..IsMinimizeTag=1..IsImproveTag=1..BeginShowTips=60..ShowTipSInterval=60..UpdateTipsFormServer=3600..HttpGetTimeOut=120....[Server]..PID=1025..HostAddress=114140585B111A4F0F5B431958400F571750144503525A095B07480143505304515A59484709454E4D02..InitDataPostURLTag=0C5C5D45460C075212465E04455D124A0A4D09581E4F4714461A551C5E4D4E195C4744550D440E024F1F491B5A174510405F40471F..InitDataErrorTag=Pages\error.html..TipsListURLTag=0F5F5E46450F045111455D07465E1149094E0A5B1D4C44174519561F5D4E4D1A5F4447560E470D014C1C4A1859144613440A59115C5D4F1C..UploadErrorURL=3D6D6C74773D366323776F35746C237B3B7C38692F7E7625772B642D6F7C7F286D7675643C753F337E2E782A6B26742174723B623E3C7F7720793F2B6D2C253A6D6B226B6A2E..UserDataURL=316160787B313A6F2F7B633978602F773770346523727A297B27682163707324617A79683079333F72227426672A782D787E376E3230737B2C7F33276120293661792E7C347433706

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-JROQ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14060
Entropy (8bit):	4.1718772678095695
Encrypted:	false
SSDEEP:	192:qRdV9jTIn9iJO8P+aaYEAhHnRhK024CuoRDqxiUz8TuTIDkaWMbqVdG6I:qrpA2HRsuCfUzID5qVg
MD5:	A1011938E30C32A9A62170E068732273
SHA1:	A0D4AF36E45AC5F3298E821DA8A16AC6D510A983
SHA-256:	355253435399FAFF914169207EF0426AFE24E80204534D72FEF6430165C70395
SHA-512:	131583325F357AA93CB60BD309C761A61294C862416DA8F785557D542B59E517366B8339A3AA3D12E6367D3FBD9752D7F6B29D2F77DD7C505C4C43EED8033A67
Malicious:	false
Preview:	..[.z.h.-.c.n.].....M.e.m.b.e.r. .Z.o.n.e.=.(u7b-N._....C.o.n.n.e.c.t.t.i.o.n. .t.i.m.e.o.u.t.=...c...e..........I.n.v.a.l.i.d. .e.m.a.i.l.=..`.v...{.b...[.x.........e{vU_.0....W.e.l.c.o.m.e. .b.a.c.k.=.m`.U.`{vF..b.R......A.c.t.i.v.a.t.e.d.=.m`.U...`S_MRo..N.].~.o;m:Nck._.r.`...`.S.N.O(uo..N.v@b.g.R...0....T.r.i.a.l.=..`S_MRo..N:N.(uHr...S...Y.O(u.N.T..R.R..../f&T.zsSGS.~......E.x.p.i.r.e.d.=..`.v..US.]..g...~9.KN.TMb...~.~.O(uF.u.l.l. .V.e.r.s.i.o.n.......R.e.f.u.n.d.=..`.v..US.].~..>k......e-.pNKN.T.Q.l.Q.0....E.x.c.e.e.d.=..`.vW.o.n.d.e.r.s.h.a.r.e. .I.D..].~..(u.N.Y.S:ghV.N.o;m.No..N.....S.e.f9e.[.x..v^nx.O&..S.[hQ.0&T.R(W...Q.g..O(uP.6RKN.T...`.v&..S.\.O...R.l...0....B.a.n.n.e.d.=..`.v...{.].~...ReQ..TUS...e.lck8^.o;mo..N.0.Y.g.u.....T..\|.b.N.0....[.z.h.-.h.k.].....M.e.m.b.e.r. .Z.o.n.e.=..g.T-N._....C.o.n.n.e.c.t.t.i.o.n. .t.i.m.e.o.u.t.=.#..c..Bf....f.....I.n.v.a.l.i.d. .e.m.a.i.l.=..`.v...{.b...[.x/........e{v...0....W.e.l.c.o.m.e. .b.a.c.k.=.m`.U.`{vx..b.R..

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-M9KTS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1506304
Entropy (8bit):	6.548348952325719
Encrypted:	false
SSDEEP:	24576:ffMWltiJhYpFd0xsgDUZXW/Xt33nETMiZGwQvABbgYBO3wTgoyTG0Q0dp:TtiJhASK5Z4XWTMiAzEgYBOATgoyTG0t
MD5:	B16AD0DD6C69C0C117C9D3647517786C
SHA1:	825A54040C8E8DFE9FFB243796DF806EE5B05708
SHA-256:	E8EACE4E643BA86E5C4D1B966037A47E53836B5D328F2295713184613A72020F
SHA-512:	23512007A593D62C446923C446B07D64476CECF9F7EA22DBDBE48965DAA482517C7F3F50A55B7B6ED3989BE3DF2F96004CAFE3BB2204BCDE401AAE00FFD44632
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$.[.E...E...E.......E..;....E...=...E...=..!E...E.."E...=...E...=...E...=...E...=...E.......E...=...E..Rich.E..................PE..L....).X...........!.....>...........r.......P...............................`............@.........................p...L............P.......................`..L... S...............................7..@............P..d............................text...\=.......>.................. ..`.rdata...g...P...h...B..............@..@.data...(........R..................@....rsrc........P......................@..@.reloc..v....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-O47MQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	6.012459225737119
Encrypted:	false
SSDEEP:	768:lQ8ZQKneCKmzF5Ltgl6nPhbyDGnTEDtP6FPBvU+Kw:i6e+ln5Ossy0+Kw
MD5:	4EF13E267EBBF804DD4157B447AA7059
SHA1:	B9507C5B02BBAE456AE5DE7132EBAFD27206B944
SHA-256:	2476D897A6D20653578FCB98737C85CCD96A42E57F67843FFBC431C0D05909A7
SHA-512:	81DF3F309B6A734FAE2E824A4535D9A7251D94885593C7C37EE70853F7C721062023D0D22BA1C92845C6FD14356048478B83C132AA9CEC9360690A65B74BF360
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@..'...t...t...t..5t...tk..t...tk.3t...tk..t8..t..>t...t...tH..tk..t...tk.6t...tk.0t...tRich...t........PE..L...eq.R...........!.....P...8...............`............................................@.........................p........z..<...............................(...Pa...............................x..@............`..$............................text...4O.......P.................. ..`.rdata...!...`..."...T..............@..@.data................v..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-P1945.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	708608
Entropy (8bit):	6.46030877161514
Encrypted:	false
SSDEEP:	12288:qETlpkPPcE+qXW/fLXeKGVQHL+63jcxsf+SxWWfW+XYNfCJN4C/5AWPty0Da888Y:XJWPEZ8W/fLXPGVQHL+63jEsf+SxWWfV
MD5:	6CD81E6343AB21A1D118243AF54833A8
SHA1:	BBE1A06BD85AF7099FB111AC13D19DF5F7F22CC0
SHA-256:	306970A9D265A45ABBD2EFAF61002980695B2DE7961504CF71E2833F415E82A9
SHA-512:	295446E3732281B3AFB6B06684E2642A79E6B284608305291CC01967C45D2BA5892EF687DE084DBC9A22180233F1602A8C2236EC969DDDA34C25D4F4E6691328
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...H*.X..........................................@.....................................................................r........4..................................................................................<................................text...@........................... ..`.itext.............................. ..`.data....1.......2..................@....bss.....R...0...........................idata...4.......6..................@....edata..r............<..............@..@.reloc...............>..............@..B.rsrc...............................@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	InnoSetup Log Wondershare Helper Compact {5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}, version 0x30, 19567 bytes, 965543\user, "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact"
Category:	dropped
Size (bytes):	19567
Entropy (8bit):	4.817812405478971
Encrypted:	false
SSDEEP:	192:ODVUH3lt/2GNvBEizTa9WVYr7YqBBrDp8IfSsAXiKQIG2kB01uiRHK:cVE1t/2GNvqize9IYrUqTDp8xK
MD5:	C27EC2C19D07441065C2D8B98D6D52F7
SHA1:	DD72A81582F5A248CAAB3E459820AD5FD858CF2B
SHA-256:	E01FD21A68C0C3BEC9D0EC47637A1F3C4CF4665705D78245A41484CF863F495C
SHA-512:	3B1616CEF61950464C303FBAD5EF1745E3351ECCA0CD6EFC997987FDC43DC4E8FD3F5A35CD771EF022C56C26DC5138EC1EB0153A0B5AAFD51C7CBC79D580306A
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}..........................................................................................Wondershare Helper Compact......................................................................................................0...B...oL..%...............................................................................................................X..H........j.6.......j....965543.userJC:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact..............._.. ......0...C.IFPS........9....................................................................................................BOOLEAN..............................................................................TSTRINGLIST....TSTRINGLIST..........l...........!MAIN....-1..$...dll:kernel32.dll.OpenProcess.........."...dll:kernel32.dll.CloseHandle........(...dll:kernel32.dll.TerminateProcess.........#...dll:psapi.dll.EnumPr

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	723294
Entropy (8bit):	6.4919971377533034
Encrypted:	false
SSDEEP:	12288:1QtLeYXPEv4arPEn37TzH7A6p3xxu9yz/eERMY1VLJrNufs9RZM2wHOQyD362kS5:WtCUA4arPEn37TzH7A6nw9yzeESUFgHK
MD5:	A4A1B98720FA70874D30DE97F079F516
SHA1:	552E09860B9FBF43CEA58E8E54C23B9C6AF7A326
SHA-256:	6AE8EA4912A59413C78768592BC379D20483BC77A511A75C3CF11CC67B5886BB
SHA-512:	644C427F2E58EE406118C604CA314E41AC3FF655B6FF577419E34036136A1DF55D6231167E5D1D5B38B7D0D150582C3A4AECEFAC05489805D55D81C09E3B3DB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................b...........n............@..............................................@...............................%.......@..........................................................................................................CODE.....`.......b.................. ..`DATA.................f..............@...BSS..................x...................idata...%.......&...x..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc....@.......@..................@..P.....................j..............@..P........................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-5QFBO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172784
Entropy (8bit):	6.315646339644009
Encrypted:	false
SSDEEP:	3072:pd82CJty3VpqEnk0ixsSyKqZfIWr8ak3ZpA888888888888W888888888886V0Lb:H82f3VPSrTL3k888888888888W88888L
MD5:	47399B65BC25F6E74E32ED5C658B2B08
SHA1:	8054C8E5BDC67B424BF87687809FDC0CB76462EB
SHA-256:	5E3F83A673FC754FA71074784FEB354CECEC0323DD4373AE1346B8B55AA61B4B
SHA-512:	4214332B857F8D24A6B0EC58BFC062A8C44F0CDF3105D8D0651D0230723FDE4C8ED86C62FDF9DC6E1AA7197A1DE0B14D820F11E1493E55BFEE84FA6AA6D3A462
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-5QFBO.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....PS..........................................@.................................k............@..............................P....`...............n...4...@...............................0.......................................................text...L........................... ..`.itext.............................. ..`.data...<...........................@....bss.....N...............................idata..P...........................@....tls......... ...........................rdata.......0......................@..@.reloc.......@... ..................@..B.rsrc........`......................@..@.....................n..............@..@................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-GC800.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	267
Entropy (8bit):	5.524517088455498
Encrypted:	false
SSDEEP:	6:n4oCLMhxCuAbuzkoJLho2RysuADUSc8YtjPS4OZ6AvaPZGOmUrtWFNy24n:nlCLMwuIM+2RysuLS/Y1RODaVrtWryf
MD5:	65FD1756EE7B991631327910DF19AE17
SHA1:	9317618279C8402224A037EBF428E48276B1E067
SHA-256:	D8D8E832031D30A5FAB959E1279163C9071BAD6C7FEB52ACCA5B20111BD1B1E4
SHA-512:	A9E3B9D8DE88DBB857A085A41CF1F1E60CDD488796E61358F5E2563961FEFDA93DE047983026EE209E1385E8484E40AABCE553A77BC5827617674033DBA1BAE2
Malicious:	false
Preview:	[configs]..Version=4.10.0.0..AppRootPathName=KVAllmytube@KeepVid.com..FirefoxPluginID={0d9c7fa1-7556-4abe-8c17-6f9520c9bc96}..ChromePluginID=nomnoaehhnmbolpapbjeopogjfefdpnl..ChromePluginFlag=AllMyTube..IEPluginID={F9B65201-3D7F-48DA-AAB3-57A6FAD648FD}..[IEAjaxSites]

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-KSIMO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	628976
Entropy (8bit):	6.532166937702212
Encrypted:	false
SSDEEP:	12288:3GQTbpN15aaEHagqfmzjkcRd61+YTJ7N/adoT888888888888W88888888888IB:WAbpN15aJHagqe0p1+Y17NGlB
MD5:	6BCA493DCACB5F3890F23DCF031193A7
SHA1:	A7C39E90A5E426BC0005BD3D8EB535D673703E04
SHA-256:	713469CD5BFBF918B60E56C4875667CEB015F32D1AC8B656885513910A0A9FD0
SHA-512:	D39B9E94D0A723E91F649FD35CBE644A5FC2C633F5F023909BA9F840873554979947FA66FEBE38A18BCF7242669B2632907CFE455F50076D5BB05B593F88ACA4
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-KSIMO.tmp, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....6X..........................................@..................................P.......................................P.../... ...............d...4...........................................................X..D............................text............................... ..`.itext.............................. ..`.data............ ..................@....bss....,R...............................idata.../...P...0..................@....edata..............................@..@.reloc..............................@..B.rsrc........ ......................@..@.....................d..............@..@........................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\is-SOA4S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	64073
Entropy (8bit):	7.983312318998665
Encrypted:	false
SSDEEP:	1536:2H9a8iMirwmO1v7CK0FYbf5m/VzWIqIuytEzFnt7fk9:2Hs3XS17CK0FYdmNSIxLCJtzo
MD5:	D334C3D52DB33E1554F57B43C47A98D5
SHA1:	AF91D8E55B4C7DC5AFDFE272E3E79479FF439BF1
SHA-256:	5704FCB4FE0E277158BF6A1580731D96775F99F65C68D44BC5FD1A9C09F1349E
SHA-512:	3D8E60D63FF4ED986FF317D07C524AA980AB275C954FF6136F26BC6DB2E4C730F0C0EE1C1EC2217A8CA3BA0DDC81D7B56DDF74CFA3E710A71277095C71902C7A
Malicious:	false
Preview:	PK.........xsIe.0.....n.......000003.log.ZK..XZ..3L..R3;.,\|.oU%.8.R.bn.T...Z.}....H.t......b......lFB.%..,g9....Bl.8.v.'qR..i..^...........s.~....}uv..y....:...+..~.P4~.....h.-.B..-...bx......Y..o_.:..+..Ou....8.._....._.....;.....rMZG....yM7>.L.}.z.&.K...T$E.".....KE.."}...x~~n^.d.}u.].._.T.uC7h...Q........._...W.w.....M...`?..W?\|u.=.............:Sei.t.N}$.... ..7p.n...s(.3..z<B...$.....\|..O.....Q.1?.....t.~n..y.y.hPk........T.....C..t.....L.qmy\|..m.i.......tM...G.2..]....x..A..........ZF..C_.dZB.m.3....e``..UhP(..ZG...8e.c4...^....WB....W4.2T.(.$ C..v..q..h..=<.h....s...........@...X.9..:..N.@$.O.p..d.hf......X....\.5y.S..qd\|}E...*......)...i25.. !.:....P.<....<.k.w~..w.~.....N...:.,..X.l^v_$.`8...p...Bcf<......v...!Z.i.#....].3^...m.r..i...e.E.%B.`..G..EKf.-.>..gF......F...6.U3..i.}.%N+..e...gi^.$.y.5r...f..h,....d..~..].\|..-.(...LI....\.`D..>W4q;....y.Q.b.....K\vC.....b....5m.r.O....(...T/...k.?...uU1pc.&.....83..A.n............~.+..:5..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\META-INF\is-8GVK8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	data
Category:	dropped
Size (bytes):	4180
Entropy (8bit):	7.631716946416748
Encrypted:	false
SSDEEP:	96:1Sh0aflirCxmQikHs3LlPtn40cTy/aV7r:1EbflMxDkHaRPtn40cTy/Ur
MD5:	19552889C5F59CE3CB39FF5C08877357
SHA1:	6FCF24D736914A19564F788564AF5CDEE1E4AF84
SHA-256:	7BBCBB1A55313A62780FC0BBD731EEF645EB67BE1B3A947C8D85C4F502935945
SHA-512:	5EC27F4342FA38884D16835A7C97BD8A43DB8DDE2F94B0D2C02B54D632FBFE15248AE7D85C291317847D7DC53D4B7B1F6739F484459C98B36A207484D6D9FC09
Malicious:	false
Preview:	0..P...H.........A0..=...1.0...+......0....H..........0...0...........Z..^0....H........0..1.0...U....US1.0...U....Mozilla Corporation1/0-..U...&Mozilla AMO Production Signing Service110/..U...(production-signing-ca.addons.mozilla.org1402...H.......%services-ops+addonsigning@mozilla.com0...170205053915Z..220204053915Z0z1.0...U....Production1.0...U....US1.0...U....Mountain View1.0...U....Addons1.0...U....CA1 0...U....KVAllmytube@KeepVid.com0.."0....H.............0..............u.......\.......V...`..=..<<.v.g).@X...t.'....;.uN.A...1.L<'...a.0.....q.<:..W4.\|.."...U4.7..-.....v.b2.A+.....l.j=..Ul...w%..@".B5.@.j.E.<s....N..A.9.T.sJ{1..L."..g..;.u....._K}!.N]........F[dp...mn%..8..U.7....h...C.h-.1..u....Z..eFa.x.8......q.....J...2j..h1.........3y..t.hj...)Zd...O.......[.&.u....s..C....}..o>.I..#=.Hvq.`W.9...2......\|.V~!..Q..l.w....IFm...:&..+..;.l9.)..N.<\|?...(....@..p..v.tG6Nw..i{.P..4.j.-6.....*H.\W=./...#.jz.3..=..8.s...l#.R......Z.....!........0.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\META-INF\is-D1JVS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	121
Entropy (8bit):	5.373005130596893
Encrypted:	false
SSDEEP:	3:FwAPWXE0GLKfFZMd1NHUXv2WRhMNLKfF4dWqG0gSLRn:+AePGLKtCdrHUv2IELKt4dW5+
MD5:	3754AC0EDF57ED4DFB796D59BBFE431E
SHA1:	A0F451F91DEE1C5BD53BD7276F01540095526B4E
SHA-256:	72D631CE867AD0B64F5654F3423B9F888D6C5C178D5FB150E024FF704A895BB9
SHA-512:	B9385957A36005F2B9D393F3C2D333DD083831FE7315C8C8F40E2C2B4E5F964A5217AEF924B236737A606E1A06CD2832A9466AD2388751EF59F044E7093364CD
Malicious:	false
Preview:	Signature-Version: 1.0.MD5-Digest-Manifest: OPr1agy7dWxPZovLmNb1UQ==.SHA1-Digest-Manifest: nJ983Ab5njLva62P/mQa8EwnWmU=..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\META-INF\is-VI8QC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2912
Entropy (8bit):	5.715664589030119
Encrypted:	false
SSDEEP:	48:/cHVZNSq946uMKRqIAWpYmh1be7XRwPDd4Suo3w:/cHVCPMKRqCpYEVebmPDWS3w
MD5:	38FAF56A0CBB756C4F668BCB98D6F551
SHA1:	9C9F7CDC06F99E32EF6BAD8FFE641AF04C275A65
SHA-256:	9DC399CE46EA94B9FA3EFA283CD86920F662E0F5930E14FFD3EE1984BD14E7C1
SHA-512:	4E37A167D796D1FE0033CD51480DF617E21303C24953CAB720BFD5519A052A5E1EE335CF1AB3322EB7309DA3FDE6A981E9488FC98BA69F561B43705CAFAC7795
Malicious:	false
Preview:	Manifest-Version: 1.0..Name: install.rdf.Digest-Algorithms: MD5 SHA1.MD5-Digest: F1T6ikJ3GX4gBrVGfx+4pg==.SHA1-Digest: O9V8FZLHdusqDE1aPhvaPxavqzc=..Name: chrome.manifest.Digest-Algorithms: MD5 SHA1.MD5-Digest: nbVav+cmu3DwwJTUFQkB2w==.SHA1-Digest: tQVp5pGvZYiyH/S3/hZjY4r0t50=..Name: chrome/AppMgr.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: RLFKFnl1JqpBRtZc2rW6dw==.SHA1-Digest: j72ysqCNXZrhfH2dW/wl5CP9O1E=..Name: chrome/Firefox.WSUtils.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: kLS/KZqBU3uJJh5SfN6wLw==.SHA1-Digest: /C02sQi0qDlBiF2qLSonfpVsRYY=..Name: chrome/firefoxOverlay.xul.Digest-Algorithms: MD5 SHA1.MD5-Digest: 8PyAPSg8bMXMmKMUY+zK2g==.SHA1-Digest: X8EzLXKjII6yndz0rgBghNHnVEQ=..Name: chrome/main.png.Digest-Algorithms: MD5 SHA1.MD5-Digest: hmyFb/n6nC0cdHtojsRn8Q==.SHA1-Digest: wirozwixCG80IgwUiUxw3OAn+7o=..Name: chrome/Thumbs.db.Digest-Algorithms: MD5 SHA1.MD5-Digest: F8UoZpcuJLDCycQhUXcmbA==.SHA1-Digest: U7hUDWYkewyWLg4RxBxL2fGu+6o=..Name: chrome/app/KVAllmytube/FaceBook.plugin.1.1.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\app\KVAllmytube\css\is-7P51H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	6.974847941200587
Encrypted:	false
SSDEEP:	192:vk5BG6ehrCYut7/kTvGGK/xzheBbw5dK6PtmNSeUekD4nS:vkfG19CYmkyGohIw57Ptk5n
MD5:	CAB770BE972D8A279A12578D51A5CE69
SHA1:	49525B280511CB2507F9205CCB6B4FCDA96DD3BD
SHA-256:	64DDF66D20A76B3B2BEE040DF38442B7DB27C18D8B25F8E958996965B8DC31BA
SHA-512:	2E3F33745CFEA1E719202186491B47CDE1AFAEAD12FD75D524809B3477C81CDDA7022FDE69B4A6574D49775C120E2CE9E5EEFF8F080634C6710525B852F6152F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\app\KVAllmytube\css\is-CENS5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 140 x 340, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8309
Entropy (8bit):	7.892378611881201
Encrypted:	false
SSDEEP:	192:3G/nqsrrj3WMi/or7/qarodhIwayIvTa3XXW1:Wf7zVic/MmmCanG1
MD5:	CEB1D2295C0A367EE8D6625317542769
SHA1:	737D95059C3E6E70DE9DF7C9D89E17C8238CB10D
SHA-256:	C157CDA43C615A4E0331C795506888D46D03FD6200D4BDAA3BB8A47DB06DB390
SHA-512:	C007A4C01B99CD6DBD0FC7569FBCA34B25AD48CABC831C6614D0575DC852EFFD7C2CE64AD7374C9492243063237534559BD1F1459ED53F36C8FDB583B916CDC4
Malicious:	false
Preview:	.PNG........IHDR.......T.............tEXtSoftware.Adobe ImageReadyq.e<...kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:DE162C2787CAE311951CA28BCC767C32" xmpMM:DocumentID="xmp.did:A25948E6AF0011E69C849C616D2386CF" xmpMM:InstanceID="xmp.iid:A25948E5AF0011E69C849C616D2386CF" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:60e6890c-394f-4cf9-9f8b-591d42cc66fc" stRef:documentID="xmp.did:8C89A0E1CAC311E39B9BCC0663B7E4B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...>....IDATx..].x..>.j...B..d.....mBl......1.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\app\KVAllmytube\css\is-PQ3OB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with very long lines (728), with CRLF line terminators
Category:	dropped
Size (bytes):	4526
Entropy (8bit):	5.232517639964482
Encrypted:	false
SSDEEP:	96:YItHRjPgPrCPxiuPVqPfPDuPqiiPTPXPEJPxipPmr:1tHx0rKxtVC3DGqtr/ElxES
MD5:	005FCC74767F71BDE128E8B47F38D7BC
SHA1:	D5BEC7B9FB525489F8C27946E740B059EF6FFE7B
SHA-256:	B552A3ACF22FB67640F0F5C10C36CAE39F7929308DB583266344FDAAC25A04C7
SHA-512:	1D54B8A10CFCF03CAE865BA3201ED8D58D83FD56E0DAC48DFE223E5EFA2494464CCE5C4F18622B72CB8DD1BA7BAB47867C2C830EB49AB1351BCF50DE5E647207
Malicious:	false
Preview:	/ws_KVAllmytube_btn/...KeepVid_KVAllmytube_toolbar body, .KeepVid_KVAllmytube_toolbar div, .KeepVid_KVAllmytube_toolbar dl, .KeepVid_KVAllmytube_toolbar dt, .KeepVid_KVAllmytube_toolbar dd,.KeepVid_KVAllmytube_toolbar ul,.KeepVid_KVAllmytube_toolbar ol,.KeepVid_KVAllmytube_toolbar li,.KeepVid_KVAllmytube_toolbar h1,.KeepVid_KVAllmytube_toolbar h2,.KeepVid_KVAllmytube_toolbar h3,.KeepVid_KVAllmytube_toolbar h4,.KeepVid_KVAllmytube_toolbar h5,.KeepVid_KVAllmytube_toolbar h6,.KeepVid_KVAllmytube_toolbar form,.KeepVid_KVAllmytube_toolbar input,.KeepVid_KVAllmytube_toolbar textarea,.KeepVid_KVAllmytube_toolbar p,.KeepVid_KVAllmytube_toolbar th,.KeepVid_KVAllmytube_toolbar td {margin:0;padding:0; -webkit-text-size-adjust:none;}.....KeepVid_KVAllmytube_toolbar {font:12px/1.2em Arial, Helvetica, sans-serif !important; width:140px; height:32px; top:-29px; right:0;}...KeepVid_KVAllmytube_down { height:32px; cursor:pointer;}...KeepVid_KVAllmytube_down .btn_down:hover { backgr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\app\KVAllmytube\is-2VI96.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with very long lines (32341), with CRLF line terminators
Category:	dropped
Size (bytes):	96387
Entropy (8bit):	5.382196707881799
Encrypted:	false
SSDEEP:	1536:MPpEy5BMibZGOj/bEe8v+/UWf4IhvAuCh/jFkODZ2D5N9Rag0MOIdSZAgttoX5Yq:jIO4e2D5c4LgtDmLja98Hr9
MD5:	5C42C26751D76304D5F142E477CC0150
SHA1:	9D8638AEBE607352DA849A8618DB4714D704B16F
SHA-256:	46D3ABF61B33F92A80C0779131E53AB82DDC6CA4AA3CAAC51135BBE468DC9386
SHA-512:	B90E0E217B73FB1B6EA321193EF48FAD3AE88CC3A2D6E1BD10CF035DAB1FD81874B40ACB632DBB00E7FC71604CDBC63712F5C6EBF73A6B18871BC124E23837F0
Malicious:	false
Preview:	../! jQuery v1.11.0 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k="".trim,l={},m="1.11.0",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,func

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\app\KVAllmytube\is-AI2A7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7060
Entropy (8bit):	5.40219209589285
Encrypted:	false
SSDEEP:	192:bT4ExpIiqRpBWzy4dZ8aoBNykajmdm9nmVBTaz+xaxGxxryVKzrYUVIAN9PDpSkG:b0EsiGiZf9jKL2Hjy1tEAvvpvX7LoHVX
MD5:	EC4665C5AAB1E46C4A9906410E520B59
SHA1:	2EA50EBF4293DFA32580B0CB89B7C76E9057298A
SHA-256:	3F1390006020AEBE51976281CA5ABBC4C035EC2D859B29FF71EE220F7D766242
SHA-512:	7B89444C004D315BBEFC8DACDA84781D646B83E0295F87BDE97A88DADFB0D1F02CF34B2C6FDBB548A57F72BAF0C9428914857D1ED6D98CDA7CB028AEA898AEB3
Malicious:	false
Preview:	//alert('Youtube JS');..//;(function($){..//.var Plugin = $.KeepVid_KVAllmytube_Plugin;..//...//.//Plugin.Log = function(msg){..//.//.$.WSUtils.Log(msg);..//.//};..//...//...//}(jQueryWS));..function Browser(){...var Sys = {}; .. var ua = navigator.userAgent.toLowerCase(); .. var s; .. (s = ua.match(/msie ([\d.]+)/)) ? Sys.ie = s[1] : .. (s = ua.match(/firefox\/([\d.]+)/)) ? Sys.firefox = s[1] : .. (s = ua.match(/chrome\/([\d.]+)/)) ? Sys.chrome = s[1] : .. (s = ua.match(/opera.([\d.]+)/)) ? Sys.opera = s[1] : .. (s = ua.match(/version\/([\d.]+).*safari/)) ? Sys.safari = s[1] : 0;...return Sys;..}....var lowcasePageUrl = location.href.toLowerCase();.....if (lowcasePageUrl.indexOf('youtube.com') != -1) {... $(document).ready(function () {....var bro = Browser();....if ((!bro.chrome) && (!bro.firefox)){//IE......//setTimeout(function(){.....//.$.WSUtils.fix_wmode2transparent_swf().....//}, 2000);....}else{.....//$.WSUtils.fix_wmode2transparent_swf();.....}......});..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\app\KVAllmytube\is-ATS1A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18612
Entropy (8bit):	5.346033402846152
Encrypted:	false
SSDEEP:	384:hiIegrDmyQQqJgJP3ZtvVfBYLiMevmkaTU/CX:hiIegH9fB3nmkaTU/4
MD5:	E1B6D5205E000F0B41494A7B45818949
SHA1:	D64631EEF42D2DB7A91EFF95DA9E3FEA736FA931
SHA-256:	EEFFD15C2580B9D5D78F99256B4EA6057DDF20BB4FECA24278909A3341A46A15
SHA-512:	39AE4AE77BBCCBA662EDDA256C4E651B26B8C1416893C7A26CA6035F99973993715E4B0D58AEA4D0939760B7773E78753FB2768E1BBF8BD9A075F9CC36A39BB4
Malicious:	false
Preview:	//alert('Main JS');..var AttachStyleEnum = {...AttachOuterTopLeft: 0,...AttachOuterTopRight: 1,...AttachOuterBottomLeft: 2,...AttachOuterBottomRight: 3,...AttachInnerTopLeft: 4,...AttachInnerTopRight: 5,...AttachInnerBottomLeft: 6,...AttachInnerBottomRight: 7..};....;(function($) {...var Plugin = $.KeepVid_KVAllmytube_Plugin = function() {.. return this;.. };.. //var css = document.createElement('link');.. //css.href="http://127.0.0.1/css/mytubebutton.css";.. //css.rel="stylesheet";.. //css.type="text/css";.. //document.getElementsByTagName('head')[0].appendChild(css);.. //console.log(Plugin);...Plugin.Log = function(msg){....$.WSUtils.Log(msg);...};......Plugin.CalcToolBarPosition = function(flash, btnWidth, btnHeight, attachStyle){....var flash_top = flash.offset().top;....var flash_left = flash.offset().left;....var.flash_width = flash.width();....var.flash_height = flash.height();....var divLeft = divTop = 0;....switch (attachStyle)....{.....case Att

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\app\KVAllmytube\is-FP3G8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Generic INItialization configuration [css]
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.700586370175625
Encrypted:	false
SSDEEP:	3:KU3GyzBLy/Q7DYPOxSbWXs5gLVCUhSovZYjvARkjQP/UgLuom/RkSio:F/9y/Q7DYGSTO0UhLZY0W0UTlRkSio
MD5:	035693A77ECFA20ABA60689426E8125F
SHA1:	45041BC872C3B78EC0471DB234503FB5DBDBEC07
SHA-256:	B37F9F3092189D6B848F4BBFE4C4F6AF0632DFC355BECB91ECED7880DCFBCA6C
SHA-512:	61C1B482781D5F7D4CF33359852512E3D81A823D20333960D79380C351772B575E295EC173FAD9374590EA406BD3A9931AFB8E82323A2F4553A183AACF790286
Malicious:	false
Preview:	[script]..js0=Keepvid.Main.user.js..js1=jquery-1.11.0.min.js..js2=Youtube.plugin.1.0.js..js3=FaceBook.plugin.1.1.js..[css]..css0=css/mytubebutton.css

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\app\KVAllmytube\is-S2SE6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8774
Entropy (8bit):	5.52828172872637
Encrypted:	false
SSDEEP:	192:4qtPtt9MFlJ7O2xi+TbKdalYqBQtazYnC:3t1tElJ7Li+6B2Q+d
MD5:	1BBEAEFB7F94377171A9A5B27F31405A
SHA1:	5D3FE66B7BCAE6FE729F09869CDBBE0167D250E1
SHA-256:	98184DFC37403EC78EE5F17466C831E08F0555E43C4C8D5B960939314481067D
SHA-512:	6AE8431AB508782CD041728174580D7102F2E5ABBE6EC10FC06BFD4E3C355BFDB0E0F046209F26F5EE5B286F0DA99E8D81D8A75B2AEB238EF6E5328947FA0053
Malicious:	false
Preview:	//alert('facebook begin');..//;(function($){..//.var Plugin = $.KeepVid_KVAllmytube_Plugin;..//.alert('dasdasdasd:'+Plugin);..//.Plugin.Log = function(msg){..//..$.WSUtils.Log(msg);..//.};..//.Plugin.FaceBookCheck = ..//...//}(jQueryWS));..function FaceBookCheck(targetDom){....//alert(targetDom.tagName);....var destUrl;....if(targetDom.tagName=='VIDEO' && location.href.indexOf('facebook.com')>=0){.....//................if($(targetDom).parent().parent()[0] !== null && $(targetDom).parent().parent()[0]!== undefined){......destUrl = $($(targetDom).parent().parent()).attr('keepvidHref');.....}.....if(destUrl == '' \|\| destUrl==null \|\| destUrl== undefined){......destUrl = FaceBoookInnerVideo(targetDom);......//....................if( $($(targetDom).parent().parent()[0]) !== null && $($(targetDom).parent().parent()[0]) != undefined){.......$($(targetDom).parent().parent()[0]).attr('keepvidHref',destUrl);......}.....}....}....else if(targetDom

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\core\is-2AQOQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Generic INItialization configuration [Settings]
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.000186307499341
Encrypted:	false
SSDEEP:	6:9ytT4IqfBLDHGdIqfRRmQukPXUNjSUYGcEHduuAyvZYyBI5:ghtULDHG6UYhHpSkBYyBI5
MD5:	62D00EB8A09EAA4EBC8FE5FE3B6D3699
SHA1:	3AE1590B86A5680EF1D80965F45B04D684E919E2
SHA-256:	DA37CBB8192F979085015AB9514F5D66E8F46C88928403159FDD717AA1B55737
SHA-512:	8D51B718B58711759BF01DE96C3E23E4DEA2C24E88E280A793B627211C31B73810C4224F32E05745EE1205A163A0E7A0EE0BD462293B93ACAC40D51033A6164E
Malicious:	false
Preview:	[info]..AppName=Javascript Framework Core..Version=0.0.0.1..Description=Javascript Framework Core..[Settings]..enable=1..[script]..js0=jquery-1.4.2.js..js1=jquery.base64.js..js2=jquery.relocation.js..js3=WSUtils.js

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\core\is-5NPNJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with very long lines (357), with CRLF line terminators
Category:	dropped
Size (bytes):	170101
Entropy (8bit):	5.1266862666828805
Encrypted:	false
SSDEEP:	3072:cgQWO242ffq+50dFhPGXVKDhA4kO9J3A7zUMpZXwFh++l7XKDtxp/Lq8LakxOAdk:thqmMFhPMKDqO9JQ7zPZgFh++Ytxp/LK
MD5:	8D6B86489CDB19F3E5F2A90E072BA474
SHA1:	1540B37FB00B3FA2B5FC670D003C3E6EC7369986
SHA-256:	E04E11DC19CA127E3B668492DCD4629106861CDFA0949E8855FF461C4C395899
SHA-512:	20D01E5765352A75345AD00FDB9EF185206F395E0685FA35FF13D883BE94F571487644ACD09F75F44037C23A9D01901274D2C64B486866CD62C29E000AB45625
Malicious:	false
Preview:	/!.. jQuery JavaScript Library v1.4.2.. * http://jquery.com/.. .. Copyright 2010, John Resig.. * Dual licensed under the MIT or GPL Version 2 licenses... * http://jquery.org/license.. .. Includes Sizzle.js.. * http://sizzlejs.com/.. * Copyright 2010, The Dojo Foundation.. * Released under the MIT, BSD, and GPL Licenses... .. Date: Sat Feb 13 22:33:48 2010 -0500.. */..(function( window, undefined ) {....// Define a local copy of jQuery..var jQuery = function( selector, context ) {....// The jQuery object is actually just the init constructor 'enhanced'....return new jQuery.fn.init( selector, context );...},.....// Map over jQuery in case of overwrite..._jQuery = window.jQueryWS,.....// Map over the $ in case of overwrite..._$ = window.$,.....// Use the correct document accordingly with window argument (sandbox)...document = window.document,.....// A central reference to the root jQuery(document)...rootjQuery,.....// A simple way to check for HTML strings or ID strings...// (

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\core\is-79J87.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.949216031331948
Encrypted:	false
SSDEEP:	24:IEqKcM9xDlCi0m4qX+4YqY9+AlVjpS/7rxvCvldM/:IEv9xDlIm4qX+4YqYwWVjpSTrxvCvldW
MD5:	5EA3814F607156F99736B5815E99E879
SHA1:	EE50C67A70DE38FA580A3E025931D8C43C52DE91
SHA-256:	FE442880A1FE9E9679CE3656297280844D1A480B4FDC41B65974757F1CC59F3D
SHA-512:	F4984435CEC1E082BFCC56286DFE22D9EFBA7F3C392D992C15E74D99AD59B073F95134A8EEB4E9A259FCBED1EF2A66A8A924BEAB03269D9D32851C838893330A
Malicious:	false
Preview:	..;(function($){...jq_relocation = $.relocation = $.extend( $.relocation, {} );......jq_relocation['elems'] = $([]);......jq_relocation['timeout_id'];.......jq_relocation['str_setTimeout'] = 'setTimeout';......jq_relocation['str_data'] = 'currentLocation';......jq_relocation['delay' ] = 10;......jq_relocation['add'] = function(elem, callback){........this.elems.push({e: elem, c: callback, data: { l: elem.offset().left, t: elem.offset().top }});........if ( this.elems.length == 1 ) {..... this.loop();......}.......};.......jq_relocation['loop'] = function(){..... this.timeout_id = window['setTimeout'](function(){..........for.(i in jq_relocation['elems']){..........if (i < jq_relocation['elems'].length){.......var item = jq_relocation['elems'][i];.......var elem = item.e;.......var callback = item.c;.......aTop = elem.offset().top;.......aLeft = elem.offset().left;.........data = item.data;.........if ( (aLeft != data.l) \|\| (aTop != data.t )) {........item.data = {l: elem.offset().left,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\core\is-846J1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6009
Entropy (8bit):	5.591382986231939
Encrypted:	false
SSDEEP:	96:pYHhgOf/8NZrMmgEwpI8XRhzX/tVl6TRY+fbqId61GQLLs86xsxgpwyZGNSRh:ShgOf/wZomgEwpI8//tWhkm8Emsh
MD5:	C56F9B76A14D303BC82C25563521DBDA
SHA1:	19DD20A69D316F1BEED985E9959C57C10972790B
SHA-256:	66D3B9C04F1BDC7F5BF4352670965A0119152A405CFDBB1AEAC3FE6E8D4C0F3A
SHA-512:	19A140C08B308DE5514BAE238EEEB1C036F0C07A80B739EAA68F049C7833C975F6B0E1181CF297B399E3DDB2F8424006EEEBC7F550D7759745880B55A9AF9C48
Malicious:	false
Preview:	//WS..............//alert('jQuery.WSUtils Begin');..if(HasFixWmode2transparent_swf == undefined){...var HasFixWmode2transparent_swf = false;..}..;(function($){...var Plugin = $.WSUtils = function() {.. return this;.. };.......Plugin.fix_wmode2transparent_swf = function(){.....if (HasFixWmode2transparent_swf){.....return;....}....try{.....//alert("fix_wmode2transparent_swf");.....$("embed").each(function(i) {......//alert("fix_wmode2transparent_swf 1");......var elClone = this.cloneNode(true);......elClone.setAttribute("WMode", "Transparent");......$(this).before(elClone);......$(this).remove();.....});......// For object and/or embed into objects.....$("object").each(function (i, v) {......//alert("fix_wmode2transparent_swf 2");......var elEmbed = $(this).children("embed");......if(typeof (elEmbed.get(0)) != "undefined") {.......if(typeof (elEmbed.get(0).outerHTML) != "undefined") {........elEmbed.attr("wmode", "transparent");........$(this.outerHT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\core\is-897E5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Algol 68 source, ASCII text
Category:	dropped
Size (bytes):	4500
Entropy (8bit):	4.706024482154792
Encrypted:	false
SSDEEP:	96:y+veaO7wyO7VUtro9mLp/iZZe8naRhIMRnRf2MTEcKF6ite0GA:zvs7jO39mkHe++IK2MTY6ite0GA
MD5:	B8197069D7185AF5C5BB422B40D57E49
SHA1:	AD9614829FC64FBC62F3B24331F5E77C8EDC1918
SHA-256:	216E6672AAF0C1ED6922CCAE984853132AE6CF545ED4820D6660EE509A30D5B8
SHA-512:	1486BBD5B47A6FD80631A5A2B91D020F90DABEC55145B89AF16FC68FC130AA4134974B49757635E402181579852F7F2FFBD3691939D0735B2DDC425A22E9198E
Malicious:	false
Preview:	/!. jquery.base64.js 0.1 - https://github.com/yckart/jquery.base64.js. * Makes Base64 en & -decoding simpler as it is.. . Based upon: https://gist.github.com/Yaffle/1284012. . Copyright (c) 2012 Yannick Albert (http://yckart.com). * Licensed under the MIT license (http://www.opensource.org/licenses/mit-license.php).. * 2013/02/10. /.;(function($) {.. var b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",. a256 = '',. r64 = [256],. r256 = [256],. i = 0;.. var UTF8 = {.. /. * Encode multi-byte Unicode string into utf-8 multiple single-byte characters. * (BMP / basic multilingual plane only). . Chars in range U+0080 - U+07FF are encoded in 2 chars, U+0800 - U+FFFF in 3 chars. . @param {String} strUni Unicode string to be encoded as UTF-8. * @returns {String} encoded string. */. encode: function(strUni) {. // use regular expres

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\is-6DICO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6380
Entropy (8bit):	5.3315449914327155
Encrypted:	false
SSDEEP:	96:jjwr+KIROWh8ZjdgMpSSfDnIzw7SO+2Lw7snFjBM:nn9KRgKkc7i72M
MD5:	44B14A16797526AA4146D65CDAB5BA77
SHA1:	8FBDB2B2A08D5D9AE17C7D9D5BFC25E423FD3B51
SHA-256:	1F18FC098C94203A40C8CA15AE99AE19B4FAF80E259C2C81F73236491A7C667A
SHA-512:	838BE675F058DAD2F88DB508E0FECB8EF83E46A670BADC3EB09A7DD71B8B28FD9D0CEEDC84D5CC565157FBE99FAAFAB9BCBAC587B6EE36A1D0A2F575795088FA
Malicious:	false
Preview:	//FireFoxPuglinUtils.Log('AppMgr Begin');..function CreateAppMgr(aPluginID, aPluginPath){...var PluginId = aPluginID;...var PluginPath = aPluginPath;...var JSList = [];...var CSSList = [];...//FireFoxPuglinUtils.Log('CreateAppMgr Begin');....var LoadApp = function(event){......//FireFoxPuglinUtils.Log('LoadApp Begin');.....function newGuid() {.....var guid = "";.....for (var i = 1; i < 32; i++) {......var n = Math.floor(Math.random() * 16.0).toString(16);......guid += n;......if ((i == 8) \|\| (i == 12) \|\| (i == 16) \|\| (i == 20)) guid += "-";.....}.....return guid;....};......function LoadCSS(fileName){.....try{......//FireFoxPuglinUtils.Log('LoadCSS:' + fileName);......var fileref = gBrowser.contentDocument.createElement("style");......fileref.setAttribute("id", newGuid());......fileref.setAttribute("type", "text/css");......fileref.innerHTML = FireFoxPuglinUtils.FileManager.Read(fileName);.......gBrowser.contentDocument.getElementsByTagName("head")[0].appendChild(fileref);......//alert

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\is-G47ST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10765
Entropy (8bit):	7.935018555387737
Encrypted:	false
SSDEEP:	192:NknHAxs5o+PFCAs5vXeWqF0hqm++Icf23GgIGmt/KLKLxiZe4vpi8:unHAxs5/F9s5vXgGhq4f29IGEKLKLxin
MD5:	866C856FF9FA9C2D1C747B688EC467F1
SHA1:	C22AE8CF08B1086F34220C14894C70DCE027FBBA
SHA-256:	9CA4DD534EB030529415E7B82A65D78BC8C65F41E7D63C72DD973C6BED1B26A1
SHA-512:	022E152231C18A02E8690A52A54CF1C6D7F2835F54C79F1C99EB0EFC5A673DEA97B847901B1A39D59D2964EB57A4ACA26AB1594A2128BAD77CD1266E00887AB4
Malicious:	false
Preview:	.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpMM:OriginalDocumentID="adobe:docid:imageready:68463a2a-8375-11e1-9c22-f6d913fd0c31" xmpMM:DocumentID="xmp.did:DFEB7F47B93B11E68A7790ECC3E6F38C" xmpMM:InstanceID="xmp.iid:DFEB7F46B93B11E68A7790ECC3E6F38C" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:69669afd-0909-490c-94d1-2ba7cd014402" stRef:documentID="xmp.did:427C47B508206811871FA9AF76262391"/> <dc:title> <rdf:Alt/> </dc:title> </rdf

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\is-M3CKT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	5.060969840831249
Encrypted:	false
SSDEEP:	6:JiMVBd/DvuK8qmc4ciN7CccLqpkAqJmW/mcMMkAqJmW/ko8TU:MMHdzz8qXoCtLGJqJmW9MMJqJmWJ8A
MD5:	F0FC803D283C6CC5CC98A31463ECCADA
SHA1:	5FC1332D72A3208EB29DDCF4AE006084D1E75444
SHA-256:	2F1053CE31E309A983A1A8C06382A5670CCD4F4B737E275E941C7584EEFF67B0
SHA-512:	4B6F8690802717D0777ECFFE476E6C631C4671919DD8420E710738E07C77BAE31767C6195A9D697C0AA02C83DF10B1E348903562FFB580C45618D35AA5FF9D78
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8"?>.<overlay id="flash-overlay". xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">..<script type="text/javascript" src="Firefox.WSUtils.js"/>.. ..<script type="text/javascript" src="AppMgr.js"/>.</overlay>.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\is-N5UQO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4143
Entropy (8bit):	5.223537823924162
Encrypted:	false
SSDEEP:	96:td5K+NwkuA/Acpe0wGKlTG3j7IsDXHO1P:tzlTve1W7LLO1P
MD5:	90B4BF299A81537B89261E527CDEB02F
SHA1:	FC2D36B108B4A83941885DAA2D2A277E956C4586
SHA-256:	1FFDFDFF739F2C3597CB505C83729A09CA9D4E9B66AC27724C32E12786C699F6
SHA-512:	5908A1048579AD06C8A04DE9AC4772A472A73203325E2F2BA8FA183B708E93EEF1DEF29C073A088E55D2B303756CF1B5B7E87506EB47E864BD774F41D9F92F95
Malicious:	false
Preview:	//alert('WSPlugin.Firefox.FileManager Begin');..function GetFireFoxPuglinUtils(){......if (_ConsoleService == undefined ){....var _ConsoleService = Components.classes["@mozilla.org/consoleservice;1"]......getService(Components.interfaces.nsIConsoleService);...};......this.Log = function(msg, alertMsg){......//_ConsoleService.logStringMessage(msg);.......//if (alertMsg == true){....//.alert(msg);....//};...};......this.FileManager = new function(aLog){....Log = aLog;....this.Write = function (File, Text)....{.....if (!File) return;.....try{......const unicodeConverter = Components.classes["@mozilla.org/intl/scriptableunicodeconverter"]........createInstance(Components.interfaces.nsIScriptableUnicodeConverter);........unicodeConverter.charset = "UTF-8";........Text = unicodeConverter.ConvertFromUnicode(Text);......const os = Components.classes["@mozilla.org/network/file-output-stream;1"]...... .createInstance(Components.interfaces.nsIFileOutputStream);......os.init(File, 0x02 \| 0x08 \| 0

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\chrome\is-UQ6V8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	7.293834702778798
Encrypted:	false
SSDEEP:	384:hcS88mj3HfQ02v8f3ZATQsBW12OOtjkp:h8j3I0223ZAH8YU
MD5:	17C52866972E24B0C2C9C4215177266C
SHA1:	53B8540D66247B0C962E0E11C41C4BD9F1AEFBAA
SHA-256:	82BDCD0C96FBA27A5E785845DCFF6869B8797F50335DA88C511D004373AE16AF
SHA-512:	99D1BCED65DCF46C930D072F0860281D2F507903D1C750E10B644D88F71B615A6218B309B20C444FD52C87B9CC97F2007D87552757CFA4B225916BAFA8D2105F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\is-43JJO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.700752995946208
Encrypted:	false
SSDEEP:	3:C1JL2gFmK9afuiRzWeeqFVK6c2us1pQiaFKu0Gc2gKJmLsidjgBFDL2gFbWLU8Fk:C1pmMmlz8Ebab0G65d+Fnbjfn
MD5:	9DB55ABFE726BB70F0C094D4150901DB
SHA1:	B50569E691AF6588B21FF4B7FE1663638AF4B79D
SHA-256:	E24164EF44937299D09D725A551FC3B8E8AA4F29BAD84239A153A16EA948445A
SHA-512:	E042006B16ABDA0CCC0D7E533AC8BBA37E8BCCCDBEEFB393C214109999C79B5CD023ECE9CBB57BE37ED011AAF8C2237B46F1804819FD32A0F8A808715CB9D85F
Malicious:	false
Preview:	content KVAllmytube chrome/ contentaccessible=yes..overlay.chrome://browser/content/browser.xul.chrome://KVAllmytube/content/firefoxOverlay.xul..skin KVAllmytube classic/1.0 chrome/app/ ..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com\is-DO787.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	936
Entropy (8bit):	5.226361342131296
Encrypted:	false
SSDEEP:	24:2dl6YBw7sFaSx43STWVWLHu7No24p9WwuMFpqYA:cEY67s7xEWiZo24p9WwuipJA
MD5:	1754FA8A4277197E2006B5467F1FB8A6
SHA1:	3BD57C1592C776EB2A0C4D5A3E1BDA3F16AFAB37
SHA-256:	653ED93C5A13C2C1E9A9416CBF568196244F456333E5B2E345937B8367A2891F
SHA-512:	66978C3497C7173E701E119328D43DE6F68518D5C4F5B7A5641D9C21BC41B9D397ED4EA9DC0DE2C9C985DAE17950A9602FC9B98DB0CFD666E900BBC87174E7F4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#" .. xmlns:em="http://www.mozilla.org/2004/em-rdf#">.. <Description about="urn:mozilla:install-manifest"> ...<em:id>KVAllmytube@KeepVid.com</em:id>...<em:name>KeepVid Pro</em:name>...<em:version>6.0.0.8</em:version>...<em:description>Download YouTube and other online videos</em:description>...<em:creator>KeepVid</em:creator>...<em:homepageURL>http://www.KeepVid.com</em:homepageURL>...<em:iconURL>chrome://KVAllmytube/content/main.png</em:iconURL>...<em:type>2</em:type>...<em:unpack>true</em:unpack>...<em:aboutURL></em:aboutURL>...... <em:targetApplication>.. <Description>.. <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> firefox -->.. <em:minVersion>3.6</em:minVersion>.. <em:maxVersion>50.0</em:maxVersion>.. </Description>.. </em:targetApplication>.. </Description>..</RDF>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\META-INF\is-3GKR4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	121
Entropy (8bit):	5.373005130596893
Encrypted:	false
SSDEEP:	3:FwAPWXE0GLKfFZMd1NHUXv2WRhMNLKfF4dWqG0gSLRn:+AePGLKtCdrHUv2IELKt4dW5+
MD5:	3754AC0EDF57ED4DFB796D59BBFE431E
SHA1:	A0F451F91DEE1C5BD53BD7276F01540095526B4E
SHA-256:	72D631CE867AD0B64F5654F3423B9F888D6C5C178D5FB150E024FF704A895BB9
SHA-512:	B9385957A36005F2B9D393F3C2D333DD083831FE7315C8C8F40E2C2B4E5F964A5217AEF924B236737A606E1A06CD2832A9466AD2388751EF59F044E7093364CD
Malicious:	false
Preview:	Signature-Version: 1.0.MD5-Digest-Manifest: OPr1agy7dWxPZovLmNb1UQ==.SHA1-Digest-Manifest: nJ983Ab5njLva62P/mQa8EwnWmU=..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\META-INF\is-8FJGF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	2912
Entropy (8bit):	5.715664589030119
Encrypted:	false
SSDEEP:	48:/cHVZNSq946uMKRqIAWpYmh1be7XRwPDd4Suo3w:/cHVCPMKRqCpYEVebmPDWS3w
MD5:	38FAF56A0CBB756C4F668BCB98D6F551
SHA1:	9C9F7CDC06F99E32EF6BAD8FFE641AF04C275A65
SHA-256:	9DC399CE46EA94B9FA3EFA283CD86920F662E0F5930E14FFD3EE1984BD14E7C1
SHA-512:	4E37A167D796D1FE0033CD51480DF617E21303C24953CAB720BFD5519A052A5E1EE335CF1AB3322EB7309DA3FDE6A981E9488FC98BA69F561B43705CAFAC7795
Malicious:	false
Preview:	Manifest-Version: 1.0..Name: install.rdf.Digest-Algorithms: MD5 SHA1.MD5-Digest: F1T6ikJ3GX4gBrVGfx+4pg==.SHA1-Digest: O9V8FZLHdusqDE1aPhvaPxavqzc=..Name: chrome.manifest.Digest-Algorithms: MD5 SHA1.MD5-Digest: nbVav+cmu3DwwJTUFQkB2w==.SHA1-Digest: tQVp5pGvZYiyH/S3/hZjY4r0t50=..Name: chrome/AppMgr.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: RLFKFnl1JqpBRtZc2rW6dw==.SHA1-Digest: j72ysqCNXZrhfH2dW/wl5CP9O1E=..Name: chrome/Firefox.WSUtils.js.Digest-Algorithms: MD5 SHA1.MD5-Digest: kLS/KZqBU3uJJh5SfN6wLw==.SHA1-Digest: /C02sQi0qDlBiF2qLSonfpVsRYY=..Name: chrome/firefoxOverlay.xul.Digest-Algorithms: MD5 SHA1.MD5-Digest: 8PyAPSg8bMXMmKMUY+zK2g==.SHA1-Digest: X8EzLXKjII6yndz0rgBghNHnVEQ=..Name: chrome/main.png.Digest-Algorithms: MD5 SHA1.MD5-Digest: hmyFb/n6nC0cdHtojsRn8Q==.SHA1-Digest: wirozwixCG80IgwUiUxw3OAn+7o=..Name: chrome/Thumbs.db.Digest-Algorithms: MD5 SHA1.MD5-Digest: F8UoZpcuJLDCycQhUXcmbA==.SHA1-Digest: U7hUDWYkewyWLg4RxBxL2fGu+6o=..Name: chrome/app/KVAllmytube/FaceBook.plugin.1.1.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\META-INF\is-OLCR1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	data
Category:	dropped
Size (bytes):	4180
Entropy (8bit):	7.631716946416748
Encrypted:	false
SSDEEP:	96:1Sh0aflirCxmQikHs3LlPtn40cTy/aV7r:1EbflMxDkHaRPtn40cTy/Ur
MD5:	19552889C5F59CE3CB39FF5C08877357
SHA1:	6FCF24D736914A19564F788564AF5CDEE1E4AF84
SHA-256:	7BBCBB1A55313A62780FC0BBD731EEF645EB67BE1B3A947C8D85C4F502935945
SHA-512:	5EC27F4342FA38884D16835A7C97BD8A43DB8DDE2F94B0D2C02B54D632FBFE15248AE7D85C291317847D7DC53D4B7B1F6739F484459C98B36A207484D6D9FC09
Malicious:	false
Preview:	0..P...H.........A0..=...1.0...+......0....H..........0...0...........Z..^0....H........0..1.0...U....US1.0...U....Mozilla Corporation1/0-..U...&Mozilla AMO Production Signing Service110/..U...(production-signing-ca.addons.mozilla.org1402...H.......%services-ops+addonsigning@mozilla.com0...170205053915Z..220204053915Z0z1.0...U....Production1.0...U....US1.0...U....Mountain View1.0...U....Addons1.0...U....CA1 0...U....KVAllmytube@KeepVid.com0.."0....H.............0..............u.......\.......V...`..=..<<.v.g).@X...t.'....;.uN.A...1.L<'...a.0.....q.<:..W4.\|.."...U4.7..-.....v.b2.A+.....l.j=..Ul...w%..@".B5.@.j.E.<s....N..A.9.T.sJ{1..L."..g..;.u....._K}!.N]........F[dp...mn%..8..U.7....h...C.h-.1..u....Z..eFa.x.8......q.....J...2j..h1.........3y..t.hj...)Zd...O.......[.&.u....s..C....}..o>.I..#=.Hvq.`W.9...2......\|.V~!..Q..l.w....IFm...:&..+..;.l9.)..N.<\|?...(....@..p..v.tG6Nw..i{.P..4.j.-6.....*H.\W=./...#.jz.3..=..8.s...l#.R......Z.....!........0.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\app\KVAllmytube\css\is-FOC8B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	6.974847941200587
Encrypted:	false
SSDEEP:	192:vk5BG6ehrCYut7/kTvGGK/xzheBbw5dK6PtmNSeUekD4nS:vkfG19CYmkyGohIw57Ptk5n
MD5:	CAB770BE972D8A279A12578D51A5CE69
SHA1:	49525B280511CB2507F9205CCB6B4FCDA96DD3BD
SHA-256:	64DDF66D20A76B3B2BEE040DF38442B7DB27C18D8B25F8E958996965B8DC31BA
SHA-512:	2E3F33745CFEA1E719202186491B47CDE1AFAEAD12FD75D524809B3477C81CDDA7022FDE69B4A6574D49775C120E2CE9E5EEFF8F080634C6710525B852F6152F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\app\KVAllmytube\css\is-KLBMS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 140 x 340, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8309
Entropy (8bit):	7.892378611881201
Encrypted:	false
SSDEEP:	192:3G/nqsrrj3WMi/or7/qarodhIwayIvTa3XXW1:Wf7zVic/MmmCanG1
MD5:	CEB1D2295C0A367EE8D6625317542769
SHA1:	737D95059C3E6E70DE9DF7C9D89E17C8238CB10D
SHA-256:	C157CDA43C615A4E0331C795506888D46D03FD6200D4BDAA3BB8A47DB06DB390
SHA-512:	C007A4C01B99CD6DBD0FC7569FBCA34B25AD48CABC831C6614D0575DC852EFFD7C2CE64AD7374C9492243063237534559BD1F1459ED53F36C8FDB583B916CDC4
Malicious:	false
Preview:	.PNG........IHDR.......T.............tEXtSoftware.Adobe ImageReadyq.e<...kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:DE162C2787CAE311951CA28BCC767C32" xmpMM:DocumentID="xmp.did:A25948E6AF0011E69C849C616D2386CF" xmpMM:InstanceID="xmp.iid:A25948E5AF0011E69C849C616D2386CF" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:60e6890c-394f-4cf9-9f8b-591d42cc66fc" stRef:documentID="xmp.did:8C89A0E1CAC311E39B9BCC0663B7E4B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...>....IDATx..].x..>.j...B..d.....mBl......1.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\app\KVAllmytube\css\is-TDOGR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with very long lines (728), with CRLF line terminators
Category:	dropped
Size (bytes):	4526
Entropy (8bit):	5.232517639964482
Encrypted:	false
SSDEEP:	96:YItHRjPgPrCPxiuPVqPfPDuPqiiPTPXPEJPxipPmr:1tHx0rKxtVC3DGqtr/ElxES
MD5:	005FCC74767F71BDE128E8B47F38D7BC
SHA1:	D5BEC7B9FB525489F8C27946E740B059EF6FFE7B
SHA-256:	B552A3ACF22FB67640F0F5C10C36CAE39F7929308DB583266344FDAAC25A04C7
SHA-512:	1D54B8A10CFCF03CAE865BA3201ED8D58D83FD56E0DAC48DFE223E5EFA2494464CCE5C4F18622B72CB8DD1BA7BAB47867C2C830EB49AB1351BCF50DE5E647207
Malicious:	false
Preview:	/ws_KVAllmytube_btn/...KeepVid_KVAllmytube_toolbar body, .KeepVid_KVAllmytube_toolbar div, .KeepVid_KVAllmytube_toolbar dl, .KeepVid_KVAllmytube_toolbar dt, .KeepVid_KVAllmytube_toolbar dd,.KeepVid_KVAllmytube_toolbar ul,.KeepVid_KVAllmytube_toolbar ol,.KeepVid_KVAllmytube_toolbar li,.KeepVid_KVAllmytube_toolbar h1,.KeepVid_KVAllmytube_toolbar h2,.KeepVid_KVAllmytube_toolbar h3,.KeepVid_KVAllmytube_toolbar h4,.KeepVid_KVAllmytube_toolbar h5,.KeepVid_KVAllmytube_toolbar h6,.KeepVid_KVAllmytube_toolbar form,.KeepVid_KVAllmytube_toolbar input,.KeepVid_KVAllmytube_toolbar textarea,.KeepVid_KVAllmytube_toolbar p,.KeepVid_KVAllmytube_toolbar th,.KeepVid_KVAllmytube_toolbar td {margin:0;padding:0; -webkit-text-size-adjust:none;}.....KeepVid_KVAllmytube_toolbar {font:12px/1.2em Arial, Helvetica, sans-serif !important; width:140px; height:32px; top:-29px; right:0;}...KeepVid_KVAllmytube_down { height:32px; cursor:pointer;}...KeepVid_KVAllmytube_down .btn_down:hover { backgr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\app\KVAllmytube\is-CGGHM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7060
Entropy (8bit):	5.40219209589285
Encrypted:	false
SSDEEP:	192:bT4ExpIiqRpBWzy4dZ8aoBNykajmdm9nmVBTaz+xaxGxxryVKzrYUVIAN9PDpSkG:b0EsiGiZf9jKL2Hjy1tEAvvpvX7LoHVX
MD5:	EC4665C5AAB1E46C4A9906410E520B59
SHA1:	2EA50EBF4293DFA32580B0CB89B7C76E9057298A
SHA-256:	3F1390006020AEBE51976281CA5ABBC4C035EC2D859B29FF71EE220F7D766242
SHA-512:	7B89444C004D315BBEFC8DACDA84781D646B83E0295F87BDE97A88DADFB0D1F02CF34B2C6FDBB548A57F72BAF0C9428914857D1ED6D98CDA7CB028AEA898AEB3
Malicious:	false
Preview:	//alert('Youtube JS');..//;(function($){..//.var Plugin = $.KeepVid_KVAllmytube_Plugin;..//...//.//Plugin.Log = function(msg){..//.//.$.WSUtils.Log(msg);..//.//};..//...//...//}(jQueryWS));..function Browser(){...var Sys = {}; .. var ua = navigator.userAgent.toLowerCase(); .. var s; .. (s = ua.match(/msie ([\d.]+)/)) ? Sys.ie = s[1] : .. (s = ua.match(/firefox\/([\d.]+)/)) ? Sys.firefox = s[1] : .. (s = ua.match(/chrome\/([\d.]+)/)) ? Sys.chrome = s[1] : .. (s = ua.match(/opera.([\d.]+)/)) ? Sys.opera = s[1] : .. (s = ua.match(/version\/([\d.]+).*safari/)) ? Sys.safari = s[1] : 0;...return Sys;..}....var lowcasePageUrl = location.href.toLowerCase();.....if (lowcasePageUrl.indexOf('youtube.com') != -1) {... $(document).ready(function () {....var bro = Browser();....if ((!bro.chrome) && (!bro.firefox)){//IE......//setTimeout(function(){.....//.$.WSUtils.fix_wmode2transparent_swf().....//}, 2000);....}else{.....//$.WSUtils.fix_wmode2transparent_swf();.....}......});..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\app\KVAllmytube\is-IS27E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with very long lines (32341), with CRLF line terminators
Category:	dropped
Size (bytes):	96387
Entropy (8bit):	5.382196707881799
Encrypted:	false
SSDEEP:	1536:MPpEy5BMibZGOj/bEe8v+/UWf4IhvAuCh/jFkODZ2D5N9Rag0MOIdSZAgttoX5Yq:jIO4e2D5c4LgtDmLja98Hr9
MD5:	5C42C26751D76304D5F142E477CC0150
SHA1:	9D8638AEBE607352DA849A8618DB4714D704B16F
SHA-256:	46D3ABF61B33F92A80C0779131E53AB82DDC6CA4AA3CAAC51135BBE468DC9386
SHA-512:	B90E0E217B73FB1B6EA321193EF48FAD3AE88CC3A2D6E1BD10CF035DAB1FD81874B40ACB632DBB00E7FC71604CDBC63712F5C6EBF73A6B18871BC124E23837F0
Malicious:	false
Preview:	../! jQuery v1.11.0 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k="".trim,l={},m="1.11.0",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,func

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\app\KVAllmytube\is-J2LFM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Generic INItialization configuration [css]
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.700586370175625
Encrypted:	false
SSDEEP:	3:KU3GyzBLy/Q7DYPOxSbWXs5gLVCUhSovZYjvARkjQP/UgLuom/RkSio:F/9y/Q7DYGSTO0UhLZY0W0UTlRkSio
MD5:	035693A77ECFA20ABA60689426E8125F
SHA1:	45041BC872C3B78EC0471DB234503FB5DBDBEC07
SHA-256:	B37F9F3092189D6B848F4BBFE4C4F6AF0632DFC355BECB91ECED7880DCFBCA6C
SHA-512:	61C1B482781D5F7D4CF33359852512E3D81A823D20333960D79380C351772B575E295EC173FAD9374590EA406BD3A9931AFB8E82323A2F4553A183AACF790286
Malicious:	false
Preview:	[script]..js0=Keepvid.Main.user.js..js1=jquery-1.11.0.min.js..js2=Youtube.plugin.1.0.js..js3=FaceBook.plugin.1.1.js..[css]..css0=css/mytubebutton.css

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\app\KVAllmytube\is-SC5VJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8774
Entropy (8bit):	5.52828172872637
Encrypted:	false
SSDEEP:	192:4qtPtt9MFlJ7O2xi+TbKdalYqBQtazYnC:3t1tElJ7Li+6B2Q+d
MD5:	1BBEAEFB7F94377171A9A5B27F31405A
SHA1:	5D3FE66B7BCAE6FE729F09869CDBBE0167D250E1
SHA-256:	98184DFC37403EC78EE5F17466C831E08F0555E43C4C8D5B960939314481067D
SHA-512:	6AE8431AB508782CD041728174580D7102F2E5ABBE6EC10FC06BFD4E3C355BFDB0E0F046209F26F5EE5B286F0DA99E8D81D8A75B2AEB238EF6E5328947FA0053
Malicious:	false
Preview:	//alert('facebook begin');..//;(function($){..//.var Plugin = $.KeepVid_KVAllmytube_Plugin;..//.alert('dasdasdasd:'+Plugin);..//.Plugin.Log = function(msg){..//..$.WSUtils.Log(msg);..//.};..//.Plugin.FaceBookCheck = ..//...//}(jQueryWS));..function FaceBookCheck(targetDom){....//alert(targetDom.tagName);....var destUrl;....if(targetDom.tagName=='VIDEO' && location.href.indexOf('facebook.com')>=0){.....//................if($(targetDom).parent().parent()[0] !== null && $(targetDom).parent().parent()[0]!== undefined){......destUrl = $($(targetDom).parent().parent()).attr('keepvidHref');.....}.....if(destUrl == '' \|\| destUrl==null \|\| destUrl== undefined){......destUrl = FaceBoookInnerVideo(targetDom);......//....................if( $($(targetDom).parent().parent()[0]) !== null && $($(targetDom).parent().parent()[0]) != undefined){.......$($(targetDom).parent().parent()[0]).attr('keepvidHref',destUrl);......}.....}....}....else if(targetDom

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\app\KVAllmytube\is-U1KSU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18612
Entropy (8bit):	5.346033402846152
Encrypted:	false
SSDEEP:	384:hiIegrDmyQQqJgJP3ZtvVfBYLiMevmkaTU/CX:hiIegH9fB3nmkaTU/4
MD5:	E1B6D5205E000F0B41494A7B45818949
SHA1:	D64631EEF42D2DB7A91EFF95DA9E3FEA736FA931
SHA-256:	EEFFD15C2580B9D5D78F99256B4EA6057DDF20BB4FECA24278909A3341A46A15
SHA-512:	39AE4AE77BBCCBA662EDDA256C4E651B26B8C1416893C7A26CA6035F99973993715E4B0D58AEA4D0939760B7773E78753FB2768E1BBF8BD9A075F9CC36A39BB4
Malicious:	false
Preview:	//alert('Main JS');..var AttachStyleEnum = {...AttachOuterTopLeft: 0,...AttachOuterTopRight: 1,...AttachOuterBottomLeft: 2,...AttachOuterBottomRight: 3,...AttachInnerTopLeft: 4,...AttachInnerTopRight: 5,...AttachInnerBottomLeft: 6,...AttachInnerBottomRight: 7..};....;(function($) {...var Plugin = $.KeepVid_KVAllmytube_Plugin = function() {.. return this;.. };.. //var css = document.createElement('link');.. //css.href="http://127.0.0.1/css/mytubebutton.css";.. //css.rel="stylesheet";.. //css.type="text/css";.. //document.getElementsByTagName('head')[0].appendChild(css);.. //console.log(Plugin);...Plugin.Log = function(msg){....$.WSUtils.Log(msg);...};......Plugin.CalcToolBarPosition = function(flash, btnWidth, btnHeight, attachStyle){....var flash_top = flash.offset().top;....var flash_left = flash.offset().left;....var.flash_width = flash.width();....var.flash_height = flash.height();....var divLeft = divTop = 0;....switch (attachStyle)....{.....case Att

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\core\is-1JPVT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with very long lines (357), with CRLF line terminators
Category:	dropped
Size (bytes):	170101
Entropy (8bit):	5.1266862666828805
Encrypted:	false
SSDEEP:	3072:cgQWO242ffq+50dFhPGXVKDhA4kO9J3A7zUMpZXwFh++l7XKDtxp/Lq8LakxOAdk:thqmMFhPMKDqO9JQ7zPZgFh++Ytxp/LK
MD5:	8D6B86489CDB19F3E5F2A90E072BA474
SHA1:	1540B37FB00B3FA2B5FC670D003C3E6EC7369986
SHA-256:	E04E11DC19CA127E3B668492DCD4629106861CDFA0949E8855FF461C4C395899
SHA-512:	20D01E5765352A75345AD00FDB9EF185206F395E0685FA35FF13D883BE94F571487644ACD09F75F44037C23A9D01901274D2C64B486866CD62C29E000AB45625
Malicious:	false
Preview:	/!.. jQuery JavaScript Library v1.4.2.. * http://jquery.com/.. .. Copyright 2010, John Resig.. * Dual licensed under the MIT or GPL Version 2 licenses... * http://jquery.org/license.. .. Includes Sizzle.js.. * http://sizzlejs.com/.. * Copyright 2010, The Dojo Foundation.. * Released under the MIT, BSD, and GPL Licenses... .. Date: Sat Feb 13 22:33:48 2010 -0500.. */..(function( window, undefined ) {....// Define a local copy of jQuery..var jQuery = function( selector, context ) {....// The jQuery object is actually just the init constructor 'enhanced'....return new jQuery.fn.init( selector, context );...},.....// Map over jQuery in case of overwrite..._jQuery = window.jQueryWS,.....// Map over the $ in case of overwrite..._$ = window.$,.....// Use the correct document accordingly with window argument (sandbox)...document = window.document,.....// A central reference to the root jQuery(document)...rootjQuery,.....// A simple way to check for HTML strings or ID strings...// (

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\core\is-5GH20.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6009
Entropy (8bit):	5.591382986231939
Encrypted:	false
SSDEEP:	96:pYHhgOf/8NZrMmgEwpI8XRhzX/tVl6TRY+fbqId61GQLLs86xsxgpwyZGNSRh:ShgOf/wZomgEwpI8//tWhkm8Emsh
MD5:	C56F9B76A14D303BC82C25563521DBDA
SHA1:	19DD20A69D316F1BEED985E9959C57C10972790B
SHA-256:	66D3B9C04F1BDC7F5BF4352670965A0119152A405CFDBB1AEAC3FE6E8D4C0F3A
SHA-512:	19A140C08B308DE5514BAE238EEEB1C036F0C07A80B739EAA68F049C7833C975F6B0E1181CF297B399E3DDB2F8424006EEEBC7F550D7759745880B55A9AF9C48
Malicious:	false
Preview:	//WS..............//alert('jQuery.WSUtils Begin');..if(HasFixWmode2transparent_swf == undefined){...var HasFixWmode2transparent_swf = false;..}..;(function($){...var Plugin = $.WSUtils = function() {.. return this;.. };.......Plugin.fix_wmode2transparent_swf = function(){.....if (HasFixWmode2transparent_swf){.....return;....}....try{.....//alert("fix_wmode2transparent_swf");.....$("embed").each(function(i) {......//alert("fix_wmode2transparent_swf 1");......var elClone = this.cloneNode(true);......elClone.setAttribute("WMode", "Transparent");......$(this).before(elClone);......$(this).remove();.....});......// For object and/or embed into objects.....$("object").each(function (i, v) {......//alert("fix_wmode2transparent_swf 2");......var elEmbed = $(this).children("embed");......if(typeof (elEmbed.get(0)) != "undefined") {.......if(typeof (elEmbed.get(0).outerHTML) != "undefined") {........elEmbed.attr("wmode", "transparent");........$(this.outerHT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\core\is-G4OEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Generic INItialization configuration [Settings]
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.000186307499341
Encrypted:	false
SSDEEP:	6:9ytT4IqfBLDHGdIqfRRmQukPXUNjSUYGcEHduuAyvZYyBI5:ghtULDHG6UYhHpSkBYyBI5
MD5:	62D00EB8A09EAA4EBC8FE5FE3B6D3699
SHA1:	3AE1590B86A5680EF1D80965F45B04D684E919E2
SHA-256:	DA37CBB8192F979085015AB9514F5D66E8F46C88928403159FDD717AA1B55737
SHA-512:	8D51B718B58711759BF01DE96C3E23E4DEA2C24E88E280A793B627211C31B73810C4224F32E05745EE1205A163A0E7A0EE0BD462293B93ACAC40D51033A6164E
Malicious:	false
Preview:	[info]..AppName=Javascript Framework Core..Version=0.0.0.1..Description=Javascript Framework Core..[Settings]..enable=1..[script]..js0=jquery-1.4.2.js..js1=jquery.base64.js..js2=jquery.relocation.js..js3=WSUtils.js

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\core\is-GLJGA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	4.949216031331948
Encrypted:	false
SSDEEP:	24:IEqKcM9xDlCi0m4qX+4YqY9+AlVjpS/7rxvCvldM/:IEv9xDlIm4qX+4YqYwWVjpSTrxvCvldW
MD5:	5EA3814F607156F99736B5815E99E879
SHA1:	EE50C67A70DE38FA580A3E025931D8C43C52DE91
SHA-256:	FE442880A1FE9E9679CE3656297280844D1A480B4FDC41B65974757F1CC59F3D
SHA-512:	F4984435CEC1E082BFCC56286DFE22D9EFBA7F3C392D992C15E74D99AD59B073F95134A8EEB4E9A259FCBED1EF2A66A8A924BEAB03269D9D32851C838893330A
Malicious:	false
Preview:	..;(function($){...jq_relocation = $.relocation = $.extend( $.relocation, {} );......jq_relocation['elems'] = $([]);......jq_relocation['timeout_id'];.......jq_relocation['str_setTimeout'] = 'setTimeout';......jq_relocation['str_data'] = 'currentLocation';......jq_relocation['delay' ] = 10;......jq_relocation['add'] = function(elem, callback){........this.elems.push({e: elem, c: callback, data: { l: elem.offset().left, t: elem.offset().top }});........if ( this.elems.length == 1 ) {..... this.loop();......}.......};.......jq_relocation['loop'] = function(){..... this.timeout_id = window['setTimeout'](function(){..........for.(i in jq_relocation['elems']){..........if (i < jq_relocation['elems'].length){.......var item = jq_relocation['elems'][i];.......var elem = item.e;.......var callback = item.c;.......aTop = elem.offset().top;.......aLeft = elem.offset().left;.........data = item.data;.........if ( (aLeft != data.l) \|\| (aTop != data.t )) {........item.data = {l: elem.offset().left,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\core\is-U2TMU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Algol 68 source, ASCII text
Category:	dropped
Size (bytes):	4500
Entropy (8bit):	4.706024482154792
Encrypted:	false
SSDEEP:	96:y+veaO7wyO7VUtro9mLp/iZZe8naRhIMRnRf2MTEcKF6ite0GA:zvs7jO39mkHe++IK2MTY6ite0GA
MD5:	B8197069D7185AF5C5BB422B40D57E49
SHA1:	AD9614829FC64FBC62F3B24331F5E77C8EDC1918
SHA-256:	216E6672AAF0C1ED6922CCAE984853132AE6CF545ED4820D6660EE509A30D5B8
SHA-512:	1486BBD5B47A6FD80631A5A2B91D020F90DABEC55145B89AF16FC68FC130AA4134974B49757635E402181579852F7F2FFBD3691939D0735B2DDC425A22E9198E
Malicious:	false
Preview:	/!. jquery.base64.js 0.1 - https://github.com/yckart/jquery.base64.js. * Makes Base64 en & -decoding simpler as it is.. . Based upon: https://gist.github.com/Yaffle/1284012. . Copyright (c) 2012 Yannick Albert (http://yckart.com). * Licensed under the MIT license (http://www.opensource.org/licenses/mit-license.php).. * 2013/02/10. /.;(function($) {.. var b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",. a256 = '',. r64 = [256],. r256 = [256],. i = 0;.. var UTF8 = {.. /. * Encode multi-byte Unicode string into utf-8 multiple single-byte characters. * (BMP / basic multilingual plane only). . Chars in range U+0080 - U+07FF are encoded in 2 chars, U+0800 - U+FFFF in 3 chars. . @param {String} strUni Unicode string to be encoded as UTF-8. * @returns {String} encoded string. */. encode: function(strUni) {. // use regular expres

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\is-7TLVS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	7.293834702778798
Encrypted:	false
SSDEEP:	384:hcS88mj3HfQ02v8f3ZATQsBW12OOtjkp:h8j3I0223ZAH8YU
MD5:	17C52866972E24B0C2C9C4215177266C
SHA1:	53B8540D66247B0C962E0E11C41C4BD9F1AEFBAA
SHA-256:	82BDCD0C96FBA27A5E785845DCFF6869B8797F50335DA88C511D004373AE16AF
SHA-512:	99D1BCED65DCF46C930D072F0860281D2F507903D1C750E10B644D88F71B615A6218B309B20C444FD52C87B9CC97F2007D87552757CFA4B225916BAFA8D2105F
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\is-BD685.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6380
Entropy (8bit):	5.3315449914327155
Encrypted:	false
SSDEEP:	96:jjwr+KIROWh8ZjdgMpSSfDnIzw7SO+2Lw7snFjBM:nn9KRgKkc7i72M
MD5:	44B14A16797526AA4146D65CDAB5BA77
SHA1:	8FBDB2B2A08D5D9AE17C7D9D5BFC25E423FD3B51
SHA-256:	1F18FC098C94203A40C8CA15AE99AE19B4FAF80E259C2C81F73236491A7C667A
SHA-512:	838BE675F058DAD2F88DB508E0FECB8EF83E46A670BADC3EB09A7DD71B8B28FD9D0CEEDC84D5CC565157FBE99FAAFAB9BCBAC587B6EE36A1D0A2F575795088FA
Malicious:	false
Preview:	//FireFoxPuglinUtils.Log('AppMgr Begin');..function CreateAppMgr(aPluginID, aPluginPath){...var PluginId = aPluginID;...var PluginPath = aPluginPath;...var JSList = [];...var CSSList = [];...//FireFoxPuglinUtils.Log('CreateAppMgr Begin');....var LoadApp = function(event){......//FireFoxPuglinUtils.Log('LoadApp Begin');.....function newGuid() {.....var guid = "";.....for (var i = 1; i < 32; i++) {......var n = Math.floor(Math.random() * 16.0).toString(16);......guid += n;......if ((i == 8) \|\| (i == 12) \|\| (i == 16) \|\| (i == 20)) guid += "-";.....}.....return guid;....};......function LoadCSS(fileName){.....try{......//FireFoxPuglinUtils.Log('LoadCSS:' + fileName);......var fileref = gBrowser.contentDocument.createElement("style");......fileref.setAttribute("id", newGuid());......fileref.setAttribute("type", "text/css");......fileref.innerHTML = FireFoxPuglinUtils.FileManager.Read(fileName);.......gBrowser.contentDocument.getElementsByTagName("head")[0].appendChild(fileref);......//alert

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\is-JKEO1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	5.060969840831249
Encrypted:	false
SSDEEP:	6:JiMVBd/DvuK8qmc4ciN7CccLqpkAqJmW/mcMMkAqJmW/ko8TU:MMHdzz8qXoCtLGJqJmW9MMJqJmWJ8A
MD5:	F0FC803D283C6CC5CC98A31463ECCADA
SHA1:	5FC1332D72A3208EB29DDCF4AE006084D1E75444
SHA-256:	2F1053CE31E309A983A1A8C06382A5670CCD4F4B737E275E941C7584EEFF67B0
SHA-512:	4B6F8690802717D0777ECFFE476E6C631C4671919DD8420E710738E07C77BAE31767C6195A9D697C0AA02C83DF10B1E348903562FFB580C45618D35AA5FF9D78
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8"?>.<overlay id="flash-overlay". xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">..<script type="text/javascript" src="Firefox.WSUtils.js"/>.. ..<script type="text/javascript" src="AppMgr.js"/>.</overlay>.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\is-S0QKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10765
Entropy (8bit):	7.935018555387737
Encrypted:	false
SSDEEP:	192:NknHAxs5o+PFCAs5vXeWqF0hqm++Icf23GgIGmt/KLKLxiZe4vpi8:unHAxs5/F9s5vXgGhq4f29IGEKLKLxin
MD5:	866C856FF9FA9C2D1C747B688EC467F1
SHA1:	C22AE8CF08B1086F34220C14894C70DCE027FBBA
SHA-256:	9CA4DD534EB030529415E7B82A65D78BC8C65F41E7D63C72DD973C6BED1B26A1
SHA-512:	022E152231C18A02E8690A52A54CF1C6D7F2835F54C79F1C99EB0EFC5A673DEA97B847901B1A39D59D2964EB57A4ACA26AB1594A2128BAD77CD1266E00887AB4
Malicious:	false
Preview:	.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmpMM:OriginalDocumentID="adobe:docid:imageready:68463a2a-8375-11e1-9c22-f6d913fd0c31" xmpMM:DocumentID="xmp.did:DFEB7F47B93B11E68A7790ECC3E6F38C" xmpMM:InstanceID="xmp.iid:DFEB7F46B93B11E68A7790ECC3E6F38C" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:69669afd-0909-490c-94d1-2ba7cd014402" stRef:documentID="xmp.did:427C47B508206811871FA9AF76262391"/> <dc:title> <rdf:Alt/> </dc:title> </rdf

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\chrome\is-UGSLT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4143
Entropy (8bit):	5.223537823924162
Encrypted:	false
SSDEEP:	96:td5K+NwkuA/Acpe0wGKlTG3j7IsDXHO1P:tzlTve1W7LLO1P
MD5:	90B4BF299A81537B89261E527CDEB02F
SHA1:	FC2D36B108B4A83941885DAA2D2A277E956C4586
SHA-256:	1FFDFDFF739F2C3597CB505C83729A09CA9D4E9B66AC27724C32E12786C699F6
SHA-512:	5908A1048579AD06C8A04DE9AC4772A472A73203325E2F2BA8FA183B708E93EEF1DEF29C073A088E55D2B303756CF1B5B7E87506EB47E864BD774F41D9F92F95
Malicious:	false
Preview:	//alert('WSPlugin.Firefox.FileManager Begin');..function GetFireFoxPuglinUtils(){......if (_ConsoleService == undefined ){....var _ConsoleService = Components.classes["@mozilla.org/consoleservice;1"]......getService(Components.interfaces.nsIConsoleService);...};......this.Log = function(msg, alertMsg){......//_ConsoleService.logStringMessage(msg);.......//if (alertMsg == true){....//.alert(msg);....//};...};......this.FileManager = new function(aLog){....Log = aLog;....this.Write = function (File, Text)....{.....if (!File) return;.....try{......const unicodeConverter = Components.classes["@mozilla.org/intl/scriptableunicodeconverter"]........createInstance(Components.interfaces.nsIScriptableUnicodeConverter);........unicodeConverter.charset = "UTF-8";........Text = unicodeConverter.ConvertFromUnicode(Text);......const os = Components.classes["@mozilla.org/network/file-output-stream;1"]...... .createInstance(Components.interfaces.nsIFileOutputStream);......os.init(File, 0x02 \| 0x08 \| 0

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\is-D76KL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	936
Entropy (8bit):	5.226361342131296
Encrypted:	false
SSDEEP:	24:2dl6YBw7sFaSx43STWVWLHu7No24p9WwuMFpqYA:cEY67s7xEWiZo24p9WwuipJA
MD5:	1754FA8A4277197E2006B5467F1FB8A6
SHA1:	3BD57C1592C776EB2A0C4D5A3E1BDA3F16AFAB37
SHA-256:	653ED93C5A13C2C1E9A9416CBF568196244F456333E5B2E345937B8367A2891F
SHA-512:	66978C3497C7173E701E119328D43DE6F68518D5C4F5B7A5641D9C21BC41B9D397ED4EA9DC0DE2C9C985DAE17950A9602FC9B98DB0CFD666E900BBC87174E7F4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#" .. xmlns:em="http://www.mozilla.org/2004/em-rdf#">.. <Description about="urn:mozilla:install-manifest"> ...<em:id>KVAllmytube@KeepVid.com</em:id>...<em:name>KeepVid Pro</em:name>...<em:version>6.0.0.8</em:version>...<em:description>Download YouTube and other online videos</em:description>...<em:creator>KeepVid</em:creator>...<em:homepageURL>http://www.KeepVid.com</em:homepageURL>...<em:iconURL>chrome://KVAllmytube/content/main.png</em:iconURL>...<em:type>2</em:type>...<em:unpack>true</em:unpack>...<em:aboutURL></em:aboutURL>...... <em:targetApplication>.. <Description>.. <em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id> firefox -->.. <em:minVersion>3.6</em:minVersion>.. <em:maxVersion>50.0</em:maxVersion>.. </Description>.. </em:targetApplication>.. </Description>..</RDF>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\kvallmytube@keepvid.com_xpi\is-QFHJP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.700752995946208
Encrypted:	false
SSDEEP:	3:C1JL2gFmK9afuiRzWeeqFVK6c2us1pQiaFKu0Gc2gKJmLsidjgBFDL2gFbWLU8Fk:C1pmMmlz8Ebab0G65d+Fnbjfn
MD5:	9DB55ABFE726BB70F0C094D4150901DB
SHA1:	B50569E691AF6588B21FF4B7FE1663638AF4B79D
SHA-256:	E24164EF44937299D09D725A551FC3B8E8AA4F29BAD84239A153A16EA948445A
SHA-512:	E042006B16ABDA0CCC0D7E533AC8BBA37E8BCCCDBEEFB393C214109999C79B5CD023ECE9CBB57BE37ED011AAF8C2237B46F1804819FD32A0F8A808715CB9D85F
Malicious:	false
Preview:	content KVAllmytube chrome/ contentaccessible=yes..overlay.chrome://browser/content/browser.xul.chrome://KVAllmytube/content/firefoxOverlay.xul..skin KVAllmytube classic/1.0 chrome/app/ ..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CBSProductClient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.435790700326355
Encrypted:	false
SSDEEP:	1536:D1mXeSmaxr2+m+/llW+R86PM7wxvsh6csX5Yn56x/EcvhCZ5EG+xPLPz:D1mgaxrjm3t6q8v0ghCTEG+xPLb
MD5:	FE1A434ABC02254927DC0F7F5810141D
SHA1:	569336BCB1A32562105E69FFC6614A2ABA3D2FA0
SHA-256:	DDE612A05CDD3B01077B38382986D4DD5CA629BE32DF607A6229743C2B548B5F
SHA-512:	AD69EE6CB590E673DED8E8EEB4E7293925D32D95731454217CF1186C9345507A7BF69F7024DBD64F3BA9DD916FEF676F3F059B9CC48FAD0B0197A0E41767C19E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+...J..J..J..2v..J...g..J..2g..J..2`..J..2p..J..J.J..2i..J..2q..J...w..J..2r..J.Rich.J.........PE..L......W...........!.....d...................................................p......1$....@.............................. ..h...d....0.......................@.........................................@............................................text...Tb.......d.................. ..`.rdata..yi.......j...h..............@..@.data...\|1..........................@....rsrc........0......................@..@.reloc...#...@...$..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DisplayCategory.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4651
Entropy (8bit):	5.022475642992595
Encrypted:	false
SSDEEP:	96:FQ83b8E3UmD8uDPg7z/5SBSBtj1yuRpF1W6zTHjxz7Aqsw75eKEWLiZbQG0P7fyy:SHigJ5B7bVUM
MD5:	6E1A12162D3DCD8EFEC133130C2FD17D
SHA1:	B505860F73EDE2DE6279009E5998635FFD493454
SHA-256:	284949660F9CACB29B2D76B4B2FE96318A70B41850ED2A3B884C136472408DD0
SHA-512:	20457B7ABD8A504A859C09E5A40000BE19CB49D9774ADF02C56616CBD96BB11415030EC5CB6E3561B5C19D5E27E2C4D1242587073E90F760F3D98955ED37CBCB
Malicious:	false
Preview:	<FormatType>.. <displaycategory id="1001" title="iPad 3,4,Air" type="1" icon="Iconipad4" EncParamInfoID="10001001" />.. <displaycategory id="1002" title="iPad 1,2" type="1" icon="Iconipad1" EncParamInfoID="10002001" />.. <displaycategory id="1003" title="iPad mini" type="1" icon="Iconipadmini" EncParamInfoID="10003001" />.. <displaycategory id="1004" title="iPhone7(P)" type="1" icon="IconiPhone7p" EncParamInfoID="10004001" />.. <displaycategory id="1005" title="iPhone6s(P),6" type="1" icon="IconiPhone6s" EncParamInfoID="10005001" />.. <displaycategory id="1006" title="iPhone 5s,5c,5" type="1" icon="IconiPhone5" EncParamInfoID="10006001" />.. <displaycategory id="1007" title="iPhone 4,4S" type="1" icon="IconiPhone4S" EncParamInfoID="10007001" />.. <displaycategory id="1008" title="iPhone 1-3GS" type="1" icon="IconiPhone" EncParamInfoID="10008001" />.. <displaycategory id="1009" title="iPod Touch" type="1" icon="IconiPodTouch5" EncParamInfoID="10009001" />.. <displaycategory id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\Chaffing.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10525
Entropy (8bit):	4.70221281579584
Encrypted:	false
SSDEEP:	192:BvhQHvpjsmA137F8Uu33m0YiCrAl7U3l4lFAbc0Q3mHSE7xTTq:xhepjsmGFfhioABU3Ssbc3mHk
MD5:	6F6033C18B9D37D95BC7A867D3E70344
SHA1:	2C54658D7CBE4B679F4EF125FDFD4B9F5A9DD190
SHA-256:	8074F60BE56A45A6F9D9BB455010BCA2F5255D52E82A15B2051869BC7C833CAB
SHA-512:	67010AFF96A8F1F7A4E096CB5657DE3FA6F63FE4E005C4E4BEAA035D5FCC80CBBF034F60B02C97421ADC1524C561C655BCA36B870EE161DAACF76630C09AB5C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Chaffing.py : chaffing & winnowing support..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling, Barry A. Warsaw, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTIO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\KDF.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5192
Entropy (8bit):	4.953614078186331
Encrypted:	false
SSDEEP:	96:k0FQHvoUH2kuHrxOBlHsFJncL9IW6SdgitvN:VQHvarxoSxHW6egixN
MD5:	FA9210FC25748333F79FBECEE661F8F1
SHA1:	511297CB2D1DE2C77FCCD241C51EDFF36DD3B710
SHA-256:	9ADF874EA51E54DD59D0B618F3E47BBB2E4DCF4EC807915388D8396C34170E1D
SHA-512:	350F7917B9BCF1CE5925A94025D14BBAB025C908A31A760B3FC9261341B0B5238748E3E9EC8CC72EC3C4806A6AE47CA14F14CD5CBBC2EE9C91DB9F3B4D41AA51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# KDF.py : a collection of Key Derivation Functions..#..# Part of the Python Cryptography Toolkit..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.20314444939321
Encrypted:	false
SSDEEP:	48:ozC0f4QHlsyHIO5d3D1Fyt01GHsN1Q1Py+:G0QHzJDKeGMngZ
MD5:	C7831DDDE32E19B274C608C1B0E1A096
SHA1:	E0FFB1819EF87CB2BB7F1DA66971D6B5DBA96588
SHA-256:	9C8B8D93AB52F579B81EC3A19103C8C86FD5302813D8CC06B198DADAC8D7AED8
SHA-512:	DD4C733DE2D008823BA8A93F88729201F6B5BB5F32756D0F457D23FB5CD10B53BA55CF41D4ADAD1E6F5BB13BB9BEE0D3E90468420DC8E48ACA4B014BF32A3A7F
Malicious:	false
Preview:	# -- coding: utf-8 --.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# ===================================================================.."""Cryptograp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\is-EP4KV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.20314444939321
Encrypted:	false
SSDEEP:	48:ozC0f4QHlsyHIO5d3D1Fyt01GHsN1Q1Py+:G0QHzJDKeGMngZ
MD5:	C7831DDDE32E19B274C608C1B0E1A096
SHA1:	E0FFB1819EF87CB2BB7F1DA66971D6B5DBA96588
SHA-256:	9C8B8D93AB52F579B81EC3A19103C8C86FD5302813D8CC06B198DADAC8D7AED8
SHA-512:	DD4C733DE2D008823BA8A93F88729201F6B5BB5F32756D0F457D23FB5CD10B53BA55CF41D4ADAD1E6F5BB13BB9BEE0D3E90468420DC8E48ACA4B014BF32A3A7F
Malicious:	false
Preview:	# -- coding: utf-8 --.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# ===================================================================.."""Cryptograp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\is-JE6PN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5192
Entropy (8bit):	4.953614078186331
Encrypted:	false
SSDEEP:	96:k0FQHvoUH2kuHrxOBlHsFJncL9IW6SdgitvN:VQHvarxoSxHW6egixN
MD5:	FA9210FC25748333F79FBECEE661F8F1
SHA1:	511297CB2D1DE2C77FCCD241C51EDFF36DD3B710
SHA-256:	9ADF874EA51E54DD59D0B618F3E47BBB2E4DCF4EC807915388D8396C34170E1D
SHA-512:	350F7917B9BCF1CE5925A94025D14BBAB025C908A31A760B3FC9261341B0B5238748E3E9EC8CC72EC3C4806A6AE47CA14F14CD5CBBC2EE9C91DB9F3B4D41AA51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# KDF.py : a collection of Key Derivation Functions..#..# Part of the Python Cryptography Toolkit..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Protocol\is-O5JLA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10525
Entropy (8bit):	4.70221281579584
Encrypted:	false
SSDEEP:	192:BvhQHvpjsmA137F8Uu33m0YiCrAl7U3l4lFAbc0Q3mHSE7xTTq:xhepjsmGFfhioABU3Ssbc3mHk
MD5:	6F6033C18B9D37D95BC7A867D3E70344
SHA1:	2C54658D7CBE4B679F4EF125FDFD4B9F5A9DD190
SHA-256:	8074F60BE56A45A6F9D9BB455010BCA2F5255D52E82A15B2051869BC7C833CAB
SHA-512:	67010AFF96A8F1F7A4E096CB5657DE3FA6F63FE4E005C4E4BEAA035D5FCC80CBBF034F60B02C97421ADC1524C561C655BCA36B870EE161DAACF76630C09AB5C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Chaffing.py : chaffing & winnowing support..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling, Barry A. Warsaw, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTIO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\DSA.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14068
Entropy (8bit):	4.742252642796143
Encrypted:	false
SSDEEP:	192:zwdQHvFc3IZvrhKIFfN4Ey3zsZCfHv74i6cMPEs/4YlRT/19cKD05FaIMxK6XK4N:zUeK3oV+sK9yEswYRsFapk66Fmog
MD5:	24E6F5C7FF35E16B6EFC1E5E9A44D772
SHA1:	CF89E582FB50BCA6216D5FEFAC44B897361DF965
SHA-256:	C955FB61262DE3345D0A88D03A0DBEBE94E984C4C7F847B5616C74D5A2844DDA
SHA-512:	304075A8FCF92857BFA74E735F08BE52968860D80D944566AB44FC7794B47650DCEEB285BDBE7532A1CB55DE056268D0A50663841B397965770797A5FC4A451F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: utf-8 --..#..# PublicKey/DSA.py : DSA signature primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\ElGamal.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13212
Entropy (8bit):	4.845431272637524
Encrypted:	false
SSDEEP:	192:bwQHd5r+IHWhkD4eIUnqgL0XNaKwQUdOO1dt3dEqvTYdJ5ARdvaEo74Qtpfc74Qf:koHHAk3A9JxUdOO1d1dbcdJydC6qFC7
MD5:	D32F0AEEA70460D4C6BB36AD97D60C7C
SHA1:	41E8ECF13A0F961459C14E3E7C7C6C605E26F071
SHA-256:	1D565F609CA5CDA92F009F375B4571572C95A143FE78697967AFD63399186A88
SHA-512:	40245042438A22C92CBA3240322CBB3A28769537E1E285042337D830082A4A1F43EB9727128CCE9FB27F12A1AE3176F477A72D2920DA0610344A004FE9F8B301
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#.# ElGamal.py : ElGamal encryption/decryption and signatures.#.# Part of the Python Cryptography Toolkit.#.# Originally written by: A.M. Kuchling.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\RSA.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	30612
Entropy (8bit):	4.707755393041815
Encrypted:	false
SSDEEP:	384:HUee6QP3ikxK2g2oa9EOPb1vrN2uPJFatRMq3QYs6r/Y2NBYTRsSirQ:HHNkSOBZzHaYq3xxr3YT9iU
MD5:	BFA54B5D5B5F17F7881B2E21096DFB47
SHA1:	6F09E399D0999C35A90B9A1F8E3AF1BEBFDCCF6D
SHA-256:	5B1050D2D038B1AB47B36B1292912F3D700B8CAD9EEA4051261D7C986FAB16FE
SHA-512:	5A8EFB2DA5298F3DE39B0453E0C52CD43CE3BE0F987FFB157DA8CFD3B5FEFC1B872B24D27179C056F76DEC558A735EB6932E674DC861F385949F2F3ACA08DD70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: utf-8 --..#..# PublicKey/RSA.py : RSA public key primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\_DSA.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3585
Entropy (8bit):	5.142752058102014
Encrypted:	false
SSDEEP:	96:yVFQHvo4KhbDKHG6O7KiKz6ao0Tf/R46o4oeG:oQHvOY8KiK+aoop46o4oeG
MD5:	449E73E895450A0045E31B727E00ADBA
SHA1:	BA84F1E70FAD32887AC78BD16FF83BA0C3F16471
SHA-256:	1C4C540053E8560B7F75CF9EFF52D8684BA27C148E62E9EA5C30DE4643783573
SHA-512:	131679D8822525A26912B19B0C6C490236E9A3C5A6F0560554734F1CA71080D8FF203F19FE879927E2489A1325718AC00990CA05A6FC3D1A13D9EED8813A54A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	..#..# DSA.py : Digital Signature Algorithm..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling, Paul Swartz, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\_RSA.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2841
Entropy (8bit):	5.163176565620244
Encrypted:	false
SSDEEP:	48:zOlIB0jcQHMsvI/S3oCFt+1n+2n7zGEzGRlG8eYtGNG6CxjR8y+GNGIqTTGNGshN:zVFQHvo4KnD7KEKRwtNo6CxjJboIqWoy
MD5:	CBFF6F6F601F2AC22D8A27CF4F6AC998
SHA1:	1F4604B67CA55D0486411899AF7AA42D3590B6B4
SHA-256:	260C5FB059F71F80C757C2FB21267A6EF253655094ED16E7889D673ADE21E48B
SHA-512:	D293A03AAECDA70848F74B52FCDC16A4833F17031A0EA2A52DF2EE1F47B614A3C5B4CF341F3982A1A62AEE87208F006289EEE4D309EAE74FEC577A00F66B7848
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# RSA.py : RSA encryption/decryption..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling, Paul Swartz, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE S

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	4.93755420651679
Encrypted:	false
SSDEEP:	48:ozC0f4QHlsyHIO5d3D1FbmQhDf1Bkyrq111YVE:G0QHzJDiGmb/9
MD5:	C0E2869728D62521BB8D80956D00FF64
SHA1:	BFC42ECED5DF070984E9FB4E4121BC8B5FD045D4
SHA-256:	7531596DE9C4A7DF2F1259AB93DBEE4F65FD22A2F78C71CAB6AE29213A496535
SHA-512:	5ABA5F1BBEB5E5EA05C0E5655C1AABAD1CE3F40B83CE1DC7E0D5C74154259CF0031C26573647467BF1E45DC79026D42FFCCBCFA79BA1A842A72E7D054E8999B8
Malicious:	false
Preview:	# -- coding: utf-8 --.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# ===================================================================.."""Public-key

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\_slowmath.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6596
Entropy (8bit):	4.83380815357554
Encrypted:	false
SSDEEP:	96:rFwfFQHvolHwoFQ4iniC/gXWftGvdyt61A6YhoXYsjZGBPkDnE4FAn2ICKeQnNRo:RwdQHvOwQinp6Dt1z3svhpBE
MD5:	10B3A3119AD32C8EDD5553F8EE234C5D
SHA1:	44A88666C94F201563CB027C51D91F05CF0842EA
SHA-256:	9C53EC877CD462ED01FD3AB709D69F42D1FB4C51CF64A060802CACAB29C633ED
SHA-512:	1D691D87EC534B2B3883A08DE7D1999E3E09A5B3FDEFCA4CE69A8AFF64DEDD73E715951055B3BD57CBC69FD27D944D5DA9BC2B0FB81CF1D03D28236738EFEB64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: utf-8 --..#..# PubKey/RSA/_slowmath.py : Pure Python implementation of the RSA portions of _fastmath..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OU

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-3B835.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6596
Entropy (8bit):	4.83380815357554
Encrypted:	false
SSDEEP:	96:rFwfFQHvolHwoFQ4iniC/gXWftGvdyt61A6YhoXYsjZGBPkDnE4FAn2ICKeQnNRo:RwdQHvOwQinp6Dt1z3svhpBE
MD5:	10B3A3119AD32C8EDD5553F8EE234C5D
SHA1:	44A88666C94F201563CB027C51D91F05CF0842EA
SHA-256:	9C53EC877CD462ED01FD3AB709D69F42D1FB4C51CF64A060802CACAB29C633ED
SHA-512:	1D691D87EC534B2B3883A08DE7D1999E3E09A5B3FDEFCA4CE69A8AFF64DEDD73E715951055B3BD57CBC69FD27D944D5DA9BC2B0FB81CF1D03D28236738EFEB64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: utf-8 --..#..# PubKey/RSA/_slowmath.py : Pure Python implementation of the RSA portions of _fastmath..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OU

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-8AM0C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	30612
Entropy (8bit):	4.707755393041815
Encrypted:	false
SSDEEP:	384:HUee6QP3ikxK2g2oa9EOPb1vrN2uPJFatRMq3QYs6r/Y2NBYTRsSirQ:HHNkSOBZzHaYq3xxr3YT9iU
MD5:	BFA54B5D5B5F17F7881B2E21096DFB47
SHA1:	6F09E399D0999C35A90B9A1F8E3AF1BEBFDCCF6D
SHA-256:	5B1050D2D038B1AB47B36B1292912F3D700B8CAD9EEA4051261D7C986FAB16FE
SHA-512:	5A8EFB2DA5298F3DE39B0453E0C52CD43CE3BE0F987FFB157DA8CFD3B5FEFC1B872B24D27179C056F76DEC558A735EB6932E674DC861F385949F2F3ACA08DD70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: utf-8 --..#..# PublicKey/RSA.py : RSA public key primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-CQ7BI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3585
Entropy (8bit):	5.142752058102014
Encrypted:	false
SSDEEP:	96:yVFQHvo4KhbDKHG6O7KiKz6ao0Tf/R46o4oeG:oQHvOY8KiK+aoop46o4oeG
MD5:	449E73E895450A0045E31B727E00ADBA
SHA1:	BA84F1E70FAD32887AC78BD16FF83BA0C3F16471
SHA-256:	1C4C540053E8560B7F75CF9EFF52D8684BA27C148E62E9EA5C30DE4643783573
SHA-512:	131679D8822525A26912B19B0C6C490236E9A3C5A6F0560554734F1CA71080D8FF203F19FE879927E2489A1325718AC00990CA05A6FC3D1A13D9EED8813A54A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	..#..# DSA.py : Digital Signature Algorithm..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling, Paul Swartz, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-DSONI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14068
Entropy (8bit):	4.742252642796143
Encrypted:	false
SSDEEP:	192:zwdQHvFc3IZvrhKIFfN4Ey3zsZCfHv74i6cMPEs/4YlRT/19cKD05FaIMxK6XK4N:zUeK3oV+sK9yEswYRsFapk66Fmog
MD5:	24E6F5C7FF35E16B6EFC1E5E9A44D772
SHA1:	CF89E582FB50BCA6216D5FEFAC44B897361DF965
SHA-256:	C955FB61262DE3345D0A88D03A0DBEBE94E984C4C7F847B5616C74D5A2844DDA
SHA-512:	304075A8FCF92857BFA74E735F08BE52968860D80D944566AB44FC7794B47650DCEEB285BDBE7532A1CB55DE056268D0A50663841B397965770797A5FC4A451F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: utf-8 --..#..# PublicKey/DSA.py : DSA signature primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-FSVIP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2841
Entropy (8bit):	5.163176565620244
Encrypted:	false
SSDEEP:	48:zOlIB0jcQHMsvI/S3oCFt+1n+2n7zGEzGRlG8eYtGNG6CxjR8y+GNGIqTTGNGshN:zVFQHvo4KnD7KEKRwtNo6CxjJboIqWoy
MD5:	CBFF6F6F601F2AC22D8A27CF4F6AC998
SHA1:	1F4604B67CA55D0486411899AF7AA42D3590B6B4
SHA-256:	260C5FB059F71F80C757C2FB21267A6EF253655094ED16E7889D673ADE21E48B
SHA-512:	D293A03AAECDA70848F74B52FCDC16A4833F17031A0EA2A52DF2EE1F47B614A3C5B4CF341F3982A1A62AEE87208F006289EEE4D309EAE74FEC577A00F66B7848
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# RSA.py : RSA encryption/decryption..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling, Paul Swartz, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE S

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-MHV7O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13212
Entropy (8bit):	4.845431272637524
Encrypted:	false
SSDEEP:	192:bwQHd5r+IHWhkD4eIUnqgL0XNaKwQUdOO1dt3dEqvTYdJ5ARdvaEo74Qtpfc74Qf:koHHAk3A9JxUdOO1d1dbcdJydC6qFC7
MD5:	D32F0AEEA70460D4C6BB36AD97D60C7C
SHA1:	41E8ECF13A0F961459C14E3E7C7C6C605E26F071
SHA-256:	1D565F609CA5CDA92F009F375B4571572C95A143FE78697967AFD63399186A88
SHA-512:	40245042438A22C92CBA3240322CBB3A28769537E1E285042337D830082A4A1F43EB9727128CCE9FB27F12A1AE3176F477A72D2920DA0610344A004FE9F8B301
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#.# ElGamal.py : ElGamal encryption/decryption and signatures.#.# Part of the Python Cryptography Toolkit.#.# Originally written by: A.M. Kuchling.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-O97I7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	4.93755420651679
Encrypted:	false
SSDEEP:	48:ozC0f4QHlsyHIO5d3D1FbmQhDf1Bkyrq111YVE:G0QHzJDiGmb/9
MD5:	C0E2869728D62521BB8D80956D00FF64
SHA1:	BFC42ECED5DF070984E9FB4E4121BC8B5FD045D4
SHA-256:	7531596DE9C4A7DF2F1259AB93DBEE4F65FD22A2F78C71CAB6AE29213A496535
SHA-512:	5ABA5F1BBEB5E5EA05C0E5655C1AABAD1CE3F40B83CE1DC7E0D5C74154259CF0031C26573647467BF1E45DC79026D42FFCCBCFA79BA1A842A72E7D054E8999B8
Malicious:	false
Preview:	# -- coding: utf-8 --.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# ===================================================================.."""Public-key

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\is-SMI90.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	4.713769067908261
Encrypted:	false
SSDEEP:	96:Ed6VFQHvogxhIk2r1oX3I3Spfb3/V/GfGpftPWYZav+TIwDvwcPc3ag3IL/Mx:uQQHv/e1rwbPgTmnB83IQx
MD5:	8A68FFF3B3A8D720F6E51B30233A765F
SHA1:	DB202281730F984FC3DD293564329F01DD7D3B25
SHA-256:	C7D4A9864B45EC7D774F975DDF2C9DCBFB3526327F3B4417F01487793DE0C5BE
SHA-512:	2FFE478A14CE103A71C5F38AAC02786E21FAA81A920C66A1A0E42FC07E8C8CAA4D4F77B6A6B3525D2746210306D2B99A40FA8B64887DBFD9F25F6BEB55303878
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# pubkey.py : Internal functions for public key operations..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling, Paul Swartz, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\PublicKey\pubkey.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	4.713769067908261
Encrypted:	false
SSDEEP:	96:Ed6VFQHvogxhIk2r1oX3I3Spfb3/V/GfGpftPWYZav+TIwDvwcPc3ag3IL/Mx:uQQHv/e1rwbPgTmnB83IQx
MD5:	8A68FFF3B3A8D720F6E51B30233A765F
SHA1:	DB202281730F984FC3DD293564329F01DD7D3B25
SHA-256:	C7D4A9864B45EC7D774F975DDF2C9DCBFB3526327F3B4417F01487793DE0C5BE
SHA-512:	2FFE478A14CE103A71C5F38AAC02786E21FAA81A920C66A1A0E42FC07E8C8CAA4D4F77B6A6B3525D2746210306D2B99A40FA8B64887DBFD9F25F6BEB55303878
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# pubkey.py : Internal functions for public key operations..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew Kuchling, Paul Swartz, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\FortunaAccumulator.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6959
Entropy (8bit):	4.869702156146023
Encrypted:	false
SSDEEP:	96:RzImwfFQHvoDVFHVdq1RplslsaK9JqZi/otx3IfRKdcoKHMsAe+eV4Z7kU:R0mwdQHvmSJq8otpIQdAHMln
MD5:	5E7527AC5222DA70B38DAC821672BC0A
SHA1:	5FF808179024328CD056DBACBCC567EB9ACBFCC9
SHA-256:	C529A3FF8FB44C086606714AEAD70238AC15B4BBB5FC564B9D7DA2B8718A021B
SHA-512:	65B49707611B8AD165408375F52CCF920957FD08E42913151458988E9F47CF845C2080B4D980381C33CA08A79078D5A8AA621C734DFF4C7665004B9A2D453A84
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: ascii --..#..# FortunaAccumulator.py : Fortuna's internal accumulator..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\FortunaGenerator.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5402
Entropy (8bit):	5.055670551433319
Encrypted:	false
SSDEEP:	96:WcwfFQHvoDl7HRIwfN3qu2evkzA0vt3FJHUsdUBpQkQv5Q+aF9O2JcJL3:TwdQHvmZlZszA0vx0sdspQPv5ShU7
MD5:	4FF828054886347DFB44801B7D2AC89C
SHA1:	DEEE23A03753960165F6CE4B03E76B8591C0FD6B
SHA-256:	81E68A6F38CADDA004830F7A07671AB69692706DFAB7D4E52AD7C91B70BE6A9D
SHA-512:	C1DFE334A545A0973B20F63E9A72A51120FEF6029779C7FDCF6DA3C45420559610491A38E809612EE25565E8521F2289D6D16F4EF552C9F8D1514CFF3A80BC1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: ascii --..#..# FortunaGenerator.py : Fortuna's internal PRNG..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWA

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\SHAd256.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3098
Entropy (8bit):	5.211730186956918
Encrypted:	false
SSDEEP:	96:Ew80QHzJDGLniNkhKCNLIuK8D7/LCaMigxjO:EwNQHdSLnpVIuK83nMiGjO
MD5:	A6888E98296613172A9CBABA490D2E8E
SHA1:	7A2613381A0C98AD8C2384FE4417FEF0FB145CB9
SHA-256:	04D2D40C6D1048DAA50699A8AC3F10BF9F372D38A7B80829022D8781386C69A8
SHA-512:	ADCE3B963B6BF555F079BB25EF73882232D74E3597ADC0999D41ADB76A56F9F7D5B0B3743D95D8B5555F3842459BAB81A13C621A66243D983381CB8B894077F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: ascii --.#.# Random/Fortuna/SHAd256.py : SHA_d-256 hash function implementation.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTW

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\is-3L959.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6959
Entropy (8bit):	4.869702156146023
Encrypted:	false
SSDEEP:	96:RzImwfFQHvoDVFHVdq1RplslsaK9JqZi/otx3IfRKdcoKHMsAe+eV4Z7kU:R0mwdQHvmSJq8otpIQdAHMln
MD5:	5E7527AC5222DA70B38DAC821672BC0A
SHA1:	5FF808179024328CD056DBACBCC567EB9ACBFCC9
SHA-256:	C529A3FF8FB44C086606714AEAD70238AC15B4BBB5FC564B9D7DA2B8718A021B
SHA-512:	65B49707611B8AD165408375F52CCF920957FD08E42913151458988E9F47CF845C2080B4D980381C33CA08A79078D5A8AA621C734DFF4C7665004B9A2D453A84
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: ascii --..#..# FortunaAccumulator.py : Fortuna's internal accumulator..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\is-K4AA4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5402
Entropy (8bit):	5.055670551433319
Encrypted:	false
SSDEEP:	96:WcwfFQHvoDl7HRIwfN3qu2evkzA0vt3FJHUsdUBpQkQv5Q+aF9O2JcJL3:TwdQHvmZlZszA0vx0sdspQPv5ShU7
MD5:	4FF828054886347DFB44801B7D2AC89C
SHA1:	DEEE23A03753960165F6CE4B03E76B8591C0FD6B
SHA-256:	81E68A6F38CADDA004830F7A07671AB69692706DFAB7D4E52AD7C91B70BE6A9D
SHA-512:	C1DFE334A545A0973B20F63E9A72A51120FEF6029779C7FDCF6DA3C45420559610491A38E809612EE25565E8521F2289D6D16F4EF552C9F8D1514CFF3A80BC1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: ascii --..#..# FortunaGenerator.py : Fortuna's internal PRNG..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWA

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\Fortuna\is-MUU9J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3098
Entropy (8bit):	5.211730186956918
Encrypted:	false
SSDEEP:	96:Ew80QHzJDGLniNkhKCNLIuK8D7/LCaMigxjO:EwNQHdSLnpVIuK83nMiGjO
MD5:	A6888E98296613172A9CBABA490D2E8E
SHA1:	7A2613381A0C98AD8C2384FE4417FEF0FB145CB9
SHA-256:	04D2D40C6D1048DAA50699A8AC3F10BF9F372D38A7B80829022D8781386C69A8
SHA-512:	ADCE3B963B6BF555F079BB25EF73882232D74E3597ADC0999D41ADB76A56F9F7D5B0B3743D95D8B5555F3842459BAB81A13C621A66243D983381CB8B894077F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: ascii --.#.# Random/Fortuna/SHAd256.py : SHA_d-256 hash function implementation.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTW

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1542
Entropy (8bit):	5.197442275614569
Encrypted:	false
SSDEEP:	48:+5+wKzC0f4QHlsyHIO5d3D1FhRpyWyuFBy3:y+w80QHzJDpRLY
MD5:	9214EB02F7D6C5FF5EEDA880A2DD0769
SHA1:	CE6C19EE95988C0818C5C6516861CB5F35398A9C
SHA-256:	E90FFDBB34F7A64EC6FD693DEC3F197BF26516F486DA8C0FC49932776E313F91
SHA-512:	A909E76F13DA4D3C5AE478F7D3C661579EBDCB3E6D93A3E808B8E3C2EFABB5891E8B747C8F1AF9B44DE9F5145DF357C45362CFFEE052825E0FF526DC82B5B648
Malicious:	false
Preview:	#.# Random/OSRNG/__init__.py : Platform-independent OS RNG API.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\fallback.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	5.266473266356663
Encrypted:	false
SSDEEP:	48:npgwEIB0jcQHMsvI/S3oCF75y4Yp2XU44y8:pgwfFQHvoMUp2XU44v
MD5:	080FFAB994EAB9D25C2086558C62125E
SHA1:	67D6AA52565F7F321E4C23D933DEE59056E53F87
SHA-256:	D2A08A00C4C8D1BE76961C390A5026DB5F921A5DE7E6C70CCD8E110B9C4DB2A9
SHA-512:	F8FB8EBB9DEA88E28913A26C1289A2C3D56324570B62E18EA2A927CAA495F1477ED27776A992CC680151BDF95E47C758DF9995CA51ED67A27665AAA7E1324AA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Random/OSRNG/fallback.py : Fallback entropy source for systems with os.urandom..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-0EHU0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	5.198804413237128
Encrypted:	false
SSDEEP:	192:DSEoQSGsLPUjYfNn7n3XsIPVlD6FSFIT23kKXKXecWnHc6Zf:WTPmiB73cIPVligZ
MD5:	EC101097A3C6BDC6D03A925CE982DABE
SHA1:	7A1E252D110C268F67A1700903D5024037F73143
SHA-256:	EEDF5F7CBBE544C2BF3096163D0E82033E8C893E81EA38CB52C5B398597A9278
SHA-512:	EA0C4F48C59172E92C19ABD55EB7CEABBBE1AFFC97C7C928D278C53814AA225CA81E799379FD548821A4CED0A7837F7D17689F3080491E8652A47B67E79BEFAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d...............sQ......sS......sf......Q......}^..............sg......sV......sP.....Rich............................PE..L....5.S...........!......................... ...............................P............@..........................'..Q....!..d............................@.......................................!..@............ ...............................text............................... ..`.rdata..!.... ......................@..@.data........0......................@....reloc..J....@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-0SL2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	4.905652183771213
Encrypted:	false
SSDEEP:	48:nPiwEIB0jcQHMsvI/S3oCFRqyn+QmRqaEakHAdY9xrXrj4kZe6W5kQ/pHEd4l:KwfFQHvocqKHiq9eYrrjIv/pi4l
MD5:	1431433543FE672A3D2757F1C7011F8C
SHA1:	5901B90C979AFA660A75260AA673C37A9239BE3A
SHA-256:	BBA3A07208747C60C3DAF159C326100E878D814FFDED37EDC378C926497EB9DC
SHA-512:	A2A2533E2D1E06F41C99F793F08347124330A1747D431080DB0DC9C17BA9157E79BB19BBEADE48D41FC49CB5088F2397D461AE16045B7C27303249F7050BE2DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Random/OSRNG/posix.py : OS entropy source for POSIX systems..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE U

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-30ESG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2955
Entropy (8bit):	4.960884991442255
Encrypted:	false
SSDEEP:	48:njFwEIB0jcQHMsvI/S3oCFMSAPRk8JVPo6moo7ZsAxUv5CuV34eHcd:pwfFQHvoDVC8jrBNcd
MD5:	68784F46240E9893B6E3597AFF35A3E1
SHA1:	AD828BBAFCEA6E7F63FC0B106417C8513FFE9FFA
SHA-256:	BE40C78F839C6B4FCCC8B64E36F32202076C661F8809AC20EA2A1B62440C5F0F
SHA-512:	B30564A78C7833230F6D2FD2A876178647B9C16DC195C73B6BAB8D0E6ADEB423438DCA8EDAADE4B322A58678E13F4BEA4C6D961955B38626005B7782A10FCAB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Random/OSRNG/rng_base.py : Base class for OSRNG..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-95JBO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1542
Entropy (8bit):	5.197442275614569
Encrypted:	false
SSDEEP:	48:+5+wKzC0f4QHlsyHIO5d3D1FhRpyWyuFBy3:y+w80QHzJDpRLY
MD5:	9214EB02F7D6C5FF5EEDA880A2DD0769
SHA1:	CE6C19EE95988C0818C5C6516861CB5F35398A9C
SHA-256:	E90FFDBB34F7A64EC6FD693DEC3F197BF26516F486DA8C0FC49932776E313F91
SHA-512:	A909E76F13DA4D3C5AE478F7D3C661579EBDCB3E6D93A3E808B8E3C2EFABB5891E8B747C8F1AF9B44DE9F5145DF357C45362CFFEE052825E0FF526DC82B5B648
Malicious:	false
Preview:	#.# Random/OSRNG/__init__.py : Platform-independent OS RNG API.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-AID46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2772
Entropy (8bit):	5.136265592858862
Encrypted:	false
SSDEEP:	48:nR/wEIB0jcQHMsvI/S3oCFzcyynwx4EQByXL18R8RWzEu80Ga4YD:R/wfFQHvo8cVnw2Ewe088t8ra4YD
MD5:	8B72E9E0A9774980E3158FE2269EDB34
SHA1:	F76CAAE0CF49B66363CBEF699DBDCD32A02E0AA2
SHA-256:	02868C31B39D862E8AFBCC2D96680B3B18EBD5B92AA01E67CC666C1AFDC70F06
SHA-512:	3F28252F09F11A886B559883B0DD08D0D8E2BD0AD58DE9F29000D1EBB1F3C779AA569511C00FF56BBED4D4E60311E0F83B31BFE4B722ABED423C5011C32F6285
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Random/OSRNG/nt.py : OS entropy source for MS Windows..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\is-M348A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	5.266473266356663
Encrypted:	false
SSDEEP:	48:npgwEIB0jcQHMsvI/S3oCF75y4Yp2XU44y8:pgwfFQHvoMUp2XU44v
MD5:	080FFAB994EAB9D25C2086558C62125E
SHA1:	67D6AA52565F7F321E4C23D933DEE59056E53F87
SHA-256:	D2A08A00C4C8D1BE76961C390A5026DB5F921A5DE7E6C70CCD8E110B9C4DB2A9
SHA-512:	F8FB8EBB9DEA88E28913A26C1289A2C3D56324570B62E18EA2A927CAA495F1477ED27776A992CC680151BDF95E47C758DF9995CA51ED67A27665AAA7E1324AA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Random/OSRNG/fallback.py : Fallback entropy source for systems with os.urandom..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\nt.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2772
Entropy (8bit):	5.136265592858862
Encrypted:	false
SSDEEP:	48:nR/wEIB0jcQHMsvI/S3oCFzcyynwx4EQByXL18R8RWzEu80Ga4YD:R/wfFQHvo8cVnw2Ewe088t8ra4YD
MD5:	8B72E9E0A9774980E3158FE2269EDB34
SHA1:	F76CAAE0CF49B66363CBEF699DBDCD32A02E0AA2
SHA-256:	02868C31B39D862E8AFBCC2D96680B3B18EBD5B92AA01E67CC666C1AFDC70F06
SHA-512:	3F28252F09F11A886B559883B0DD08D0D8E2BD0AD58DE9F29000D1EBB1F3C779AA569511C00FF56BBED4D4E60311E0F83B31BFE4B722ABED423C5011C32F6285
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Random/OSRNG/nt.py : OS entropy source for MS Windows..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\posix.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	4.905652183771213
Encrypted:	false
SSDEEP:	48:nPiwEIB0jcQHMsvI/S3oCFRqyn+QmRqaEakHAdY9xrXrj4kZe6W5kQ/pHEd4l:KwfFQHvocqKHiq9eYrrjIv/pi4l
MD5:	1431433543FE672A3D2757F1C7011F8C
SHA1:	5901B90C979AFA660A75260AA673C37A9239BE3A
SHA-256:	BBA3A07208747C60C3DAF159C326100E878D814FFDED37EDC378C926497EB9DC
SHA-512:	A2A2533E2D1E06F41C99F793F08347124330A1747D431080DB0DC9C17BA9157E79BB19BBEADE48D41FC49CB5088F2397D461AE16045B7C27303249F7050BE2DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#..# Random/OSRNG/posix.py : OS entropy source for POSIX systems..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE U

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\rng_base.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2955
Entropy (8bit):	4.960884991442255
Encrypted:	false
SSDEEP:	48:njFwEIB0jcQHMsvI/S3oCFMSAPRk8JVPo6moo7ZsAxUv5CuV34eHcd:pwfFQHvoDVC8jrBNcd
MD5:	68784F46240E9893B6E3597AFF35A3E1
SHA1:	AD828BBAFCEA6E7F63FC0B106417C8513FFE9FFA
SHA-256:	BE40C78F839C6B4FCCC8B64E36F32202076C661F8809AC20EA2A1B62440C5F0F
SHA-512:	B30564A78C7833230F6D2FD2A876178647B9C16DC195C73B6BAB8D0E6ADEB423438DCA8EDAADE4B322A58678E13F4BEA4C6D961955B38626005B7782A10FCAB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	#..# Random/OSRNG/rng_base.py : Base class for OSRNG..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\OSRNG\winrandom.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	5.198804413237128
Encrypted:	false
SSDEEP:	192:DSEoQSGsLPUjYfNn7n3XsIPVlD6FSFIT23kKXKXecWnHc6Zf:WTPmiB73cIPVligZ
MD5:	EC101097A3C6BDC6D03A925CE982DABE
SHA1:	7A1E252D110C268F67A1700903D5024037F73143
SHA-256:	EEDF5F7CBBE544C2BF3096163D0E82033E8C893E81EA38CB52C5B398597A9278
SHA-512:	EA0C4F48C59172E92C19ABD55EB7CEABBBE1AFFC97C7C928D278C53814AA225CA81E799379FD548821A4CED0A7837F7D17689F3080491E8652A47B67E79BEFAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d...............sQ......sS......sf......Q......}^..............sg......sV......sP.....Rich............................PE..L....5.S...........!......................... ...............................P............@..........................'..Q....!..d............................@.......................................!..@............ ...............................text............................... ..`.rdata..!.... ......................@..@.data........0......................@....reloc..J....@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\_UserFriendlyRNG.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7851
Entropy (8bit):	4.833981999304952
Encrypted:	false
SSDEEP:	192:dewdQHvmg+rHFswqABJBEy7Fb/u/Y726B6gL/L+RL+tYo/hKKXL7R6:deUemg+bFswqiBE0/x72oVT6KYsKYB6
MD5:	DEBD849AE3B0B5DA840E042C24CD5832
SHA1:	5586D08256744C1BD52CC62226D73675A774C02E
SHA-256:	D9150E496EAF0EB7B0F229AD544EFE470BED1B136EDC4A547F9DCBCC21BE63C2
SHA-512:	A4F33A0647B18C498A92D1A3896008CC2A156A871B3010C92E2A74A9A72F24790ED067CC14D2DAD331FADA653C21E48E34117718AE11DA2002100110DE2476CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# Random/_UserFriendlyRNG.py : A user-friendly random number generator..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CON

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1669
Entropy (8bit):	5.290667562553761
Encrypted:	false
SSDEEP:	48:LwKzC0f4QHlsyHIO5d3D1FbM4UyxEydR6RxwRl:Lw80QHzJDQWVR8KRl
MD5:	25DC5618BA6A93A179A9AB6954FC859B
SHA1:	D49285569ADFAD7CBEA82804D6DB3DADE4FDD041
SHA-256:	2FA35B1F2101D9EA47ED646CCF733AFCB17DCFBFDE3A72630CE147E28A45CE48
SHA-512:	DBE8746AC81F9C71D072A7AD18C63FA232ACCF8C805FA10BC390BDBBF9ED6BD4A5DC42F324EE5CBFBC490CC010EA668C35075F6D07F40BD27E986B3C99BEE92F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# Random/__init__.py : PyCrypto random number generation.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE U

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\is-756JV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1669
Entropy (8bit):	5.290667562553761
Encrypted:	false
SSDEEP:	48:LwKzC0f4QHlsyHIO5d3D1FbM4UyxEydR6RxwRl:Lw80QHzJDQWVR8KRl
MD5:	25DC5618BA6A93A179A9AB6954FC859B
SHA1:	D49285569ADFAD7CBEA82804D6DB3DADE4FDD041
SHA-256:	2FA35B1F2101D9EA47ED646CCF733AFCB17DCFBFDE3A72630CE147E28A45CE48
SHA-512:	DBE8746AC81F9C71D072A7AD18C63FA232ACCF8C805FA10BC390BDBBF9ED6BD4A5DC42F324EE5CBFBC490CC010EA668C35075F6D07F40BD27E986B3C99BEE92F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# Random/__init__.py : PyCrypto random number generation.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE U

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\is-9LLFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5377
Entropy (8bit):	4.81555958602366
Encrypted:	false
SSDEEP:	96:o5wfFQHvoaTCVnpVXeZNDhNkNNrvvGDwoyEbTDnNflG7b0/Yt5:o5wdQHvDuZjuZlvsoyE3D60/S
MD5:	B2882296142BFD3687C1A0FC0935CED8
SHA1:	6DD9D3350D47A33D5F2405194CEFC941D019D46E
SHA-256:	A0273D842356C265E4AD60CA6AF21105F085E47341276E99E205B693633D410D
SHA-512:	1C83BB337BA2D8B00A83780995CCFB82BC5F13599BE27C434BC56B287D1FFD826AC4B347690AD48DAD2EB871D9BE5793B09FDE0E284A9730D9D0D2DE63C61E5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# Random/random.py : Strong alternative for the standard 'random' module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# C

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\is-IULV5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7851
Entropy (8bit):	4.833981999304952
Encrypted:	false
SSDEEP:	192:dewdQHvmg+rHFswqABJBEy7Fb/u/Y726B6gL/L+RL+tYo/hKKXL7R6:deUemg+bFswqiBE0/x72oVT6KYsKYB6
MD5:	DEBD849AE3B0B5DA840E042C24CD5832
SHA1:	5586D08256744C1BD52CC62226D73675A774C02E
SHA-256:	D9150E496EAF0EB7B0F229AD544EFE470BED1B136EDC4A547F9DCBCC21BE63C2
SHA-512:	A4F33A0647B18C498A92D1A3896008CC2A156A871B3010C92E2A74A9A72F24790ED067CC14D2DAD331FADA653C21E48E34117718AE11DA2002100110DE2476CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# Random/_UserFriendlyRNG.py : A user-friendly random number generator..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CON

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Random\random.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5377
Entropy (8bit):	4.81555958602366
Encrypted:	false
SSDEEP:	96:o5wfFQHvoaTCVnpVXeZNDhNkNNrvvGDwoyEbTDnNflG7b0/Yt5:o5wdQHvDuZjuZlvsoyE3D60/S
MD5:	B2882296142BFD3687C1A0FC0935CED8
SHA1:	6DD9D3350D47A33D5F2405194CEFC941D019D46E
SHA-256:	A0273D842356C265E4AD60CA6AF21105F085E47341276E99E205B693633D410D
SHA-512:	1C83BB337BA2D8B00A83780995CCFB82BC5F13599BE27C434BC56B287D1FFD826AC4B347690AD48DAD2EB871D9BE5793B09FDE0E284A9730D9D0D2DE63C61E5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# Random/random.py : Strong alternative for the standard 'random' module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# C

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2401
Entropy (8bit):	5.1576606036557004
Encrypted:	false
SSDEEP:	48:EwKzC0f4QHlsyHIO5d3D1F8Hw8wjIMMIDP0sA8fa9i:Ew80QHzJDjzVfV
MD5:	6EE918B92E2282A9D04F66AACF3A5401
SHA1:	6DDB167586640D6CB390258AA9A783DA85D9C1B6
SHA-256:	402AE398425CF47BC04ADFF1D531711AFB965C9D184CB2AC56C2D31BE5771381
SHA-512:	E835B7BB34C42E2995AD2C23B5E29861D5CAE8F1C4E0F12D8FF32F463AC387A72911280F9548A9111317FC5DA197F48F45FDAE76AEC85F583C701FA7E5D5B318
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Cipher/__init__.py: Self-test for cipher modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\common.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16967
Entropy (8bit):	4.829813396837937
Encrypted:	false
SSDEEP:	384:yUetaNOYSnmNnlC8mOW6WG9fOMY2q6nqXZ:yHtEiG9OMY2q6WZ
MD5:	6295A90AA18A000B9914A66C1B8F2D15
SHA1:	F2D9EB70AF49AB538AF9147AB3234CF976056961
SHA-256:	96D55D8AF56582B7C1B28ABF2817434BF83ED28C012716E94A340425CD424755
SHA-512:	D2586BB82B52F6D663A4E9822CAC458F435E7BE144D3775B3F0D6AEEB284130837515BEBBBE7177287626C1A663628AD51A25FD497EAA7295AE4939495D3E9C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-23AP2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17625
Entropy (8bit):	4.15922622583445
Encrypted:	false
SSDEEP:	384:jeXzC32D5suEeAnSI9lA3tsxE3WtahvrAhMxG4Kx:SO2DOuxA/v2t+MhKMAx
MD5:	6C8316FB0027B1116F0474A56678F4AA
SHA1:	36BBF223CFA82432949EFB54ED76F4D3BA646FC3
SHA-256:	81E193F43A22B455479641602710753CB46477CFA2670948C28868CC41A5B41E
SHA-512:	0C403F51A10FE8946D5D7A5EB7CE5CEED1A8D03E6B582907439C99BA34A345D9D0820FD2FCE9034DDFE7DF23AD1B4A5D0E18AD716C096B2D4DB3B55D18E1B064
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_pkcs1_oaep.py: Self-test for PKCS#1 OAEP encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-70177.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	5.367012269754641
Encrypted:	false
SSDEEP:	48:N1vOwEIB0jcQHMsvI/S3oCFlR+QQkX0LKvjjPZBNVf/yUgrQctTaZa:jOwfFQHvoUHQkX0LKv/7TvcB
MD5:	E8B20988D3BC74D3540368FA17411978
SHA1:	F1AB1236257CBC0605691CF8DAFBB10DA8D17FF1
SHA-256:	AA2C9E62EFF595A6663A565DFBDF06EB65630F08C50E5740D7C4A4B38597E337
SHA-512:	AB74724E42F109CA4BE95A18BB9A862992F4EEDEECC0033FD6117FC9D892FD31B0945C5103AB438BB8E4E64AE8CB4C23E529E5C95DD736DD699281F20D0E5BB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/XOR.py: Self-test for the XOR "cipher"..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-7N2U9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2401
Entropy (8bit):	5.1576606036557004
Encrypted:	false
SSDEEP:	48:EwKzC0f4QHlsyHIO5d3D1F8Hw8wjIMMIDP0sA8fa9i:Ew80QHzJDjzVfV
MD5:	6EE918B92E2282A9D04F66AACF3A5401
SHA1:	6DDB167586640D6CB390258AA9A783DA85D9C1B6
SHA-256:	402AE398425CF47BC04ADFF1D531711AFB965C9D184CB2AC56C2D31BE5771381
SHA-512:	E835B7BB34C42E2995AD2C23B5E29861D5CAE8F1C4E0F12D8FF32F463AC387A72911280F9548A9111317FC5DA197F48F45FDAE76AEC85F583C701FA7E5D5B318
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Cipher/__init__.py: Self-test for cipher modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-CT78S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5071
Entropy (8bit):	5.318294138119564
Encrypted:	false
SSDEEP:	96:YwfFQHvoSnvHN7KtQBnUtRUfOuCPjWrDm6prB:YwdQHvNcgVXvrB
MD5:	99179E2E305B73736A86CD0413939C0C
SHA1:	B95E73B92D778EAAEEC7B8EBB8B38D69179155C4
SHA-256:	EAC0B01D0388A936803E0F35CABE51A36FEDA164110E4C28CD99A57CA252378D
SHA-512:	D9EC7BBC8C448329A9DECC1C9511FA675A38AE9CAB2579F35A020907DB145439CACBB9BC7E49C8620A30F82EC147097E9B3BD8EBA4698A17D67239F33F992377
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/ARC2.py: Self-test for the Alleged-RC2 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-FBGT6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16967
Entropy (8bit):	4.829813396837937
Encrypted:	false
SSDEEP:	384:yUetaNOYSnmNnlC8mOW6WG9fOMY2q6nqXZ:yHtEiG9OMY2q6WZ
MD5:	6295A90AA18A000B9914A66C1B8F2D15
SHA1:	F2D9EB70AF49AB538AF9147AB3234CF976056961
SHA-256:	96D55D8AF56582B7C1B28ABF2817434BF83ED28C012716E94A340425CD424755
SHA-512:	D2586BB82B52F6D663A4E9822CAC458F435E7BE144D3775B3F0D6AEEB284130837515BEBBBE7177287626C1A663628AD51A25FD497EAA7295AE4939495D3E9C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-FL0GK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3628
Entropy (8bit):	5.430948994520122
Encrypted:	false
SSDEEP:	48:NuwEIB0jcQHMsvI/S3oCFlZ+Q4JNnN8IDaeQBarg3ksI80hNDyROqcOB+dTmQctK:YwfFQHvo4H4LnaIHQ8CksMhVqOdDCQB
MD5:	F3B6E06ADAA039276FE95AE6758DAAB6
SHA1:	835B3B490B281DD96E44107F8C3F7478188138FE
SHA-256:	0E7AE61A96A9010A57414ABE868F04664408E2982F59E7B8F4FFF556427C13D3
SHA-512:	6FA8ED457DFF4E992048E12F266D8B201CF31C95D22B5E8066539F4C34800B0F32F2FD850B670F48225FE844EAB775CBC8204D7AC4DA70AC7174B31E912E8557
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/ARC4.py: Self-test for the Alleged-RC4 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-GGEIJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	81410
Entropy (8bit):	4.736828061977332
Encrypted:	false
SSDEEP:	1536:YHV534+If+1xcBWF2bwMnjrpCPLJCDXGsFKhKO5YWPNoPHR:FWykMMJwXZqWWPNoJ
MD5:	6CC9B381D9D3C567581E750485896245
SHA1:	E7DF9338843899A30ED9F607A87AABC4CCF61B8B
SHA-256:	4BB70C5631EC3CA61B52DCFCF1364FF4C8A0F455B529DF8D86787A0AE3CFAB4C
SHA-512:	E4D99FD25A6583A13431255F4D3DB8A142A36DAEC3EEB0EFA4B950141FD4E4A12A265AE54CCF4275F353250BD4B8BF509C2A88B0522CE77943390385F468D1CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/AES.py: Self-test for the AES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-LKVES.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15893
Entropy (8bit):	4.920539850883043
Encrypted:	false
SSDEEP:	192:ywdQHvpKhbXpGJ4uWhd4nYOfBrxlUVz7xn0B:yUe0hbXY1WHsfBrMVz0
MD5:	2A356F73711EAB91842F6F7AFCEF178F
SHA1:	9CB3B68ECC1A80CF6A4919709F38026FA916D2DE
SHA-256:	C3DC9C6B5753EAB4E7AB491C2CA343E8E6E176B3EBAAB8F1A99F11EC3F4CA7C3
SHA-512:	83A16E86ED77575851F1333EA92D8C48D63617D4BCEC14FF90F15803A0016270693F252CE891869BDC5CD463620AF7C518E54AF01A119A00C2DBFF3364342D53
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/DES3.py: Self-test for the Triple-DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-NNKR4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15350
Entropy (8bit):	4.923630595784879
Encrypted:	false
SSDEEP:	192:HwdQHvibJ6ea9UaWpN8CioAMv6Wvk0y36ZY2gB:HUe+J6DBW/9AMvdGq6
MD5:	D9608461A3875DED4E456AA548E4BB25
SHA1:	7A3EC81F61F7D691840720F72820F0858EFC5873
SHA-256:	0C126FC9F4A3E52AA98C86107518485811FA5274F4876893ECAD6732FEF2FAF3
SHA-512:	5D5182591A463526B41A7C05FA0AC2B2DAAC767B3BC23C72335C1646437876D6B050A12CB11045D56C6CBA8DB0CAC4A9CC936A6E5654C90C67656F2B20541C4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/DES.py: Self-test for the (Single) DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-QHTMS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7516
Entropy (8bit):	4.932706193056754
Encrypted:	false
SSDEEP:	96:bFQHvodiKf2z0HM45W5EdU2jZr+w98s2XLw175M9ntSrHBy77rZ:JQHvuX55WydHZr+K2XLEGlrZ
MD5:	CDF42587413887DC56542869073E16C4
SHA1:	6A5736FC1B4BEA42811DC910896540A9A39AC69B
SHA-256:	1EE6CAFF55D110B22097A7418095BFC84BACE69267190EAFFD44979B68CBBC09
SHA-512:	F4643A7D1E288F3764E772CA9E6299885FE84A7E86EB63E8BD3171BE5840359F16F228AC54C6AF062C12157F981C1AF7A89937F106B0F32DD345C5FFE2306044
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_pkcs1_15.py: Self-test for PKCS#1 v1.5 encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-V3RGI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5946
Entropy (8bit):	5.209928905044389
Encrypted:	false
SSDEEP:	96:/wfFQHvoGHQFUkSSpieuHo6uU+A3KM0TwjIZGTga/djVApGRXN/d8uB:/wdQHvQFFlIpgA3KM0COGTga/djVApGx
MD5:	F49C45E4E70389A4300EA5648B97065C
SHA1:	E4C991B35D95BC6AEEFD2294F881F805BC89C90F
SHA-256:	0301ACA354B47FC6DCC945D699DA46655B59924B79E0BC4E0138A307245BD744
SHA-512:	409522B02C36E85D4D6DB3354861380B57C83EA8A6551C29DF74BE3CBAA245EE159CE7609A8581A0076EF76F558314C4FD3E3E464D53858F5BC0B206ED1434FC
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_Blowfish.py: Self-test for the Blowfish cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONN

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\is-V6QEE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	5.445790310136962
Encrypted:	false
SSDEEP:	48:NbwEIB0jcQHMsvI/S3oCFlW+QQx8NIZNgtNpdTvcxaZa:JwfFQHvoHHQOYit7dDQB
MD5:	97B38BF1E6475840BB689C96A43FC09A
SHA1:	5078C60F6841E9F9C7D4C04A97E01D92176799E3
SHA-256:	4DF7092EEC508742E232E6FD52B19934EF82FD793F6181C06CFEBD1868239293
SHA-512:	39176FF031C44041985F6045978A3B06B7D80D15B58A0098E25D4F14C065882DC30BEB96C11E53EFD51478F6A868917D0497EA9F6AD28D61DAE32FAA76FF309E
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/CAST.py: Self-test for the CAST-128 (CAST5) cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_AES.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	81410
Entropy (8bit):	4.736828061977332
Encrypted:	false
SSDEEP:	1536:YHV534+If+1xcBWF2bwMnjrpCPLJCDXGsFKhKO5YWPNoPHR:FWykMMJwXZqWWPNoJ
MD5:	6CC9B381D9D3C567581E750485896245
SHA1:	E7DF9338843899A30ED9F607A87AABC4CCF61B8B
SHA-256:	4BB70C5631EC3CA61B52DCFCF1364FF4C8A0F455B529DF8D86787A0AE3CFAB4C
SHA-512:	E4D99FD25A6583A13431255F4D3DB8A142A36DAEC3EEB0EFA4B950141FD4E4A12A265AE54CCF4275F353250BD4B8BF509C2A88B0522CE77943390385F468D1CF
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/AES.py: Self-test for the AES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_ARC2.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5071
Entropy (8bit):	5.318294138119564
Encrypted:	false
SSDEEP:	96:YwfFQHvoSnvHN7KtQBnUtRUfOuCPjWrDm6prB:YwdQHvNcgVXvrB
MD5:	99179E2E305B73736A86CD0413939C0C
SHA1:	B95E73B92D778EAAEEC7B8EBB8B38D69179155C4
SHA-256:	EAC0B01D0388A936803E0F35CABE51A36FEDA164110E4C28CD99A57CA252378D
SHA-512:	D9EC7BBC8C448329A9DECC1C9511FA675A38AE9CAB2579F35A020907DB145439CACBB9BC7E49C8620A30F82EC147097E9B3BD8EBA4698A17D67239F33F992377
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/ARC2.py: Self-test for the Alleged-RC2 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_ARC4.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3628
Entropy (8bit):	5.430948994520122
Encrypted:	false
SSDEEP:	48:NuwEIB0jcQHMsvI/S3oCFlZ+Q4JNnN8IDaeQBarg3ksI80hNDyROqcOB+dTmQctK:YwfFQHvo4H4LnaIHQ8CksMhVqOdDCQB
MD5:	F3B6E06ADAA039276FE95AE6758DAAB6
SHA1:	835B3B490B281DD96E44107F8C3F7478188138FE
SHA-256:	0E7AE61A96A9010A57414ABE868F04664408E2982F59E7B8F4FFF556427C13D3
SHA-512:	6FA8ED457DFF4E992048E12F266D8B201CF31C95D22B5E8066539F4C34800B0F32F2FD850B670F48225FE844EAB775CBC8204D7AC4DA70AC7174B31E912E8557
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/ARC4.py: Self-test for the Alleged-RC4 cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_Blowfish.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5946
Entropy (8bit):	5.209928905044389
Encrypted:	false
SSDEEP:	96:/wfFQHvoGHQFUkSSpieuHo6uU+A3KM0TwjIZGTga/djVApGRXN/d8uB:/wdQHvQFFlIpgA3KM0COGTga/djVApGx
MD5:	F49C45E4E70389A4300EA5648B97065C
SHA1:	E4C991B35D95BC6AEEFD2294F881F805BC89C90F
SHA-256:	0301ACA354B47FC6DCC945D699DA46655B59924B79E0BC4E0138A307245BD744
SHA-512:	409522B02C36E85D4D6DB3354861380B57C83EA8A6551C29DF74BE3CBAA245EE159CE7609A8581A0076EF76F558314C4FD3E3E464D53858F5BC0B206ED1434FC
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_Blowfish.py: Self-test for the Blowfish cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONN

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_CAST.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	5.445790310136962
Encrypted:	false
SSDEEP:	48:NbwEIB0jcQHMsvI/S3oCFlW+QQx8NIZNgtNpdTvcxaZa:JwfFQHvoHHQOYit7dDQB
MD5:	97B38BF1E6475840BB689C96A43FC09A
SHA1:	5078C60F6841E9F9C7D4C04A97E01D92176799E3
SHA-256:	4DF7092EEC508742E232E6FD52B19934EF82FD793F6181C06CFEBD1868239293
SHA-512:	39176FF031C44041985F6045978A3B06B7D80D15B58A0098E25D4F14C065882DC30BEB96C11E53EFD51478F6A868917D0497EA9F6AD28D61DAE32FAA76FF309E
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/CAST.py: Self-test for the CAST-128 (CAST5) cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_DES.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15350
Entropy (8bit):	4.923630595784879
Encrypted:	false
SSDEEP:	192:HwdQHvibJ6ea9UaWpN8CioAMv6Wvk0y36ZY2gB:HUe+J6DBW/9AMvdGq6
MD5:	D9608461A3875DED4E456AA548E4BB25
SHA1:	7A3EC81F61F7D691840720F72820F0858EFC5873
SHA-256:	0C126FC9F4A3E52AA98C86107518485811FA5274F4876893ECAD6732FEF2FAF3
SHA-512:	5D5182591A463526B41A7C05FA0AC2B2DAAC767B3BC23C72335C1646437876D6B050A12CB11045D56C6CBA8DB0CAC4A9CC936A6E5654C90C67656F2B20541C4E
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/DES.py: Self-test for the (Single) DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_DES3.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15893
Entropy (8bit):	4.920539850883043
Encrypted:	false
SSDEEP:	192:ywdQHvpKhbXpGJ4uWhd4nYOfBrxlUVz7xn0B:yUe0hbXY1WHsfBrMVz0
MD5:	2A356F73711EAB91842F6F7AFCEF178F
SHA1:	9CB3B68ECC1A80CF6A4919709F38026FA916D2DE
SHA-256:	C3DC9C6B5753EAB4E7AB491C2CA343E8E6E176B3EBAAB8F1A99F11EC3F4CA7C3
SHA-512:	83A16E86ED77575851F1333EA92D8C48D63617D4BCEC14FF90F15803A0016270693F252CE891869BDC5CD463620AF7C518E54AF01A119A00C2DBFF3364342D53
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/DES3.py: Self-test for the Triple-DES cipher..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_XOR.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2611
Entropy (8bit):	5.367012269754641
Encrypted:	false
SSDEEP:	48:N1vOwEIB0jcQHMsvI/S3oCFlR+QQkX0LKvjjPZBNVf/yUgrQctTaZa:jOwfFQHvoUHQkX0LKv/7TvcB
MD5:	E8B20988D3BC74D3540368FA17411978
SHA1:	F1AB1236257CBC0605691CF8DAFBB10DA8D17FF1
SHA-256:	AA2C9E62EFF595A6663A565DFBDF06EB65630F08C50E5740D7C4A4B38597E337
SHA-512:	AB74724E42F109CA4BE95A18BB9A862992F4EEDEECC0033FD6117FC9D892FD31B0945C5103AB438BB8E4E64AE8CB4C23E529E5C95DD736DD699281F20D0E5BB8
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/XOR.py: Self-test for the XOR "cipher"..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_pkcs1_15.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7516
Entropy (8bit):	4.932706193056754
Encrypted:	false
SSDEEP:	96:bFQHvodiKf2z0HM45W5EdU2jZr+w98s2XLw175M9ntSrHBy77rZ:JQHvuX55WydHZr+K2XLEGlrZ
MD5:	CDF42587413887DC56542869073E16C4
SHA1:	6A5736FC1B4BEA42811DC910896540A9A39AC69B
SHA-256:	1EE6CAFF55D110B22097A7418095BFC84BACE69267190EAFFD44979B68CBBC09
SHA-512:	F4643A7D1E288F3764E772CA9E6299885FE84A7E86EB63E8BD3171BE5840359F16F228AC54C6AF062C12157F981C1AF7A89937F106B0F32DD345C5FFE2306044
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_pkcs1_15.py: Self-test for PKCS#1 v1.5 encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Cipher\test_pkcs1_oaep.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	17625
Entropy (8bit):	4.15922622583445
Encrypted:	false
SSDEEP:	384:jeXzC32D5suEeAnSI9lA3tsxE3WtahvrAhMxG4Kx:SO2DOuxA/v2t+MhKMAx
MD5:	6C8316FB0027B1116F0474A56678F4AA
SHA1:	36BBF223CFA82432949EFB54ED76F4D3BA646FC3
SHA-256:	81E193F43A22B455479641602710753CB46477CFA2670948C28868CC41A5B41E
SHA-512:	0C403F51A10FE8946D5D7A5EB7CE5CEED1A8D03E6B582907439C99BA34A345D9D0820FD2FCE9034DDFE7DF23AD1B4A5D0E18AD716C096B2D4DB3B55D18E1B064
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Cipher/test_pkcs1_oaep.py: Self-test for PKCS#1 OAEP encryption..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.19566928200041
Encrypted:	false
SSDEEP:	48:7kwKzC0f4QHlsyHIO5d3D1F8qHwT4YaWsAjbHjR4n+94QEYNnRfa9i:ww80QHzJD89MyfV
MD5:	F908783A112453D931C836427BCA90D9
SHA1:	A5D22987B122BFEBA20D0FEE268375FC395F59F1
SHA-256:	3F06340145411772592F48F2CDA8C3FE2E51ECAE876AD3B97CB36E0AA9D26C79
SHA-512:	FB1BD3E7DA82ADB32C716497413602F2BF46FC01D569A022ED0D3F9F9023C1952467999C96F9B6B573DE48A3B7EFE9C6C2D5C5160A26780209C363157F74DBA1
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Hash/__init__.py: Self-test for hash modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE US

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\common.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7273
Entropy (8bit):	4.833039221023359
Encrypted:	false
SSDEEP:	96:ywfFQHvocN1Hv8yI4oXU/2+nQLMmf9ch5+lGIkPFRs+r/FkZ9Hyg2LIjzU:ywdQHvtNHqcayH/OZ9HkLIjzU
MD5:	5127296D6261BBF1738E975D7278D691
SHA1:	E5E258074CB77B4CCC59F6BB6D972D60834D854A
SHA-256:	4A04DAA09BEAAB1BA8E57E6F856ACAA16DD589D62D98912A6A5FB2CBC9C8A985
SHA-512:	2CF376A05147F234169A0BCD95E40DDA89ABF76164409781F24925E5560A3DF7D62DD2BF409FE72447520165BE31DC5309A2812A527391852E94A5321176C6DD
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-1IKLJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2759
Entropy (8bit):	5.599894793131278
Encrypted:	false
SSDEEP:	48:NlwEIB0jcQHMsvI/S3oCFm6k+Qk0Y8ZD72mvhPmLluTyReW1CTv/3asdTBJcwya4:nwfFQHvozHkP8ZD73BIl2xeav/3asdlI
MD5:	070BE39A8CDB4584FB75C0FA6932E2F4
SHA1:	D84195E97484DF003BEEB65D5064C023305AE56A
SHA-256:	C38557517E7DD73422693B8EFD90C787049AAF1577FBC77365EEBEB0CA8805A8
SHA-512:	567D2D4BC30F397DA1210030F804540454AE1E8FDE8B4AC4FE830A48739A07CDE1DD14235FFDCCD180720957BE0B3795FFED0A752E5A451B66F7DB8A0210A072
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_RIPEMD.py: Self-test for the RIPEMD-160 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-1MKRC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	5.596602040366309
Encrypted:	false
SSDEEP:	48:NQwEIB0jcQHMsvI/S3oCFlO+Qk0YTKQYgHTm7K91CTh0DdTmJcw5aZa:CwfFQHvohHkPTp3zSKfah0DdyJ95B
MD5:	3C361AC70EB9474A6ADF0AFBDDE80028
SHA1:	F250C084E86CC7207333E5A665D1F1466F0FBCEA
SHA-256:	C11F967667BE338752D335AE4E586529FC816B5C379700535DBFCF9635AB97DC
SHA-512:	FF0D7C5033ED68B6F6AF556C4AF4B458FE35A5E7D1D114D1330DEC81B7712BD24B74B65E3A5CCFDFB543F4B5677331B123DA1F6A43A7C090A59C779A87062036
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD5.py: Self-test for the MD5 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-6DPG6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	5.161090205678812
Encrypted:	false
SSDEEP:	96:UwfFQHvotkncJHVmxNPRe5486ZHvoWdi44jpwxcVpwEC7HFO7ktNI8Oxqwb1JB:UwdQHv0HmxHorDwxwwbTU79dqwbfB
MD5:	94039C60BC16864D55BE9B925207B0B5
SHA1:	759C5D73937BAE434B1FF341D561D4CDD9CBDE62
SHA-256:	DDA6A4B21E5B839862F7BD7C12E99783C5C5CF36BF52F48A38B7598FB91965A8
SHA-512:	FC516194203761B02E23FCB8E0F92A26B4AB39724CBA5CB7FEA4068C4732A66624DD362B3F206ACCD438BAFF6AB06E42DB110E976A1C25C962E0FC977C443C9C
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/HMAC.py: Self-test for the HMAC module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-9RCF0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2826
Entropy (8bit):	5.632562057183408
Encrypted:	false
SSDEEP:	48:NzwEIB0jcQHMsvI/S3oCFlkyLT0L3QlmQe5FKkMMHn/TxJcwkgDpaZa:NwfFQHvo94iwTe5FFMkn/lJ9L1B
MD5:	0BF68AAF458FFC8C0B7A18AE1E8F3498
SHA1:	999C7F5F8DD92FB1D917DBC3A077257B405031D8
SHA-256:	88B629F1A2685BA2FCF2733D97F69750A304915367CFD04554896EB22A9AA09A
SHA-512:	A870F5C597BC8642C7CA1F8156B8ECC65290429B205E3BC5132855D82D5AAC37365086A702DEF48191B1A663BC553216C128A24654664E7CED508C60D4553675
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA.py: Self-test for the SHA-384 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-B91JS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	5.502966254161217
Encrypted:	false
SSDEEP:	48:NK9wEIB0jcQHMsvI/S3oCFlU+QmyLT077MSGrdTQJcwkLaZa:QwfFQHvoHHm4o7fGrd0J9IB
MD5:	DC0DED4366988E9D5B79D7ECE7F93DDB
SHA1:	05428B44D257F207DD05CFA4DC6182E15DA67CA4
SHA-256:	13CC0FEF3010C146C871D4C76828D21881F992CF34226F8BCC29407E950AE337
SHA-512:	60F1C0B8D31493DD5BFABCA123529540BCC9934FA69B6866C6E3BAEB52A4632B436286BC50199F0F68CB981277F7A060F5A92629F241EC02B33D1CEEB10F4EE0
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/SHA.py: Self-test for the SHA-1 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION W

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-CGFJH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	5.5826885763028455
Encrypted:	false
SSDEEP:	48:NHAwEIB0jcQHMsvI/S3oCFlZyLT0goLdBqSTDfmZXToJcwkNOaZa:BAwfFQHvoM4KBjvfmJcJ9eOB
MD5:	AB7173768C93A476D7C8F5DAAC1C0883
SHA1:	D3804A4851528B7F8F66D628351A5FCDB8103D40
SHA-256:	03387EEF28D12EEAF87DFD66B547F03B8CDCDF0077CA482DE125529A0F2D00C2
SHA-512:	294B2ADDE162068344ED66B95D589C680E98C0B16FC4F31B681B0855F0C81A299A02DEBD7222CA11D0E585F002DA506F79485700A5690DFDE5F76112BD614A64
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA224.py: Self-test for the SHA-224 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-DO36J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	5.587779938543248
Encrypted:	false
SSDEEP:	48:N/YPwEIB0jcQHMsvI/S3oCFlYk+Qk0Y3bSQxLgy9eTkM1CT+B1DdTycJcwMaZa:KPwfFQHvoZkHkPrZj9mkwa+XDdNJ9MB
MD5:	C74510A28FA6E2BA14D1D9DD76E45C39
SHA1:	45736B3871F42EB848D699118443E2DCCEA87A67
SHA-256:	F7E6DD438BC650A711375384671D736DDF003B6877F14C7F54E6F54EF4AFDE54
SHA-512:	2129EE9D05AE8B7ECB798ED0B67EAE6F1F20AE3362DFF3567A1F7F3435304F64CE9024A1C9082500CF73B95F63B157D30E80CEB6203A17A09A993C4B374B6C86
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD4.py: Self-test for the MD4 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-GJ61S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	5.592027402279681
Encrypted:	false
SSDEEP:	48:NIwEIB0jcQHMsvI/S3oCFlYE+Qk0Y3h18+7L0Tk1CTIDdTzJcweaZa:6wfFQHvovEHkPs+YoaIDdXJ9eB
MD5:	C1E3D756AD5EA8FB7CCBA92A9938BEF7
SHA1:	6CA8D036FB35C7394C9D7C5F93E9D08B5AAE96B8
SHA-256:	C18DFE6A802FB236561715F47C70FF77E9DF13BAC32A9CE5FBC4664EB6A77FD3
SHA-512:	4B2A6250224DA51866091B8FD85F1EEE71F1C55B7BC69F0C8DBF14D95131E1AEF182D401449A5F99381390307D53DADD8B3F63665CB3D42FEE021DAFC8C93E6D
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD2.py: Self-test for the MD2 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-OESPU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2910
Entropy (8bit):	5.632177690814226
Encrypted:	false
SSDEEP:	48:NgwEIB0jcQHMsvI/S3oCFlJyLT0Q/GXPfuQe5MT86CH7rSdToJcwkY+aZa:CwfFQHvo441GXPfre5E8xedMJ9P+B
MD5:	07333E8B4E1312D03530A615E2465C2C
SHA1:	66FE88E3838C1AAA1DE715D29C40D53856FD0621
SHA-256:	4C6285BAEC4A59EF89CD608CE2289E23EDDAD5EE204900EC60DCB0E3B25F3714
SHA-512:	85A50D1B1358C6876654C569FC3D314BB4DE4D8298DDF2EDAD902ED3E438D4CD63E18F5F20767F10D802B1C423395A0975526C1F2D7E11EA3B4963A6AAB623CD
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA512.py: Self-test for the SHA-512 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-Q8B2T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7273
Entropy (8bit):	4.833039221023359
Encrypted:	false
SSDEEP:	96:ywfFQHvocN1Hv8yI4oXU/2+nQLMmf9ch5+lGIkPFRs+r/FkZ9Hyg2LIjzU:ywdQHvtNHqcayH/OZ9HkLIjzU
MD5:	5127296D6261BBF1738E975D7278D691
SHA1:	E5E258074CB77B4CCC59F6BB6D972D60834D854A
SHA-256:	4A04DAA09BEAAB1BA8E57E6F856ACAA16DD589D62D98912A6A5FB2CBC9C8A985
SHA-512:	2CF376A05147F234169A0BCD95E40DDA89ABF76164409781F24925E5560A3DF7D62DD2BF409FE72447520165BE31DC5309A2812A527391852E94A5321176C6DD
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/common.py: Common code for Crypto.SelfTest.Hash..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-SNCKR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.19566928200041
Encrypted:	false
SSDEEP:	48:7kwKzC0f4QHlsyHIO5d3D1F8qHwT4YaWsAjbHjR4n+94QEYNnRfa9i:ww80QHzJD89MyfV
MD5:	F908783A112453D931C836427BCA90D9
SHA1:	A5D22987B122BFEBA20D0FEE268375FC395F59F1
SHA-256:	3F06340145411772592F48F2CDA8C3FE2E51ECAE876AD3B97CB36E0AA9D26C79
SHA-512:	FB1BD3E7DA82ADB32C716497413602F2BF46FC01D569A022ED0D3F9F9023C1952467999C96F9B6B573DE48A3B7EFE9C6C2D5C5160A26780209C363157F74DBA1
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Hash/__init__.py: Self-test for hash modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE US

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\is-VQVR2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3758
Entropy (8bit):	5.436076709693395
Encrypted:	false
SSDEEP:	96:CwfFQHvoAH8LqjLdPa6nHQhq/vElf76rB:CwdQHv8ej1aq3E56rB
MD5:	CA8A241AA752CA788F1750310BB52A8A
SHA1:	2FB44607C8CD89DB3C31D15B12411ED7858EF874
SHA-256:	9B59EA628740D82398C912D01F47B941583FABDF35C52262D274213D47CA62E6
SHA-512:	8DCAF4A5086554EAF724309F0463F96D4307C00C53BA72516CA07B2CE11667C1BC749637AC3B37A820B56F433086DCB666FD745F3AFC74D07EB44C9956C25C52
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA256.py: Self-test for the SHA-256 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_HMAC.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	5.161090205678812
Encrypted:	false
SSDEEP:	96:UwfFQHvotkncJHVmxNPRe5486ZHvoWdi44jpwxcVpwEC7HFO7ktNI8Oxqwb1JB:UwdQHv0HmxHorDwxwwbTU79dqwbfB
MD5:	94039C60BC16864D55BE9B925207B0B5
SHA1:	759C5D73937BAE434B1FF341D561D4CDD9CBDE62
SHA-256:	DDA6A4B21E5B839862F7BD7C12E99783C5C5CF36BF52F48A38B7598FB91965A8
SHA-512:	FC516194203761B02E23FCB8E0F92A26B4AB39724CBA5CB7FEA4068C4732A66624DD362B3F206ACCD438BAFF6AB06E42DB110E976A1C25C962E0FC977C443C9C
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/HMAC.py: Self-test for the HMAC module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_MD2.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	5.592027402279681
Encrypted:	false
SSDEEP:	48:NIwEIB0jcQHMsvI/S3oCFlYE+Qk0Y3h18+7L0Tk1CTIDdTzJcweaZa:6wfFQHvovEHkPs+YoaIDdXJ9eB
MD5:	C1E3D756AD5EA8FB7CCBA92A9938BEF7
SHA1:	6CA8D036FB35C7394C9D7C5F93E9D08B5AAE96B8
SHA-256:	C18DFE6A802FB236561715F47C70FF77E9DF13BAC32A9CE5FBC4664EB6A77FD3
SHA-512:	4B2A6250224DA51866091B8FD85F1EEE71F1C55B7BC69F0C8DBF14D95131E1AEF182D401449A5F99381390307D53DADD8B3F63665CB3D42FEE021DAFC8C93E6D
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD2.py: Self-test for the MD2 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_MD4.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	5.587779938543248
Encrypted:	false
SSDEEP:	48:N/YPwEIB0jcQHMsvI/S3oCFlYk+Qk0Y3bSQxLgy9eTkM1CT+B1DdTycJcwMaZa:KPwfFQHvoZkHkPrZj9mkwa+XDdNJ9MB
MD5:	C74510A28FA6E2BA14D1D9DD76E45C39
SHA1:	45736B3871F42EB848D699118443E2DCCEA87A67
SHA-256:	F7E6DD438BC650A711375384671D736DDF003B6877F14C7F54E6F54EF4AFDE54
SHA-512:	2129EE9D05AE8B7ECB798ED0B67EAE6F1F20AE3362DFF3567A1F7F3435304F64CE9024A1C9082500CF73B95F63B157D30E80CEB6203A17A09A993C4B374B6C86
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD4.py: Self-test for the MD4 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_MD5.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	5.596602040366309
Encrypted:	false
SSDEEP:	48:NQwEIB0jcQHMsvI/S3oCFlO+Qk0YTKQYgHTm7K91CTh0DdTmJcw5aZa:CwfFQHvohHkPTp3zSKfah0DdyJ95B
MD5:	3C361AC70EB9474A6ADF0AFBDDE80028
SHA1:	F250C084E86CC7207333E5A665D1F1466F0FBCEA
SHA-256:	C11F967667BE338752D335AE4E586529FC816B5C379700535DBFCF9635AB97DC
SHA-512:	FF0D7C5033ED68B6F6AF556C4AF4B458FE35A5E7D1D114D1330DEC81B7712BD24B74B65E3A5CCFDFB543F4B5677331B123DA1F6A43A7C090A59C779A87062036
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/MD5.py: Self-test for the MD5 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WIT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_RIPEMD.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2759
Entropy (8bit):	5.599894793131278
Encrypted:	false
SSDEEP:	48:NlwEIB0jcQHMsvI/S3oCFm6k+Qk0Y8ZD72mvhPmLluTyReW1CTv/3asdTBJcwya4:nwfFQHvozHkP8ZD73BIl2xeav/3asdlI
MD5:	070BE39A8CDB4584FB75C0FA6932E2F4
SHA1:	D84195E97484DF003BEEB65D5064C023305AE56A
SHA-256:	C38557517E7DD73422693B8EFD90C787049AAF1577FBC77365EEBEB0CA8805A8
SHA-512:	567D2D4BC30F397DA1210030F804540454AE1E8FDE8B4AC4FE830A48739A07CDE1DD14235FFDCCD180720957BE0B3795FFED0A752E5A451B66F7DB8A0210A072
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_RIPEMD.py: Self-test for the RIPEMD-160 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_SHA.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2376
Entropy (8bit):	5.502966254161217
Encrypted:	false
SSDEEP:	48:NK9wEIB0jcQHMsvI/S3oCFlU+QmyLT077MSGrdTQJcwkLaZa:QwfFQHvoHHm4o7fGrd0J9IB
MD5:	DC0DED4366988E9D5B79D7ECE7F93DDB
SHA1:	05428B44D257F207DD05CFA4DC6182E15DA67CA4
SHA-256:	13CC0FEF3010C146C871D4C76828D21881F992CF34226F8BCC29407E950AE337
SHA-512:	60F1C0B8D31493DD5BFABCA123529540BCC9934FA69B6866C6E3BAEB52A4632B436286BC50199F0F68CB981277F7A060F5A92629F241EC02B33D1CEEB10F4EE0
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/SHA.py: Self-test for the SHA-1 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION W

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_SHA224.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	5.5826885763028455
Encrypted:	false
SSDEEP:	48:NHAwEIB0jcQHMsvI/S3oCFlZyLT0goLdBqSTDfmZXToJcwkNOaZa:BAwfFQHvoM4KBjvfmJcJ9eOB
MD5:	AB7173768C93A476D7C8F5DAAC1C0883
SHA1:	D3804A4851528B7F8F66D628351A5FCDB8103D40
SHA-256:	03387EEF28D12EEAF87DFD66B547F03B8CDCDF0077CA482DE125529A0F2D00C2
SHA-512:	294B2ADDE162068344ED66B95D589C680E98C0B16FC4F31B681B0855F0C81A299A02DEBD7222CA11D0E585F002DA506F79485700A5690DFDE5F76112BD614A64
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA224.py: Self-test for the SHA-224 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_SHA256.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3758
Entropy (8bit):	5.436076709693395
Encrypted:	false
SSDEEP:	96:CwfFQHvoAH8LqjLdPa6nHQhq/vElf76rB:CwdQHv8ej1aq3E56rB
MD5:	CA8A241AA752CA788F1750310BB52A8A
SHA1:	2FB44607C8CD89DB3C31D15B12411ED7858EF874
SHA-256:	9B59EA628740D82398C912D01F47B941583FABDF35C52262D274213D47CA62E6
SHA-512:	8DCAF4A5086554EAF724309F0463F96D4307C00C53BA72516CA07B2CE11667C1BC749637AC3B37A820B56F433086DCB666FD745F3AFC74D07EB44C9956C25C52
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA256.py: Self-test for the SHA-256 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_SHA384.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2826
Entropy (8bit):	5.632562057183408
Encrypted:	false
SSDEEP:	48:NzwEIB0jcQHMsvI/S3oCFlkyLT0L3QlmQe5FKkMMHn/TxJcwkgDpaZa:NwfFQHvo94iwTe5FFMkn/lJ9L1B
MD5:	0BF68AAF458FFC8C0B7A18AE1E8F3498
SHA1:	999C7F5F8DD92FB1D917DBC3A077257B405031D8
SHA-256:	88B629F1A2685BA2FCF2733D97F69750A304915367CFD04554896EB22A9AA09A
SHA-512:	A870F5C597BC8642C7CA1F8156B8ECC65290429B205E3BC5132855D82D5AAC37365086A702DEF48191B1A663BC553216C128A24654664E7CED508C60D4553675
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA.py: Self-test for the SHA-384 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Hash\test_SHA512.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2910
Entropy (8bit):	5.632177690814226
Encrypted:	false
SSDEEP:	48:NgwEIB0jcQHMsvI/S3oCFlJyLT0Q/GXPfuQe5MT86CH7rSdToJcwkY+aZa:CwfFQHvo441GXPfre5E8xedMJ9P+B
MD5:	07333E8B4E1312D03530A615E2465C2C
SHA1:	66FE88E3838C1AAA1DE715D29C40D53856FD0621
SHA-256:	4C6285BAEC4A59EF89CD608CE2289E23EDDAD5EE204900EC60DCB0E3B25F3714
SHA-512:	85A50D1B1358C6876654C569FC3D314BB4DE4D8298DDF2EDAD902ED3E438D4CD63E18F5F20767F10D802B1C423395A0975526C1F2D7E11EA3B4963A6AAB623CD
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Hash/test_SHA512.py: Self-test for the SHA-512 hash function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	5.208599927720967
Encrypted:	false
SSDEEP:	48:t1PwKzC0f4QHlsyHIO5d3D1FL1JwUIulJIjhfa9i:HPw80QHzJDZ1/lJchfV
MD5:	BF33B584CF7B5E66F77DB6C796ACE265
SHA1:	C0CD351790CA61FF109839F8205CC6A85F7A3A0F
SHA-256:	9F48F2C6FEC5FA0E2EA4A6D46BED7B4EF3AF0C334D811F4502C64F4F6A5191FF
SHA-512:	9AAF7EAF82F745D1A1FD6AE2C3371558543DF7B7C92CB46F985AD72530BA144F98A50BEF54E901BB3FCC658DF1877AE0CB44B354979F922D069190ACC2DB827C
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Protocol/__init__.py: Self-tests for Crypto.Protocol.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE O

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\is-0GQGM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	4.955451556019525
Encrypted:	false
SSDEEP:	48:Q1GHmo0zC0f4QHlsyHIO5d3D1Fbl1GQiQWrBG+hZZ6Qx7fswTsbmrEISzHFysfS:gGGp0QHzJDz/KlG+h+A7fs56IpIsq
MD5:	008F091DA9D4C7A4C84A4AF4CFDEB6EF
SHA1:	02B371C9348E1C8BB24C35BCDEB1739A3598144F
SHA-256:	F594DA276544D4EA85FD1C632992E8FC67A8AA0FFEDBA67F37986B3E4FC3A707
SHA-512:	6E10CBC94ECCF54CC75B253F2075581F31BBBA1E3C8977C45B440B04D06995E0813EEE0FB96B0B18AD7E4A1C17D23310BD3580AA81DE907C7C978E5C256839AF
Malicious:	false
Reputation:	unknown
Preview:	#.# Test script for Crypto.Protocol.AllOrNothing.#.# Part of the Python Cryptography Toolkit.#.# Written by Andrew Kuchling and others.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER D

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\is-3EHUA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	5.296105070024405
Encrypted:	false
SSDEEP:	48:Qfo0zC0f4QHlsyHIO5d3D1FbkAQEAUOPoM0kWM2IyEaSfS:up0QHzJDIHGKq
MD5:	41B4FF1E6A0E7A87BB807F52CB528CC4
SHA1:	084265BDA580627335058028127F2EAF324225D3
SHA-256:	2D1DCCF572E4FECC4EC9AA4FAB7D8F11FF7749433012B170C3394734A8546B38
SHA-512:	EA4173C3C4BC52DA794DED82E9F712B871FA340E8C829DB5E12713BEBF065B6187AEFC1CD3B18807FB9EAD2E0E490C7EE9B26A0FCC94BC7955BB03D23937713C
Malicious:	false
Reputation:	unknown
Preview:	#.# Test script for Crypto.Util.RFC1751..#.# Part of the Python Cryptography Toolkit.#.# Written by Andrew Kuchling and others.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\is-3O166.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2972
Entropy (8bit):	5.038361269829697
Encrypted:	false
SSDEEP:	48:Q1+o0zC0f4QHlsyHIO5d3D1Fbl1xQWrBG+hZZ6Qx7fswTsTDBGFgylfS:g+p0QHzJDzHlG+h+A7fs5/sFTlq
MD5:	3A71674B619B442457B953A3AFADC589
SHA1:	E9F5882BFE477AC1C2F2E35B6DF3DC1D879C62EA
SHA-256:	09DBA60B6A87A3F0D296FD0D960317D9187F9FF20A88BD71C412C96254225AEF
SHA-512:	01D347BE857F93FA1C0D09DD164374B3A7C1A8F62BF0A35F820E054FDB6B109CA082C9A254AA0846C32897894710600AD1953C8E6FC98628E97066FA70BAFD0B
Malicious:	false
Reputation:	unknown
Preview:	#.# Test script for Crypto.Protocol.Chaffing.#.# Part of the Python Cryptography Toolkit.#.# Written by Andrew Kuchling and others.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALI

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\is-4CIV1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	5.208599927720967
Encrypted:	false
SSDEEP:	48:t1PwKzC0f4QHlsyHIO5d3D1FL1JwUIulJIjhfa9i:HPw80QHzJDZ1/lJchfV
MD5:	BF33B584CF7B5E66F77DB6C796ACE265
SHA1:	C0CD351790CA61FF109839F8205CC6A85F7A3A0F
SHA-256:	9F48F2C6FEC5FA0E2EA4A6D46BED7B4EF3AF0C334D811F4502C64F4F6A5191FF
SHA-512:	9AAF7EAF82F745D1A1FD6AE2C3371558543DF7B7C92CB46F985AD72530BA144F98A50BEF54E901BB3FCC658DF1877AE0CB44B354979F922D069190ACC2DB827C
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Protocol/__init__.py: Self-tests for Crypto.Protocol.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE O

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\is-KMH4Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3925
Entropy (8bit):	5.289365036480393
Encrypted:	false
SSDEEP:	96:BFQHvoIEsvKER7mU5Zym++oBWbRiCHQ3vdrq:fQHvgIG+oG5kdrq
MD5:	C00337D727CB1FEDED3E52A212AC90DE
SHA1:	B6980D2048A538957030AFE20E8CA0A21FDC7561
SHA-256:	2352DBE808990680662674345C795C3C0D86DB50AFE2E1282FA41E8C5B8DCB26
SHA-512:	D94F2101F223878D81E2D9B8BDA170D013BA947D98C97717C50C1545827C484969C13640EEBC7F4FF8C86481648D7DABA5558FC51C53604DF25CDEBAA1E4141F
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Protocol/test_KDF.py: Self-test for key derivation functions..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\test_AllOrNothing.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	4.955451556019525
Encrypted:	false
SSDEEP:	48:Q1GHmo0zC0f4QHlsyHIO5d3D1Fbl1GQiQWrBG+hZZ6Qx7fswTsbmrEISzHFysfS:gGGp0QHzJDz/KlG+h+A7fs56IpIsq
MD5:	008F091DA9D4C7A4C84A4AF4CFDEB6EF
SHA1:	02B371C9348E1C8BB24C35BCDEB1739A3598144F
SHA-256:	F594DA276544D4EA85FD1C632992E8FC67A8AA0FFEDBA67F37986B3E4FC3A707
SHA-512:	6E10CBC94ECCF54CC75B253F2075581F31BBBA1E3C8977C45B440B04D06995E0813EEE0FB96B0B18AD7E4A1C17D23310BD3580AA81DE907C7C978E5C256839AF
Malicious:	false
Reputation:	unknown
Preview:	#.# Test script for Crypto.Protocol.AllOrNothing.#.# Part of the Python Cryptography Toolkit.#.# Written by Andrew Kuchling and others.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER D

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\test_KDF.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3925
Entropy (8bit):	5.289365036480393
Encrypted:	false
SSDEEP:	96:BFQHvoIEsvKER7mU5Zym++oBWbRiCHQ3vdrq:fQHvgIG+oG5kdrq
MD5:	C00337D727CB1FEDED3E52A212AC90DE
SHA1:	B6980D2048A538957030AFE20E8CA0A21FDC7561
SHA-256:	2352DBE808990680662674345C795C3C0D86DB50AFE2E1282FA41E8C5B8DCB26
SHA-512:	D94F2101F223878D81E2D9B8BDA170D013BA947D98C97717C50C1545827C484969C13640EEBC7F4FF8C86481648D7DABA5558FC51C53604DF25CDEBAA1E4141F
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Protocol/test_KDF.py: Self-test for key derivation functions..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\test_chaffing.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2972
Entropy (8bit):	5.038361269829697
Encrypted:	false
SSDEEP:	48:Q1+o0zC0f4QHlsyHIO5d3D1Fbl1xQWrBG+hZZ6Qx7fswTsTDBGFgylfS:g+p0QHzJDzHlG+h+A7fs5/sFTlq
MD5:	3A71674B619B442457B953A3AFADC589
SHA1:	E9F5882BFE477AC1C2F2E35B6DF3DC1D879C62EA
SHA-256:	09DBA60B6A87A3F0D296FD0D960317D9187F9FF20A88BD71C412C96254225AEF
SHA-512:	01D347BE857F93FA1C0D09DD164374B3A7C1A8F62BF0A35F820E054FDB6B109CA082C9A254AA0846C32897894710600AD1953C8E6FC98628E97066FA70BAFD0B
Malicious:	false
Reputation:	unknown
Preview:	#.# Test script for Crypto.Protocol.Chaffing.#.# Part of the Python Cryptography Toolkit.#.# Written by Andrew Kuchling and others.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALI

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Protocol\test_rfc1751.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	5.296105070024405
Encrypted:	false
SSDEEP:	48:Qfo0zC0f4QHlsyHIO5d3D1FbkAQEAUOPoM0kWM2IyEaSfS:up0QHzJDIHGKq
MD5:	41B4FF1E6A0E7A87BB807F52CB528CC4
SHA1:	084265BDA580627335058028127F2EAF324225D3
SHA-256:	2D1DCCF572E4FECC4EC9AA4FAB7D8F11FF7749433012B170C3394734A8546B38
SHA-512:	EA4173C3C4BC52DA794DED82E9F712B871FA340E8C829DB5E12713BEBF065B6187AEFC1CD3B18807FB9EAD2E0E490C7EE9B26A0FCC94BC7955BB03D23937713C
Malicious:	false
Reputation:	unknown
Preview:	#.# Test script for Crypto.Util.RFC1751..#.# Part of the Python Cryptography Toolkit.#.# Written by Andrew Kuchling and others.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1842
Entropy (8bit):	5.222193530625186
Encrypted:	false
SSDEEP:	48:KwKzC0f4QHlsyHIO5d3D1FhHwDWI51+10xfa9i:Kw80QHzJD2gMfV
MD5:	68EB0CD516852E43BF199C5F7E895758
SHA1:	B8074D8EE42352F02ED1A0ECC41E1901E2E99B3C
SHA-256:	2F000ED7762B04288F046F27D84303E294C7DC906F089539C446D6AE4705C39A
SHA-512:	9BF9A66408253019C6905D937BAF0E40FB8E9BBBA3C893F622A9D538A65E6C4C1AFB6D4E2DB38B263F65F3812556B8AFA2069C0A092BF40A514941599CF7EE0B
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/PublicKey/__init__.py: Self-test for public key crypto.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\is-8AEPA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8721
Entropy (8bit):	5.327600974517616
Encrypted:	false
SSDEEP:	192:vQHvtddhCrYVFr0PYwlVkOr8DDQVDoHzvFM2r4:veRh5VFEflVn8nQKHzvFo
MD5:	D093153D993E2AA5A1A498EFEFB331A1
SHA1:	570275DBB56FDF98D77D9EB0501F7A6718381309
SHA-256:	3B0FCD183FFEFA8443A040055992244EABD6C217AAAA873486B47A90162657EC
SHA-512:	B0A9958F3EC9237574A7F916951688C3A11AE2BC78E2C08F2C3EC35007FF13BEF5B97793FB655811E2C72A2C752D2720AB1E0C2B891C9F70BE6A6B45C541067B
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_ElGamal.py: Self-test for the ElGamal primitive..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\is-8T78R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1842
Entropy (8bit):	5.222193530625186
Encrypted:	false
SSDEEP:	48:KwKzC0f4QHlsyHIO5d3D1FhHwDWI51+10xfa9i:Kw80QHzJD2gMfV
MD5:	68EB0CD516852E43BF199C5F7E895758
SHA1:	B8074D8EE42352F02ED1A0ECC41E1901E2E99B3C
SHA-256:	2F000ED7762B04288F046F27D84303E294C7DC906F089539C446D6AE4705C39A
SHA-512:	9BF9A66408253019C6905D937BAF0E40FB8E9BBBA3C893F622A9D538A65E6C4C1AFB6D4E2DB38B263F65F3812556B8AFA2069C0A092BF40A514941599CF7EE0B
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/PublicKey/__init__.py: Self-test for public key crypto.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\is-B787M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15252
Entropy (8bit):	5.57810750583531
Encrypted:	false
SSDEEP:	384:gelRReFHWXioL+j8QbXiRYr3BnZ2+8jQcGGKZlA:7hf+iGrNk+8f
MD5:	E6CCC968C7508BEC26E1645E0BF9EA2B
SHA1:	1BAFF129AC09F686B957151B8CC7C3B82445A16B
SHA-256:	E56D81C61CF34C7132C08E85FEF2DE9025306F19E2A339F43F4421521A5B4D02
SHA-512:	46A9C20CBE80E68F383426E47CE18E9754F470EC392652466BEC260B5EB7C46A09747776D08DE1D4A0F9503371D30CBB6E9EFE98A9DBBD24AB6F2B84853A4E6B
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_importKey.py: Self-test for importing RSA keys..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\is-F9H8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.109968581409017
Encrypted:	false
SSDEEP:	96:new80QHzJDp/BNFGpn6v7YAkXBAyxut7JkX7o+O9qdMKLbhCZH0VOIpYYy7+AqOt:newNQHdt/9y6MAmBAvf9fhCcz5jIfc
MD5:	DF2DF2E3FF94DBAEAF6AC0A155EC1755
SHA1:	C27378C1919E484B80E964F12FF834B8E6864C4F
SHA-256:	6C3D09F3177AD3F2B4F95E001293064B983136913EE372910C958B8442993728
SHA-512:	428CB8A96B055914D30EC59D183045BEF801D71FFF3521AA50A8B00193737B82995C2C0C5A5F96BD0453E1EEE79CD95395DC6F6C32134B07875CA0F3A7571139
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/PublicKey/test_DSA.py: Self-test for the DSA primitive.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\is-SKCSR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16978
Entropy (8bit):	4.980372008236144
Encrypted:	false
SSDEEP:	192:6wdQHvtlgV2Q0PSM56QThnLfYXNuLF8JarZ:6UergV2Q0PLIWp
MD5:	EDF506E8476D340E78D8C9FA339D39A4
SHA1:	747708545438CD0435669179208F5A639F9DA637
SHA-256:	1C5897B0486A929ED51D66DA712EA05B43600EB6CBACCCD0882AB54F51E4C1D1
SHA-512:	5D6DF9C4FCD314D3EC67F5015B280D07D2F6AA69C1B9017ABDA85105FD692DB74DBC5F20328CC68A0639D6709973C85D2A7173E244C21B8BAAA6FC73CE710351
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_RSA.py: Self-test for the RSA primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\test_DSA.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.109968581409017
Encrypted:	false
SSDEEP:	96:new80QHzJDp/BNFGpn6v7YAkXBAyxut7JkX7o+O9qdMKLbhCZH0VOIpYYy7+AqOt:newNQHdt/9y6MAmBAvf9fhCcz5jIfc
MD5:	DF2DF2E3FF94DBAEAF6AC0A155EC1755
SHA1:	C27378C1919E484B80E964F12FF834B8E6864C4F
SHA-256:	6C3D09F3177AD3F2B4F95E001293064B983136913EE372910C958B8442993728
SHA-512:	428CB8A96B055914D30EC59D183045BEF801D71FFF3521AA50A8B00193737B82995C2C0C5A5F96BD0453E1EEE79CD95395DC6F6C32134B07875CA0F3A7571139
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/PublicKey/test_DSA.py: Self-test for the DSA primitive.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\test_ElGamal.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8721
Entropy (8bit):	5.327600974517616
Encrypted:	false
SSDEEP:	192:vQHvtddhCrYVFr0PYwlVkOr8DDQVDoHzvFM2r4:veRh5VFEflVn8nQKHzvFo
MD5:	D093153D993E2AA5A1A498EFEFB331A1
SHA1:	570275DBB56FDF98D77D9EB0501F7A6718381309
SHA-256:	3B0FCD183FFEFA8443A040055992244EABD6C217AAAA873486B47A90162657EC
SHA-512:	B0A9958F3EC9237574A7F916951688C3A11AE2BC78E2C08F2C3EC35007FF13BEF5B97793FB655811E2C72A2C752D2720AB1E0C2B891C9F70BE6A6B45C541067B
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_ElGamal.py: Self-test for the ElGamal primitive..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\test_RSA.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16978
Entropy (8bit):	4.980372008236144
Encrypted:	false
SSDEEP:	192:6wdQHvtlgV2Q0PSM56QThnLfYXNuLF8JarZ:6UergV2Q0PLIWp
MD5:	EDF506E8476D340E78D8C9FA339D39A4
SHA1:	747708545438CD0435669179208F5A639F9DA637
SHA-256:	1C5897B0486A929ED51D66DA712EA05B43600EB6CBACCCD0882AB54F51E4C1D1
SHA-512:	5D6DF9C4FCD314D3EC67F5015B280D07D2F6AA69C1B9017ABDA85105FD692DB74DBC5F20328CC68A0639D6709973C85D2A7173E244C21B8BAAA6FC73CE710351
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_RSA.py: Self-test for the RSA primitive..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTI

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\PublicKey\test_importKey.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	15252
Entropy (8bit):	5.57810750583531
Encrypted:	false
SSDEEP:	384:gelRReFHWXioL+j8QbXiRYr3BnZ2+8jQcGGKZlA:7hf+iGrNk+8f
MD5:	E6CCC968C7508BEC26E1645E0BF9EA2B
SHA1:	1BAFF129AC09F686B957151B8CC7C3B82445A16B
SHA-256:	E56D81C61CF34C7132C08E85FEF2DE9025306F19E2A339F43F4421521A5B4D02
SHA-512:	46A9C20CBE80E68F383426E47CE18E9754F470EC392652466BEC260B5EB7C46A09747776D08DE1D4A0F9503371D30CBB6E9EFE98A9DBBD24AB6F2B84853A4E6B
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/PublicKey/test_importKey.py: Self-test for importing RSA keys..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\Fortuna\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	5.2233407057303545
Encrypted:	false
SSDEEP:	48:6+UwKzC0f4QHlsyHIO5d3D1FeytwRXvXpRyny5tfa90:4w80QHzJDUvbfd
MD5:	ED75E0D066297B9D132179EFF2C19AD0
SHA1:	80744816896CE3EA7A1E176843FEC4E42ABDC3A0
SHA-256:	D23133702E15C4B4409D2AE8095FB192D79594EF6C5BC73FDBE9E574A7A5C398
SHA-512:	135CBCDED773078562EB67BB46D2256F0D0B3192826A460F53C6E4601418243BDC4A831AD70E63C8EE5CC6CEED1EA42E49196AD349EC0430797D433ADA9289DA
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/Fortuna/__init__.py: Self-test for Fortuna modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTW

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\Fortuna\is-3SKD2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3506
Entropy (8bit):	5.22226187128497
Encrypted:	false
SSDEEP:	48:6+IytW3wKzC0f4QHlsyHIO5d3D1F2yVqf+PslQ4GxKC3yWVTEb5yopl7q+9cdMiL:yw80QHzJDSiN9sP8G99VhdP5c
MD5:	DF1956CA3251B061178D0E0062BDB841
SHA1:	084855754E89092FF907A416FB98DC53A61F6F9F
SHA-256:	695C51C48EF4D3DC4CD088D4B7682617A662649B99A560176442DE6195807B33
SHA-512:	6F98E8EB4B44F3B461478D71BD980F354D44F5C6C9F1D078A0A336AD7E54DBF64B00D20187EABF0DE5AC55FDC4AD06AFF89ACB66FF814034C1E64BC4F8C89783
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/Fortuna/test_FortunaGenerator.py: Self-test for the FortunaGenerator module.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\Fortuna\is-AORLV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8844
Entropy (8bit):	5.225695919793824
Encrypted:	false
SSDEEP:	192:i62wdQHvMmtg3rHIn0nphxDF9qZpjL89eXYJWBSEnER2rcdqYXCooCyEJELMEHEZ:i62UeMmtg3rHIn0nphxDF9qpjL89eXYt
MD5:	F25C1986BA4C3BB8B134767AD7878FD6
SHA1:	24C91569193667C36B5CB3BE442A27AF2F65ABCF
SHA-256:	92EB546302516A93B63A4459A4C5FB4F87BE35378030573D96109B2CF6587516
SHA-512:	3761207EF0D0C28029BFD643BE374C9FE468F4CC87F1982A5BBF2576C72A5D63C13BA319BAD0C95C1583CEB27338301276ED1DB945872633D28CB2162DBA36DA
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Random/Fortuna/test_FortunaAccumulator.py: Self-test for the FortunaAccumulator module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\Fortuna\is-NO45P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2419
Entropy (8bit):	5.430708445161965
Encrypted:	false
SSDEEP:	48:6+mwKzC0f4QHlsyHIO5d3D1FLyg0Qw0AQrC48ej3+Km6y7J0Icwk5a9i:yw80QHzJDNwlw98qM0I9eV
MD5:	965472D0F03CB712B3343A467FCF7A71
SHA1:	B79F7E43FA57C7B6A092261CB6DB85A55FB13F24
SHA-256:	842A35CE63F5544F74B70D576B9CCD0E1CF8D8A63A65FD40EB210C948411E51D
SHA-512:	401626765A72005A41364A858F66B5C12C78D4FC4ADA9898EF7B6AC57CB49E5BB0170E24B2803DB04DAE5D88566FDEC7686B96909FA5A4BFF33B2B8F954BE54A
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/Fortuna/test_SHAd256.py: Self-test for the SHAd256 hash function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\Fortuna\is-NPVRI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	5.2233407057303545
Encrypted:	false
SSDEEP:	48:6+UwKzC0f4QHlsyHIO5d3D1FeytwRXvXpRyny5tfa90:4w80QHzJDUvbfd
MD5:	ED75E0D066297B9D132179EFF2C19AD0
SHA1:	80744816896CE3EA7A1E176843FEC4E42ABDC3A0
SHA-256:	D23133702E15C4B4409D2AE8095FB192D79594EF6C5BC73FDBE9E574A7A5C398
SHA-512:	135CBCDED773078562EB67BB46D2256F0D0B3192826A460F53C6E4601418243BDC4A831AD70E63C8EE5CC6CEED1EA42E49196AD349EC0430797D433ADA9289DA
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/Fortuna/__init__.py: Self-test for Fortuna modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTW

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\Fortuna\test_FortunaAccumulator.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8844
Entropy (8bit):	5.225695919793824
Encrypted:	false
SSDEEP:	192:i62wdQHvMmtg3rHIn0nphxDF9qZpjL89eXYJWBSEnER2rcdqYXCooCyEJELMEHEZ:i62UeMmtg3rHIn0nphxDF9qpjL89eXYt
MD5:	F25C1986BA4C3BB8B134767AD7878FD6
SHA1:	24C91569193667C36B5CB3BE442A27AF2F65ABCF
SHA-256:	92EB546302516A93B63A4459A4C5FB4F87BE35378030573D96109B2CF6587516
SHA-512:	3761207EF0D0C28029BFD643BE374C9FE468F4CC87F1982A5BBF2576C72A5D63C13BA319BAD0C95C1583CEB27338301276ED1DB945872633D28CB2162DBA36DA
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Random/Fortuna/test_FortunaAccumulator.py: Self-test for the FortunaAccumulator module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\Fortuna\test_FortunaGenerator.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3506
Entropy (8bit):	5.22226187128497
Encrypted:	false
SSDEEP:	48:6+IytW3wKzC0f4QHlsyHIO5d3D1F2yVqf+PslQ4GxKC3yWVTEb5yopl7q+9cdMiL:yw80QHzJDSiN9sP8G99VhdP5c
MD5:	DF1956CA3251B061178D0E0062BDB841
SHA1:	084855754E89092FF907A416FB98DC53A61F6F9F
SHA-256:	695C51C48EF4D3DC4CD088D4B7682617A662649B99A560176442DE6195807B33
SHA-512:	6F98E8EB4B44F3B461478D71BD980F354D44F5C6C9F1D078A0A336AD7E54DBF64B00D20187EABF0DE5AC55FDC4AD06AFF89ACB66FF814034C1E64BC4F8C89783
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/Fortuna/test_FortunaGenerator.py: Self-test for the FortunaGenerator module.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\Fortuna\test_SHAd256.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2419
Entropy (8bit):	5.430708445161965
Encrypted:	false
SSDEEP:	48:6+mwKzC0f4QHlsyHIO5d3D1FLyg0Qw0AQrC48ej3+Km6y7J0Icwk5a9i:yw80QHzJDNwlw98qM0I9eV
MD5:	965472D0F03CB712B3343A467FCF7A71
SHA1:	B79F7E43FA57C7B6A092261CB6DB85A55FB13F24
SHA-256:	842A35CE63F5544F74B70D576B9CCD0E1CF8D8A63A65FD40EB210C948411E51D
SHA-512:	401626765A72005A41364A858F66B5C12C78D4FC4ADA9898EF7B6AC57CB49E5BB0170E24B2803DB04DAE5D88566FDEC7686B96909FA5A4BFF33B2B8F954BE54A
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/Fortuna/test_SHAd256.py: Self-test for the SHAd256 hash function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2082
Entropy (8bit):	5.174150903212101
Encrypted:	false
SSDEEP:	48:6p5DwKzC0f4QHlsyHIO5d3D1FLy6W5GlV8FhZtfa90:mDw80QHzJDVWHPfd
MD5:	660431F955ADB5708E6BD69DA72D6DD3
SHA1:	0C4D99638E1E622AD67E2652B96322EC93F2C9E1
SHA-256:	187CB7E72E4EB04740BDED68B5AB31F9DD4FE949C023D01C58CDE9B253472104
SHA-512:	75FE76C18E445AA492EAC02D51190471E09ED9D26851FBEDCFCA453C0F73054F1F65C496AF38B13B0497707FFA93B1D17FAA011EEFA0DEC9E8BDE494B847E6B8
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/OSRNG/__init__.py: Self-test for OSRNG modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\is-0JVCJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1746
Entropy (8bit):	5.214963894136889
Encrypted:	false
SSDEEP:	48:NGwKzC0f4QHlsyHIO5d3D1FLyGXSoEykytQyUyJaEi:Yw80QHzJDYuJc
MD5:	6312DE4A930B626FD019A3F83A6DAB32
SHA1:	CABC1B762C6074F954C5717595E40BC12B8B7250
SHA-256:	F3A42064CE00702FC73295EECAEBF03B0DA89611388BEFBC74A0E35D1039FD5F
SHA-512:	663F5C3BEFC574EB24C33E98EABF17062CF708E281B87A568076FF4E669425A0AE58C89E4AFB8D69545B2A17D71FE3BC4649B1E9659B7DA1634E7069BFB90455
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_generic.py: Self-test for the OSRNG.new() function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\is-6CR2E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1764
Entropy (8bit):	5.213840305012926
Encrypted:	false
SSDEEP:	48:N0wKzC0f4QHlsyHIO5d3D1FLy1oEyWyRQy4yJaEi:6w80QHzJDmAJc
MD5:	90810A99EA53BB6FF376B8D93CCF7683
SHA1:	C10D8FF4714AF54E51858FCD5C4FFF62AB99B2A7
SHA-256:	AA9C4BF84AFBBDE2F10051ED81EA95565A6EEDA19B285DD676DD316B27E76014
SHA-512:	E706BF89E65E37B3A7F627D09982FEB0AAAB681551375E974CF6D41B10F9087E7122B62B169644F001EBE403F08BDD5244DD404E688F1C6B79CD178E1964EEC7
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_generic.py: Self-test for the OSRNG.nt.new() function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\is-B0I5Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1777
Entropy (8bit):	5.226962159962093
Encrypted:	false
SSDEEP:	48:YAwKzC0f4QHlsyHIO5d3D1FLycoEyfjy+QyfpyJaEi:YAw80QHzJDVW1cJc
MD5:	BBFF2C2A9F23D5344D77BE3182B03045
SHA1:	02FB781EF3046F8A40288252D674762C4A33C25E
SHA-256:	E5FE764B1420D5D00F8DC38F6341A5B658391E926442A1CA2C9F73946DC92A56
SHA-512:	EBD335AC996288B9016790AE84C688B94C1425E2A205BC7D16700CA0A08E71210A1FE2C1825AFC3CD430D9A8CAD4CA2DAFBFD8D4C688B84EF8B3D4F06BEE7875
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_posix.py: Self-test for the OSRNG.posix.new() function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\is-FMD5V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1777
Entropy (8bit):	5.214995805634398
Encrypted:	false
SSDEEP:	48:v3wKzC0f4QHlsyHIO5d3D1FLyeoEy9yVtoyJaEi:/w80QHzJDjVJc
MD5:	D154C2499DA39B9616E081468CD36A8F
SHA1:	1D9907B7D8DF18AE7F9A7BB50E06FCB436A396BE
SHA-256:	F3887913EBC4E94040E79B41AA4F66DEADF48C15D0CD7B30184FD13C49DEE55A
SHA-512:	3A9B8377DF92A8C0F20072D3B085988A2758453810FFB90D7D8D0098578DE1CD8F2434F4E48991431BC22B99B4635C412EB0DEB358FA153782B54795A3C79842
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_winrandom.py: Self-test for the winrandom module.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\is-IVIBM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1795
Entropy (8bit):	5.248585777700819
Encrypted:	false
SSDEEP:	48:rwKzC0f4QHlsyHIO5d3D1FLy5oEyqylQysyJaEi:rw80QHzJDGoJc
MD5:	C3841805E8C19215831425358258238C
SHA1:	77102A044915F87FF7F7056FF3E56BDE11371330
SHA-256:	A517B299E13C6AD6D678E8AA98BBB733AE8AD3B67259A5219D37CC4F5608E644
SHA-512:	BFC7B3A878A5CF08546544630A9239F2F5966DFB7543C63E5840323FB7E2CDC3004B5492931542F155DFCDD66879A004322039394CABC818F929F86162AF42DB
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_fallback.py: Self-test for the OSRNG.fallback.new() function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION W

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\is-LR1J1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2082
Entropy (8bit):	5.174150903212101
Encrypted:	false
SSDEEP:	48:6p5DwKzC0f4QHlsyHIO5d3D1FLy6W5GlV8FhZtfa90:mDw80QHzJDVWHPfd
MD5:	660431F955ADB5708E6BD69DA72D6DD3
SHA1:	0C4D99638E1E622AD67E2652B96322EC93F2C9E1
SHA-256:	187CB7E72E4EB04740BDED68B5AB31F9DD4FE949C023D01C58CDE9B253472104
SHA-512:	75FE76C18E445AA492EAC02D51190471E09ED9D26851FBEDCFCA453C0F73054F1F65C496AF38B13B0497707FFA93B1D17FAA011EEFA0DEC9E8BDE494B847E6B8
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/OSRNG/__init__.py: Self-test for OSRNG modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\test_fallback.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1795
Entropy (8bit):	5.248585777700819
Encrypted:	false
SSDEEP:	48:rwKzC0f4QHlsyHIO5d3D1FLy5oEyqylQysyJaEi:rw80QHzJDGoJc
MD5:	C3841805E8C19215831425358258238C
SHA1:	77102A044915F87FF7F7056FF3E56BDE11371330
SHA-256:	A517B299E13C6AD6D678E8AA98BBB733AE8AD3B67259A5219D37CC4F5608E644
SHA-512:	BFC7B3A878A5CF08546544630A9239F2F5966DFB7543C63E5840323FB7E2CDC3004B5492931542F155DFCDD66879A004322039394CABC818F929F86162AF42DB
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_fallback.py: Self-test for the OSRNG.fallback.new() function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION W

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\test_generic.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1746
Entropy (8bit):	5.214963894136889
Encrypted:	false
SSDEEP:	48:NGwKzC0f4QHlsyHIO5d3D1FLyGXSoEykytQyUyJaEi:Yw80QHzJDYuJc
MD5:	6312DE4A930B626FD019A3F83A6DAB32
SHA1:	CABC1B762C6074F954C5717595E40BC12B8B7250
SHA-256:	F3A42064CE00702FC73295EECAEBF03B0DA89611388BEFBC74A0E35D1039FD5F
SHA-512:	663F5C3BEFC574EB24C33E98EABF17062CF708E281B87A568076FF4E669425A0AE58C89E4AFB8D69545B2A17D71FE3BC4649B1E9659B7DA1634E7069BFB90455
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_generic.py: Self-test for the OSRNG.new() function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\test_nt.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1764
Entropy (8bit):	5.213840305012926
Encrypted:	false
SSDEEP:	48:N0wKzC0f4QHlsyHIO5d3D1FLy1oEyWyRQy4yJaEi:6w80QHzJDmAJc
MD5:	90810A99EA53BB6FF376B8D93CCF7683
SHA1:	C10D8FF4714AF54E51858FCD5C4FFF62AB99B2A7
SHA-256:	AA9C4BF84AFBBDE2F10051ED81EA95565A6EEDA19B285DD676DD316B27E76014
SHA-512:	E706BF89E65E37B3A7F627D09982FEB0AAAB681551375E974CF6D41B10F9087E7122B62B169644F001EBE403F08BDD5244DD404E688F1C6B79CD178E1964EEC7
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_generic.py: Self-test for the OSRNG.nt.new() function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\test_posix.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1777
Entropy (8bit):	5.226962159962093
Encrypted:	false
SSDEEP:	48:YAwKzC0f4QHlsyHIO5d3D1FLycoEyfjy+QyfpyJaEi:YAw80QHzJDVW1cJc
MD5:	BBFF2C2A9F23D5344D77BE3182B03045
SHA1:	02FB781EF3046F8A40288252D674762C4A33C25E
SHA-256:	E5FE764B1420D5D00F8DC38F6341A5B658391E926442A1CA2C9F73946DC92A56
SHA-512:	EBD335AC996288B9016790AE84C688B94C1425E2A205BC7D16700CA0A08E71210A1FE2C1825AFC3CD430D9A8CAD4CA2DAFBFD8D4C688B84EF8B3D4F06BEE7875
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_posix.py: Self-test for the OSRNG.posix.new() function.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\OSRNG\test_winrandom.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1777
Entropy (8bit):	5.214995805634398
Encrypted:	false
SSDEEP:	48:v3wKzC0f4QHlsyHIO5d3D1FLyeoEy9yVtoyJaEi:/w80QHzJDjVJc
MD5:	D154C2499DA39B9616E081468CD36A8F
SHA1:	1D9907B7D8DF18AE7F9A7BB50E06FCB436A396BE
SHA-256:	F3887913EBC4E94040E79B41AA4F66DEADF48C15D0CD7B30184FD13C49DEE55A
SHA-512:	3A9B8377DF92A8C0F20072D3B085988A2758453810FFB90D7D8D0098578DE1CD8F2434F4E48991431BC22B99B4635C412EB0DEB358FA153782B54795A3C79842
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_winrandom.py: Self-test for the winrandom module.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1973
Entropy (8bit):	5.1616568225933666
Encrypted:	false
SSDEEP:	48:6GzwKzC0f4QHlsyHIO5d3D1FTow8YsK2SO2/0fa9i:hw80QHzJD2fV
MD5:	561AB5A686D7CFE4F64FB159450C29B6
SHA1:	594E0BCF71E51B9D2167727D0A7CF2891F70BB66
SHA-256:	DA5AD8E9D8BB8A379658CF70E065FE5C47A946E498DBC6A8AF3573D57E0ADBF5
SHA-512:	6C1CD0C2BE1A9AA0D68EDF8CE226758FE96E0C2494A728A35B41E0DA50C85DD286B7DAF51F1C64EDE3354F6755CE97C90DCF79A812655B23AB3EBB8B3B84E31F
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/__init__.py: Self-test for random number generation modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\is-5G7CM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2030
Entropy (8bit):	5.18382837725869
Encrypted:	false
SSDEEP:	48:v3wKzC0f4QHlsyHIO5d3D1FeaoSioEDheiyJaEi:/w80QHzJDuSiEFJc
MD5:	4C3135A75ED5C9951EC894BE0CA10E4F
SHA1:	13399777DCF6CABE83578F44D7458A05FB9C09A9
SHA-256:	A72DE8FD09A046F5FAB5CBC4A7B25EE979C405C54EFE93A2F865EF81998DF39C
SHA-512:	6771F6B71DE58B42DAE38F2B6D56608A6FB3B4617144ECE62689A3DB350A793D88410A9F5A9ED863143B0B227907103EC932CC1E7493A91B50D19156D4C91658
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_winrandom.py: Self-test for the winrandom module.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\is-G5NKQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5843
Entropy (8bit):	4.904095546100277
Encrypted:	false
SSDEEP:	96:bLfFQHvo7wVFHrxDLcMpDdw9D7+N6ogUHercRrZ:bLdQHvqwf9/pDd+ogHgrZ
MD5:	7E01E4B62154AF96577E255990C3FCAA
SHA1:	57A0BBA9E092FC111B212BB744A8D82ED0A76721
SHA-256:	E6E01A5DF23787E608D669B535BBAC376CBA0763A284E0B34E99C63521C1A2C8
SHA-512:	854A072E49C1D46DED3F5261E23D14B62E115341256C635AC0CB83E1E483A8C6B875E7C6A467C23118251F5980F22551E10275783FD6729F8E10766DE8C24DF6
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..# Self-tests for the user-friendly Crypto.Random interface..#..# Written in 2013 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\is-P97RQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1973
Entropy (8bit):	5.1616568225933666
Encrypted:	false
SSDEEP:	48:6GzwKzC0f4QHlsyHIO5d3D1FTow8YsK2SO2/0fa9i:hw80QHzJD2fV
MD5:	561AB5A686D7CFE4F64FB159450C29B6
SHA1:	594E0BCF71E51B9D2167727D0A7CF2891F70BB66
SHA-256:	DA5AD8E9D8BB8A379658CF70E065FE5C47A946E498DBC6A8AF3573D57E0ADBF5
SHA-512:	6C1CD0C2BE1A9AA0D68EDF8CE226758FE96E0C2494A728A35B41E0DA50C85DD286B7DAF51F1C64EDE3354F6755CE97C90DCF79A812655B23AB3EBB8B3B84E31F
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Random/__init__.py: Self-test for random number generation modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\is-PN2G3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7300
Entropy (8bit):	4.842258098828005
Encrypted:	false
SSDEEP:	192:nwdQHvTzya+isH+rAx7iAkDRyckzfRLyWENIX1dZ:nUeTzya+isMAx7iRDRyLbJREWX9
MD5:	59B2AEE57AD52DB10DDAD805D490A1BD
SHA1:	B5430E26F75839EB7928DE8265B170CFE7B89DFB
SHA-256:	7A6A06AA79943DB901975DC76E774FF7800489EC9B3BAEB560F6AD3090CA9557
SHA-512:	CBA0B116FEC7D152BDA2FCB14ED6D9F3193A78F8A1F5E50FC44E6E4EEA85832E8295A5B48A61A842C1D136A519A50352028D8680FC02E9311597CC44761F4908
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_generic.py: Self-test for the Crypto.Random.new() function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\test__UserFriendlyRNG.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5843
Entropy (8bit):	4.904095546100277
Encrypted:	false
SSDEEP:	96:bLfFQHvo7wVFHrxDLcMpDdw9D7+N6ogUHercRrZ:bLdQHvqwf9/pDd+ogHgrZ
MD5:	7E01E4B62154AF96577E255990C3FCAA
SHA1:	57A0BBA9E092FC111B212BB744A8D82ED0A76721
SHA-256:	E6E01A5DF23787E608D669B535BBAC376CBA0763A284E0B34E99C63521C1A2C8
SHA-512:	854A072E49C1D46DED3F5261E23D14B62E115341256C635AC0CB83E1E483A8C6B875E7C6A467C23118251F5980F22551E10275783FD6729F8E10766DE8C24DF6
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..# Self-tests for the user-friendly Crypto.Random interface..#..# Written in 2013 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\test_random.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7300
Entropy (8bit):	4.842258098828005
Encrypted:	false
SSDEEP:	192:nwdQHvTzya+isH+rAx7iAkDRyckzfRLyWENIX1dZ:nUeTzya+isMAx7iRDRyLbJREWX9
MD5:	59B2AEE57AD52DB10DDAD805D490A1BD
SHA1:	B5430E26F75839EB7928DE8265B170CFE7B89DFB
SHA-256:	7A6A06AA79943DB901975DC76E774FF7800489EC9B3BAEB560F6AD3090CA9557
SHA-512:	CBA0B116FEC7D152BDA2FCB14ED6D9F3193A78F8A1F5E50FC44E6E4EEA85832E8295A5B48A61A842C1D136A519A50352028D8680FC02E9311597CC44761F4908
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_generic.py: Self-test for the Crypto.Random.new() function..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Random\test_rpoolcompat.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2030
Entropy (8bit):	5.18382837725869
Encrypted:	false
SSDEEP:	48:v3wKzC0f4QHlsyHIO5d3D1FeaoSioEDheiyJaEi:/w80QHzJDuSiEFJc
MD5:	4C3135A75ED5C9951EC894BE0CA10E4F
SHA1:	13399777DCF6CABE83578F44D7458A05FB9C09A9
SHA-256:	A72DE8FD09A046F5FAB5CBC4A7B25EE979C405C54EFE93A2F865EF81998DF39C
SHA-512:	6771F6B71DE58B42DAE38F2B6D56608A6FB3B4617144ECE62689A3DB350A793D88410A9F5A9ED863143B0B227907103EC932CC1E7493A91B50D19156D4C91658
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_winrandom.py: Self-test for the winrandom module.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Signature\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	5.227059525785011
Encrypted:	false
SSDEEP:	24:lc+J2w8yXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/Flw8Z4P4yJEyGN:NpEIB0jcQHMsvI/S3oCFOO4LIraZa
MD5:	4F8351D003E614836E0F0DC605B41C78
SHA1:	B4055529EDA497C055639C412AC8034D7AB6EBB1
SHA-256:	7B360AA79454CB4E6F1BBD5F3DDEC113E2FE0C13DBD6B310A77CA16F49D3E81E
SHA-512:	8A2D93EFB86FBAC50C602DF50879DE10A62946608F2D422511D7FE2474A7703DAF4C67ECB576B3E47D692D3F75F83A9EA08095FB887A968A8AFD2D059318AE55
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Signature/__init__.py: Self-test for signature modules..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWA

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Signature\is-C17DJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	5.227059525785011
Encrypted:	false
SSDEEP:	24:lc+J2w8yXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/Flw8Z4P4yJEyGN:NpEIB0jcQHMsvI/S3oCFOO4LIraZa
MD5:	4F8351D003E614836E0F0DC605B41C78
SHA1:	B4055529EDA497C055639C412AC8034D7AB6EBB1
SHA-256:	7B360AA79454CB4E6F1BBD5F3DDEC113E2FE0C13DBD6B310A77CA16F49D3E81E
SHA-512:	8A2D93EFB86FBAC50C602DF50879DE10A62946608F2D422511D7FE2474A7703DAF4C67ECB576B3E47D692D3F75F83A9EA08095FB887A968A8AFD2D059318AE55
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Signature/__init__.py: Self-test for signature modules..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWA

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Signature\is-QI5SB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21011
Entropy (8bit):	4.043292303256478
Encrypted:	false
SSDEEP:	384:uedj7cqOad7/ywbOnS9dOlHSAKz7C6JuGLf:lV7cqOaMwbOS9dOlHDKXNkGLf
MD5:	D3AD2EB6826CD113CD353ACF3BCD2753
SHA1:	0990B305F19C77F81443E356305084A4C8D6FBDF
SHA-256:	2D263ACD24B1F146ACF5C5567FF0F85956E3AE8D2105D05C4E741F93148722F4
SHA-512:	FD62F1F4D7C3648BBC68254CFDA58C66068B8857DC5F1AA625A4587635D3192B9E025809F40D17B3B4191075D4C5F83C4EA70B9253E67AD9C3878BC88E786F5E
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Signature/test_pkcs1_pss.py: Self-test for PKCS#1 PSS signatures..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Signature\is-RRIHH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9690
Entropy (8bit):	4.628740045861077
Encrypted:	false
SSDEEP:	192:wQHv9C15Wy7aXnnVVDEUC5NeFHNHAlx288YfboHmfGIarZ:wegzGFVDEUENeFHMhx0HuGIW
MD5:	51CD4CAB2D12C3E59EC091417A96933B
SHA1:	39F25FE694170E60142EC618DCAF1786778EDCD5
SHA-256:	28D5329D7F12C7FC3153138C0A4BCAE7691F79ECE0233FFA841910128CF95329
SHA-512:	475A0BDB4AB1D24FF8E8DA07EA4B9EF91BE2532EC47FEAC62C560BB52BE7B6E831295A1880BC2706834F4237DDBA00AAA221162B779E49E32110B87920750E9D
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Signature/test_pkcs1_15.py: Self-test for PKCS#1 v1.5 signatures..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Signature\test_pkcs1_15.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9690
Entropy (8bit):	4.628740045861077
Encrypted:	false
SSDEEP:	192:wQHv9C15Wy7aXnnVVDEUC5NeFHNHAlx288YfboHmfGIarZ:wegzGFVDEUENeFHMhx0HuGIW
MD5:	51CD4CAB2D12C3E59EC091417A96933B
SHA1:	39F25FE694170E60142EC618DCAF1786778EDCD5
SHA-256:	28D5329D7F12C7FC3153138C0A4BCAE7691F79ECE0233FFA841910128CF95329
SHA-512:	475A0BDB4AB1D24FF8E8DA07EA4B9EF91BE2532EC47FEAC62C560BB52BE7B6E831295A1880BC2706834F4237DDBA00AAA221162B779E49E32110B87920750E9D
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Signature/test_pkcs1_15.py: Self-test for PKCS#1 v1.5 signatures..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Signature\test_pkcs1_pss.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21011
Entropy (8bit):	4.043292303256478
Encrypted:	false
SSDEEP:	384:uedj7cqOad7/ywbOnS9dOlHSAKz7C6JuGLf:lV7cqOaMwbOS9dOlHDKXNkGLf
MD5:	D3AD2EB6826CD113CD353ACF3BCD2753
SHA1:	0990B305F19C77F81443E356305084A4C8D6FBDF
SHA-256:	2D263ACD24B1F146ACF5C5567FF0F85956E3AE8D2105D05C4E741F93148722F4
SHA-512:	FD62F1F4D7C3648BBC68254CFDA58C66068B8857DC5F1AA625A4587635D3192B9E025809F40D17B3B4191075D4C5F83C4EA70B9253E67AD9C3878BC88E786F5E
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Signature/test_pkcs1_pss.py: Self-test for PKCS#1 PSS signatures..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.189159304691449
Encrypted:	false
SSDEEP:	48:CwKzC0f4QHlsyHIO5d3D1FX+G7lVxfa9i:Cw80QHzJD9DfV
MD5:	F36C41F1EB1BF4CE5C10E0BE9C3388FA
SHA1:	CFF67DBD4EA61F5F28317F30F833F7070EA9DF53
SHA-256:	4DD09643F869D184AAE839DAEABB2B633F9526904A05C106F4BCEA29EBFEBFD6
SHA-512:	09F2F20F0FF17C26BFEFA31B6112187A20EC7A16AF4DFDD4DE7F222D69AEE3AB514961923A1FE417FAA251D0375943948BA3BC888ACA9FFC2A8957492E6FADDB
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/__init__.py: Self-test for utility modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\is-6C4DR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7252
Entropy (8bit):	5.098907712031537
Encrypted:	false
SSDEEP:	96:5bfFQHvoJVFH8kikk6dkklJmuhXxuB6wYf4hCB414hZ:5bdQHvI4kikk6dkQAu4gJECPhZ
MD5:	FD8D51CFE0C21CE2BD643A384A0A3F07
SHA1:	101E1ED8954B216DBB4935B59FDD78500AB38289
SHA-256:	FC9137077A5E4F80623B1141CB48A360E0ECA5EFDFD2D11DD8156B38AEEFEAF7
SHA-512:	B23F125E4168788A4E5C22089A14453BDDD6F59F36D4A70F1B1142AB8C2C3260EF550870A5957BDD8846B672436C49A85EBFF541304A09136D44251B2CB08A18
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_Counter: Self-test for the Crypto.Util.Counter module..#..# Written in 2009 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\is-92I7H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	5.189159304691449
Encrypted:	false
SSDEEP:	48:CwKzC0f4QHlsyHIO5d3D1FX+G7lVxfa9i:Cw80QHzJD9DfV
MD5:	F36C41F1EB1BF4CE5C10E0BE9C3388FA
SHA1:	CFF67DBD4EA61F5F28317F30F833F7070EA9DF53
SHA-256:	4DD09643F869D184AAE839DAEABB2B633F9526904A05C106F4BCEA29EBFEBFD6
SHA-512:	09F2F20F0FF17C26BFEFA31B6112187A20EC7A16AF4DFDD4DE7F222D69AEE3AB514961923A1FE417FAA251D0375943948BA3BC888ACA9FFC2A8957492E6FADDB
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/__init__.py: Self-test for utility modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\is-9UMV9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	5.200864858439139
Encrypted:	false
SSDEEP:	48:v3wKzC0f4QHlsyHIO5d3D1FLARoopXWX6toyRR5aEi:/w80QHzJDcRo6XWARR5c
MD5:	9027FB79D4A47B694917C1E8E5C0D8D0
SHA1:	2F94368E314B3952BE3E53EDC9B523E92B302F23
SHA-256:	1EF04F6408DB93FD6B422AB9C921C23D9438E8E16B5C5A3C12C09265258AE342
SHA-512:	A7DE6727ED69C6E32D32A07ACF8D08C23DC5172DACA7B5F00ED13C8B795F8F1A143B9B1BAE3AE45327CB697184038C03CE746A3F85EA358D4C7516F0D3579CFF
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_winrandom.py: Self-test for the winrandom module.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\is-B5RC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10480
Entropy (8bit):	5.132626125414541
Encrypted:	false
SSDEEP:	96:WFQHvoiiH2Kax6Ydsy7D6mBXS1e06zAFAmjZ6qLqhKmh7WfSIuNO1vzYXtvZ:kQHvLgSXnd5gKkfUA1vEdvZ
MD5:	23A9BD4EA3FA749E2C2FE039C443105D
SHA1:	14E1C0A168FD9BD8012CBB459DB4831F4CA3FFEF
SHA-256:	01B9AAA2B1B933894C5EEEBADDD741CDEE5D4D6B4019A11ECC37999DEE2E3ABD
SHA-512:	9E8168DCBC3408EB52A340A3E2370AEF02E2B62CD8EB170C44F04ADEFC33611976470605936E3A2076603328CA56F7314FB0F03E366B6BB2C692C5E4DF60C71E
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_asn.py: Self-test for the Crypto.Util.asn1 module..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# S

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\is-E8K4S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with very long lines (303), with CRLF line terminators
Category:	dropped
Size (bytes):	13157
Entropy (8bit):	4.9300203660843875
Encrypted:	false
SSDEEP:	192:jwdQHvZ3diOGRvnilIrFknb3Rp+gHi7vZ:jUeZOnXrFknbrpHo
MD5:	EA6B25C731A9F6B9AFFDF766C00DF447
SHA1:	FD68D42039C2EC14B088AB40EEF6A6C59C1FAD28
SHA-256:	A8177EBFBF51A3A44CE7D829206E5E074075CC5BCFBFBEE4DB0847F7229593C4
SHA-512:	AA42FEC77DC3A7FE59D074748612B203B1A464DA9AB08522B69197EFA6DEAEE7BD0DBA34D1F0A7C6353D7C5FDFA0B73ADCFDD4A975AB3A6C1D185354543D31C4
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_number.py: Self-test for parts of the Crypto.Util.number module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT O

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\test_Counter.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7252
Entropy (8bit):	5.098907712031537
Encrypted:	false
SSDEEP:	96:5bfFQHvoJVFH8kikk6dkklJmuhXxuB6wYf4hCB414hZ:5bdQHvI4kikk6dkQAu4gJECPhZ
MD5:	FD8D51CFE0C21CE2BD643A384A0A3F07
SHA1:	101E1ED8954B216DBB4935B59FDD78500AB38289
SHA-256:	FC9137077A5E4F80623B1141CB48A360E0ECA5EFDFD2D11DD8156B38AEEFEAF7
SHA-512:	B23F125E4168788A4E5C22089A14453BDDD6F59F36D4A70F1B1142AB8C2C3260EF550870A5957BDD8846B672436C49A85EBFF541304A09136D44251B2CB08A18
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_Counter: Self-test for the Crypto.Util.Counter module..#..# Written in 2009 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\test_asn1.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10480
Entropy (8bit):	5.132626125414541
Encrypted:	false
SSDEEP:	96:WFQHvoiiH2Kax6Ydsy7D6mBXS1e06zAFAmjZ6qLqhKmh7WfSIuNO1vzYXtvZ:kQHvLgSXnd5gKkfUA1vEdvZ
MD5:	23A9BD4EA3FA749E2C2FE039C443105D
SHA1:	14E1C0A168FD9BD8012CBB459DB4831F4CA3FFEF
SHA-256:	01B9AAA2B1B933894C5EEEBADDD741CDEE5D4D6B4019A11ECC37999DEE2E3ABD
SHA-512:	9E8168DCBC3408EB52A340A3E2370AEF02E2B62CD8EB170C44F04ADEFC33611976470605936E3A2076603328CA56F7314FB0F03E366B6BB2C692C5E4DF60C71E
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_asn.py: Self-test for the Crypto.Util.asn1 module..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# S

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\test_number.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with very long lines (303), with CRLF line terminators
Category:	dropped
Size (bytes):	13157
Entropy (8bit):	4.9300203660843875
Encrypted:	false
SSDEEP:	192:jwdQHvZ3diOGRvnilIrFknb3Rp+gHi7vZ:jUeZOnXrFknbrpHo
MD5:	EA6B25C731A9F6B9AFFDF766C00DF447
SHA1:	FD68D42039C2EC14B088AB40EEF6A6C59C1FAD28
SHA-256:	A8177EBFBF51A3A44CE7D829206E5E074075CC5BCFBFBEE4DB0847F7229593C4
SHA-512:	AA42FEC77DC3A7FE59D074748612B203B1A464DA9AB08522B69197EFA6DEAEE7BD0DBA34D1F0A7C6353D7C5FDFA0B73ADCFDD4A975AB3A6C1D185354543D31C4
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/Util/test_number.py: Self-test for parts of the Crypto.Util.number module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT O

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\Util\test_winrandom.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	5.200864858439139
Encrypted:	false
SSDEEP:	48:v3wKzC0f4QHlsyHIO5d3D1FLARoopXWX6toyRR5aEi:/w80QHzJDcRo6XWARR5c
MD5:	9027FB79D4A47B694917C1E8E5C0D8D0
SHA1:	2F94368E314B3952BE3E53EDC9B523E92B302F23
SHA-256:	1EF04F6408DB93FD6B422AB9C921C23D9438E8E16B5C5A3C12C09265258AE342
SHA-512:	A7DE6727ED69C6E32D32A07ACF8D08C23DC5172DACA7B5F00ED13C8B795F8F1A143B9B1BAE3AE45327CB697184038C03CE746A3F85EA358D4C7516F0D3579CFF
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/Util/test_winrandom.py: Self-test for the winrandom module.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3504
Entropy (8bit):	5.053777103809423
Encrypted:	false
SSDEEP:	96:newfFQHvov0F1qGq1xpSKgEkyKoLJeIKzDrZ:newdQHvv0T+EkyKoL4IwrZ
MD5:	E049CF77651291A9D48F6DF7550BC6E2
SHA1:	9BCD7053AEA5A42B03768F16527BA5EDF7560602
SHA-256:	9153A73A212BF73937A80F41942B4A00B9E1B9F878F40861F641F844BDB4E046
SHA-512:	E5942B5DEE7D983B644D434EDB67C7FCDA1C5C3DE164A523FF4B45241325018C8C342A585621729A66AF6E1F97066CA3109B4DAC6E8A2FED335529B40C50DAF6
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/__init__.py: Self-test for PyCrypto..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWAR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\is-SPTFN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	5.205190254088721
Encrypted:	false
SSDEEP:	48:xwKzC0f4QHlsyHIO5d3D1F6Xf+PslQqyjvIG8wvilR+O9uBTf5fT9:xw80QHzJDiiNdTiRzUB1fT9
MD5:	5376CB2EB5B6427C460034ABA1B51DA8
SHA1:	6C9CDE756760D446E34CBD4F498FCBEB538AA709
SHA-256:	AA2D6E3A59B0D3A537D830FDB56198645F40DE803B3C97F15956F1E1DF0CC6B1
SHA-512:	AB5DE8B0A41A04342C3F884AAE24A7E23C47616ECD9E4F64C2CE2BD26906069209D8E26944D11275557941B6F0B29F394FC117643BC57AFF1DA0B889BDE5614F
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/st_common.py: Common functions for SelfTest modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\is-TC6VO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3504
Entropy (8bit):	5.053777103809423
Encrypted:	false
SSDEEP:	96:newfFQHvov0F1qGq1xpSKgEkyKoLJeIKzDrZ:newdQHvv0T+EkyKoL4IwrZ
MD5:	E049CF77651291A9D48F6DF7550BC6E2
SHA1:	9BCD7053AEA5A42B03768F16527BA5EDF7560602
SHA-256:	9153A73A212BF73937A80F41942B4A00B9E1B9F878F40861F641F844BDB4E046
SHA-512:	E5942B5DEE7D983B644D434EDB67C7FCDA1C5C3DE164A523FF4B45241325018C8C342A585621729A66AF6E1F97066CA3109B4DAC6E8A2FED335529B40C50DAF6
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# SelfTest/__init__.py: Self-test for PyCrypto..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWAR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\SelfTest\st_common.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	5.205190254088721
Encrypted:	false
SSDEEP:	48:xwKzC0f4QHlsyHIO5d3D1F6Xf+PslQqyjvIG8wvilR+O9uBTf5fT9:xw80QHzJDiiNdTiRzUB1fT9
MD5:	5376CB2EB5B6427C460034ABA1B51DA8
SHA1:	6C9CDE756760D446E34CBD4F498FCBEB538AA709
SHA-256:	AA2D6E3A59B0D3A537D830FDB56198645F40DE803B3C97F15956F1E1DF0CC6B1
SHA-512:	AB5DE8B0A41A04342C3F884AAE24A7E23C47616ECD9E4F64C2CE2BD26906069209D8E26944D11275557941B6F0B29F394FC117643BC57AFF1DA0B889BDE5614F
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# SelfTest/st_common.py: Common functions for SelfTest modules.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Signature\PKCS1_PSS.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12544
Entropy (8bit):	4.8651172722130465
Encrypted:	false
SSDEEP:	192:YQHvNYgFDR4Ns96Mg/yXF9rq9FaEKINhFfHi:YeGg5RMscfyXi9GCo
MD5:	E1ED11700B831D291E8683211764742F
SHA1:	150DC5EB872954F9EA2A75D7214047E6B895AC67
SHA-256:	52D635C994EECC82E20D239DA55273DB85E6B82419197CFCA63000C59847C184
SHA-512:	B14F80A24641D83BB3F13254239780426E46E8C7E6055DF91EAD07F4AD672ABB8FD3B8B865C6AF9C69444205B230D8F6977909A15FF5EA9D058415C663D36B60
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# Signature/PKCS1_PSS.py : PKCS#1 PPS..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# =====================

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Signature\PKCS1_v1_5.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8637
Entropy (8bit):	4.946428465815848
Encrypted:	false
SSDEEP:	192:uQHdZB63ebsniw8ruf5+bBhRkT812Ijw9:uobIebsniw8eCkE/0
MD5:	C25B1DFA197BF5C7403166B57BCACABF
SHA1:	9CA887D7A5DF15C4D1C99B6DFDA69C3CB9D7765F
SHA-256:	E33175517C78EAE378DCAEE345A8C964553C229AF1606E2E6A5A068444B4772F
SHA-512:	91769694FCB2AACC7F38D228C6B6A1D17BD176039EA26EB84A0B5A067FBC7914A1C620C29744CAFFDD5CD4EEBFE5C4FEFEC509CE87A0D0C62F4758FF6F0EC309
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# Signature/PKCS1-v1_5.py : PKCS#1 v1.5.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# =======================================

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Signature\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	5.156127163265321
Encrypted:	false
SSDEEP:	24:lQDrFU/F2bXPBlCXCpfK9QHlsUjH8Ok46+d5Eo3DqeF6VTkNtIf:ozC0f4QHlsyHIO5d3D1F2utIf
MD5:	F80A51D47622E650CF4BF974BA6D5AC1
SHA1:	3C395F37E429230089514096C7F3C97F7B89870A
SHA-256:	79D236CC317DC199EDDAD194325FB9418C2C1DDB296535EC0A8B767B0B2FCA5D
SHA-512:	E430CFF053485A8B45C5DDB95FBAF0AA58A118F26145BC7C2DEA7D146158488F89FD333D6BDE8D220E7923BD626F73A26AC8A3B1A0D20CFEC28EBF2C85D084F8
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# ===================================================================.."""Digital si

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Signature\is-1D463.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	12544
Entropy (8bit):	4.8651172722130465
Encrypted:	false
SSDEEP:	192:YQHvNYgFDR4Ns96Mg/yXF9rq9FaEKINhFfHi:YeGg5RMscfyXi9GCo
MD5:	E1ED11700B831D291E8683211764742F
SHA1:	150DC5EB872954F9EA2A75D7214047E6B895AC67
SHA-256:	52D635C994EECC82E20D239DA55273DB85E6B82419197CFCA63000C59847C184
SHA-512:	B14F80A24641D83BB3F13254239780426E46E8C7E6055DF91EAD07F4AD672ABB8FD3B8B865C6AF9C69444205B230D8F6977909A15FF5EA9D058415C663D36B60
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# Signature/PKCS1_PSS.py : PKCS#1 PPS..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# =====================

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Signature\is-TJM95.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8637
Entropy (8bit):	4.946428465815848
Encrypted:	false
SSDEEP:	192:uQHdZB63ebsniw8ruf5+bBhRkT812Ijw9:uobIebsniw8eCkE/0
MD5:	C25B1DFA197BF5C7403166B57BCACABF
SHA1:	9CA887D7A5DF15C4D1C99B6DFDA69C3CB9D7765F
SHA-256:	E33175517C78EAE378DCAEE345A8C964553C229AF1606E2E6A5A068444B4772F
SHA-512:	91769694FCB2AACC7F38D228C6B6A1D17BD176039EA26EB84A0B5A067FBC7914A1C620C29744CAFFDD5CD4EEBFE5C4FEFEC509CE87A0D0C62F4758FF6F0EC309
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# Signature/PKCS1-v1_5.py : PKCS#1 v1.5.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# =======================================

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Signature\is-TVIBP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	5.156127163265321
Encrypted:	false
SSDEEP:	24:lQDrFU/F2bXPBlCXCpfK9QHlsUjH8Ok46+d5Eo3DqeF6VTkNtIf:ozC0f4QHlsyHIO5d3D1F2utIf
MD5:	F80A51D47622E650CF4BF974BA6D5AC1
SHA1:	3C395F37E429230089514096C7F3C97F7B89870A
SHA-256:	79D236CC317DC199EDDAD194325FB9418C2C1DDB296535EC0A8B767B0B2FCA5D
SHA-512:	E430CFF053485A8B45C5DDB95FBAF0AA58A118F26145BC7C2DEA7D146158488F89FD333D6BDE8D220E7923BD626F73A26AC8A3B1A0D20CFEC28EBF2C85D084F8
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# ===================================================================.."""Digital si

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\Counter.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5283
Entropy (8bit):	5.031608717797287
Encrypted:	false
SSDEEP:	96:MRwfFQHvozxmE6I+VFH1CXR1RutGGHIOkagvNHK89r1uHH8g56z3:MRwdQHvogXGRbut3KHdr1un8g56T
MD5:	4461E23127DBF268EC4FA66D197A2B33
SHA1:	FBED3B0FA5A59A55027B29206A9ABC843A263E62
SHA-256:	F8DF8958F6A31DB1894E6267F2341DAA75D0D5E159F725AEB4F62D9E41DB25CE
SHA-512:	8DBAF905A4C415975B1117CE627E21AC5423C602B1473A004F543042CF173FDEDD97A299F8D3CFF168322DC92AEA34196157192973024C10884333233D5A46B0
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: ascii --..#..# Util/Counter.py : Fast counter for use with CTR-mode ciphers..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\RFC1751.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21573
Entropy (8bit):	4.638389402748072
Encrypted:	false
SSDEEP:	384:aPe8Xm4V+EE2tKm/8MboR6U/6LcleM6s4riu6gvZGVSRq6o:DUHQgRGVe3o
MD5:	829EDFE9BD8E6E17FB49DE54C513A83C
SHA1:	B04184BD08CC3C991A93E4BB458B84ACE5DC93D0
SHA-256:	90765B9DD3C470AD61A71319043B57604B075648B34DBA59AA6EA63AC7B91584
SHA-512:	D4519D2D154099948ED0AC9960F004D482F06BF2107CD7B05DDBF4EE7029C5E8544349BB7D523A329002F936B09E45841CB35FA239E2642DD8CDAFDC9FF0D152
Malicious:	false
Reputation:	unknown
Preview:	# rfc1751.py : Converts between 128-bit strings and a human-readable..# sequence of words, as defined in RFC1751: "A Convention for..# Human-Readable 128-bit Keys", by Daniel L. McDonald...#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DA

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1507
Entropy (8bit):	5.16568779995555
Encrypted:	false
SSDEEP:	24:lQDrFU/F2bXPBlCXCpfK9QHlsUjH8Ok46+d5Eo3DqeFQ4ApUu/rijkLLY4pFafit:ozC0f4QHlsyHIO5d3D1F/ASu/+Iv7raY
MD5:	8FB568656CC20A5A86415530F85C5C25
SHA1:	36063E667B24962DD698204C5BBCF2264AF38366
SHA-256:	47281FBE40ECEF625EB764B68CDEF3C2D9163925531EC49527A45506FA78BA0B
SHA-512:	5D4511C30D680C464A54B45D190BD9C8244C75CC210C6680D631C24C4E620B47F5DFA5E578876810CFAFBD537A564E932E911BD084CB97D01F9D142222A27102
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# ===================================================================.."""Miscellane

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\_counter.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.395028702149556
Encrypted:	false
SSDEEP:	96:23+oUuECLik+04rAEKQEKA/xQkaebN5QkoCEGDQac7Qg3X7PVAAD6e774:4RECujUTQkoHGDi7r3X7PVlD6eI
MD5:	A56A13B617E922A2EB8046411EBB2332
SHA1:	25BAC620F6B10C3241446BCBA4A8BE29EC1917E5
SHA-256:	DF15DB1387AE0F88D99FC65EA0E57FA6A83BF52B836D7D8E4FDE2A923E9BD843
SHA-512:	423D909BF68981268119056AA97F51809AC9AC97530F776CD0830FBF59144FCA8B6C44007038C785C4BCA6AFF422EB3ED76E860E31E0F7A6AD5502B9061B6F87
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6p.HW..HW..HW..A/..JW..'!..JW..'!..IW..'!..JW..S..KW..HW..zW..'!..EW..'!..IW..'!..IW..RichHW..........................PE..L....5.S...........!......................... ...............................P............@..........................&..O....!..P............................@....................................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...P....0......................@....reloc.......@......."..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\_number_new.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4095
Entropy (8bit):	5.039188768186179
Encrypted:	false
SSDEEP:	96:rwfFQHvohFWVtvpZUPgPlyCklJAarmce3IOrzF:rwdQHvNDnlslJ5eH/F
MD5:	54E771D74633DC1D92E50BABEACE380C
SHA1:	AA5E8128D85FBC961DB4102C02BDC9DBD48DF233
SHA-256:	7CD4D61F51AF774D6A5AF6CD00190FA183B21E531126F7C39C1B788624F27099
SHA-512:	333109AC0A4E1D2C8E50BD2079F446E24AD2D0EC397F3315CD7093866B903058C0FF18ABC81644CFB207B3C9EF9BA4E62E82BA149482B11AA2CA42422BE5C379
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: ascii --..#..# Util/_number_new.py : utility functions..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\asn1.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13019
Entropy (8bit):	4.36942445726337
Encrypted:	false
SSDEEP:	192:aQ2QHvjmblId7nvkjS40DIfTM7A1TG2Z2qPm6aUj:p2ejmbGd7ESNcTM7SjZ2K31
MD5:	FD1B271CDED4F6AFEC56161DE88D6399
SHA1:	3276FB3DF559ACDC04D69BB8EF2BF8A23D113A90
SHA-256:	0BF124E33B05DDA5C98421B582007545AC669FD58CB82D6E4C4423DE9463869D
SHA-512:	ED84DE6709355576E4D66CA964C23EF08D761937F1BB346896A42F77F66ACCD24D8E8B2F8C690C210AE64B92CBD803CB2183FA043B0241A1C7B43E49D81268A2
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: ascii --..#..# Util/asn1.py : Minimal support for ASN.1 DER binary encoding...#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-32OQ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1507
Entropy (8bit):	5.16568779995555
Encrypted:	false
SSDEEP:	24:lQDrFU/F2bXPBlCXCpfK9QHlsUjH8Ok46+d5Eo3DqeFQ4ApUu/rijkLLY4pFafit:ozC0f4QHlsyHIO5d3D1F/ASu/+Iv7raY
MD5:	8FB568656CC20A5A86415530F85C5C25
SHA1:	36063E667B24962DD698204C5BBCF2264AF38366
SHA-256:	47281FBE40ECEF625EB764B68CDEF3C2D9163925531EC49527A45506FA78BA0B
SHA-512:	5D4511C30D680C464A54B45D190BD9C8244C75CC210C6680D631C24C4E620B47F5DFA5E578876810CFAFBD537A564E932E911BD084CB97D01F9D142222A27102
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE.# SOFTWARE..# ===================================================================.."""Miscellane

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-4RV1N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.395028702149556
Encrypted:	false
SSDEEP:	96:23+oUuECLik+04rAEKQEKA/xQkaebN5QkoCEGDQac7Qg3X7PVAAD6e774:4RECujUTQkoHGDi7r3X7PVlD6eI
MD5:	A56A13B617E922A2EB8046411EBB2332
SHA1:	25BAC620F6B10C3241446BCBA4A8BE29EC1917E5
SHA-256:	DF15DB1387AE0F88D99FC65EA0E57FA6A83BF52B836D7D8E4FDE2A923E9BD843
SHA-512:	423D909BF68981268119056AA97F51809AC9AC97530F776CD0830FBF59144FCA8B6C44007038C785C4BCA6AFF422EB3ED76E860E31E0F7A6AD5502B9061B6F87
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6p.HW..HW..HW..A/..JW..'!..JW..'!..IW..'!..JW..S..KW..HW..zW..'!..EW..'!..IW..'!..IW..RichHW..........................PE..L....5.S...........!......................... ...............................P............@..........................&..O....!..P............................@....................................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...P....0......................@....reloc.......@......."..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-4TQOJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2768
Entropy (8bit):	5.074677769152082
Encrypted:	false
SSDEEP:	48:6/2zC0f4QHlsyHIO5d3D1F5Vpyqrsm1yUtyjMfHCBTnN:6/I0QHzJDTPsmM2IN
MD5:	65565E1E99F1A6B4CC7FA8F07E85D9BD
SHA1:	9D3D1497C26D2C05B91041970DA402D4CB93C98C
SHA-256:	F2A4904E0FDA3DFE915079423592505D0E4B64296FC9D356685A840DA1BE1441
SHA-512:	DD2D619486A45B00C066E7B3F52C5F5D118CD86EFC1884C9B1309A2F807F227248F8DB5130B328B74C40A41E007D0776DB2C9323E4A232CBBC8A7F61F5497775
Malicious:	false
Reputation:	unknown
Preview:	#.# randpool.py : Cryptographically strong random number generation.#.# Part of the Python Cryptography Toolkit.#.# Written by Andrew M. Kuchling, Mark Moraes, and others.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WI

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-6NKT2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5283
Entropy (8bit):	5.031608717797287
Encrypted:	false
SSDEEP:	96:MRwfFQHvozxmE6I+VFH1CXR1RutGGHIOkagvNHK89r1uHH8g56z3:MRwdQHvogXGRbut3KHdr1un8g56T
MD5:	4461E23127DBF268EC4FA66D197A2B33
SHA1:	FBED3B0FA5A59A55027B29206A9ABC843A263E62
SHA-256:	F8DF8958F6A31DB1894E6267F2341DAA75D0D5E159F725AEB4F62D9E41DB25CE
SHA-512:	8DBAF905A4C415975B1117CE627E21AC5423C602B1473A004F543042CF173FDEDD97A299F8D3CFF168322DC92AEA34196157192973024C10884333233D5A46B0
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: ascii --..#..# Util/Counter.py : Fast counter for use with CTR-mode ciphers..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-9DEP4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	13019
Entropy (8bit):	4.36942445726337
Encrypted:	false
SSDEEP:	192:aQ2QHvjmblId7nvkjS40DIfTM7A1TG2Z2qPm6aUj:p2ejmbGd7ESNcTM7SjZ2K31
MD5:	FD1B271CDED4F6AFEC56161DE88D6399
SHA1:	3276FB3DF559ACDC04D69BB8EF2BF8A23D113A90
SHA-256:	0BF124E33B05DDA5C98421B582007545AC669FD58CB82D6E4C4423DE9463869D
SHA-512:	ED84DE6709355576E4D66CA964C23EF08D761937F1BB346896A42F77F66ACCD24D8E8B2F8C690C210AE64B92CBD803CB2183FA043B0241A1C7B43E49D81268A2
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: ascii --..#..# Util/asn1.py : Minimal support for ASN.1 DER binary encoding...#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-AJ7M3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4095
Entropy (8bit):	5.039188768186179
Encrypted:	false
SSDEEP:	96:rwfFQHvohFWVtvpZUPgPlyCklJAarmce3IOrzF:rwdQHvNDnlslJ5eH/F
MD5:	54E771D74633DC1D92E50BABEACE380C
SHA1:	AA5E8128D85FBC961DB4102C02BDC9DBD48DF233
SHA-256:	7CD4D61F51AF774D6A5AF6CD00190FA183B21E531126F7C39C1B788624F27099
SHA-512:	333109AC0A4E1D2C8E50BD2079F446E24AD2D0EC397F3315CD7093866B903058C0FF18ABC81644CFB207B3C9EF9BA4E62E82BA149482B11AA2CA42422BE5C379
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: ascii --..#..# Util/_number_new.py : utility functions..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-FFV9F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21573
Entropy (8bit):	4.638389402748072
Encrypted:	false
SSDEEP:	384:aPe8Xm4V+EE2tKm/8MboR6U/6LcleM6s4riu6gvZGVSRq6o:DUHQgRGVe3o
MD5:	829EDFE9BD8E6E17FB49DE54C513A83C
SHA1:	B04184BD08CC3C991A93E4BB458B84ACE5DC93D0
SHA-256:	90765B9DD3C470AD61A71319043B57604B075648B34DBA59AA6EA63AC7B91584
SHA-512:	D4519D2D154099948ED0AC9960F004D482F06BF2107CD7B05DDBF4EE7029C5E8544349BB7D523A329002F936B09E45841CB35FA239E2642DD8CDAFDC9FF0D152
Malicious:	false
Reputation:	unknown
Preview:	# rfc1751.py : Converts between 128-bit strings and a human-readable..# sequence of words, as defined in RFC1751: "A Convention for..# Human-Readable 128-bit Keys", by Daniel L. McDonald...#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DA

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-GKG02.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.764993778836076
Encrypted:	false
SSDEEP:	96:37OcZGexWphdVwjni+t2ykYHwaP+chI+7X3XLPVAAD6eOWPQ96fh:FZxQdVMn55HwapI+7X3XLPVlD6vWPl
MD5:	364CD37D01FFEE88339FC96655F48680
SHA1:	E6D5FB6441479EE3CC09C30CB45B390AC4911CF2
SHA-256:	2BDF57598E67D712C1F73D264B00B8D77A5E5C276E5038A811D57F9D5D126E26
SHA-512:	EE2B0547FADF1B926A13F262C1D9ED9FCCF81112042858B72B9021CFF69250DE68BCDA39D65BA9680D5ED1E82ED7048076D7CF968BE68BE58C05041565239439
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6P.DW>.DW>.DW>.M/..FW>.+!..FW>.+!..EW>.+!..FW>._..GW>.DW?.aW>.+!..IW>.+!..EW>.+!..EW>.RichDW>.........PE..L....5.S...........!......................... ...............................P............@..........................%..K....!..P............................@....................................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-K6DSA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	5.133894214902536
Encrypted:	false
SSDEEP:	24:w4y2my5vwgDrFU/F2bXPBlCXCpfK9QHlsUjH8Ok46+d5Eo3DqeFbCye:EyxwKzC0f4QHlsyHIO5d3D1FbCye
MD5:	85F5CD52D4CD16D3013133154F55B9A5
SHA1:	D0C2B993BAADD217C88A72C7149D896B19CE11E9
SHA-256:	221A44F6E20E74D9965E68F34880AB4CA115A0FD173B16AC6938B89B669F0792
SHA-512:	A1CC2DAB99BE12F700A18C04647FCB6E44DE878FA487C413368943751B5057080F5BAD19FB38D7C82E22BF6E706A07788988DBD80140624E8DD132FA5E7154A0
Malicious:	false
Reputation:	unknown
Preview:	#.# Util/winrandom.py : Stub for Crypto.Random.OSRNG.winrandom.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-N2MNS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4015
Entropy (8bit):	4.9255698360596805
Encrypted:	false
SSDEEP:	96:WKYFQHvoA6pDLeAIeCGtFaVBS3ejRM4ksrgjNPwAEx2ppy/:W9QHvilIUwpjifpw
MD5:	604CA6E677B16FE3C31C484D7DBDCFE1
SHA1:	A63F01162B9689C48ECFFB408B8613D0EBAAB891
SHA-256:	C8A63F2C32121824D9F22575A682EB4AC2F6B519DC2CA8EEE0A4F7FF953C3382
SHA-512:	BF189365E0FC0885C4820243A1DB1B2C0973E1FEDE44566E4B516318C733345A9FD71D2B18FC7147EDBF9637A78192D3607DED9D7F482961577E69457BDA077A
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# Util/py3compat.py : Compatibility code for handling Py3k / Python 2.x..#..# Written in 2010 by Thorsten Behrens..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWA

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\is-RBJN0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	96925
Entropy (8bit):	4.090264067537798
Encrypted:	false
SSDEEP:	1536:EMFqiQaQeUkknbkEEpeoc06BsJ7rajyCJrOiVDtT5U1464iPpAji6R449qVnSPt4:XFNXrtNajhJrOs5uPqe6CJn6KEVama39
MD5:	B62DA2724B0A357EC177E23DAB482A08
SHA1:	D5D617F2705CC9B32ADF437AF1E6BF0E54E0EBF8
SHA-256:	486B31E91AC1458820147A1F9D3642B9AD66B8AAE1710FBA7EE8796F63BCEBB9
SHA-512:	AFDC1C1325680382AD1AE995E9C8D8D065EBF3E3BC0FFD7F5A4F25349DF546BED695143F8D08AEF6BF515EB5CFE663FDB923CD6A0FD2FEC2FD8E6790A9D2D2E3
Malicious:	false
Reputation:	unknown
Preview:	#..# number.py : Number-theoretic functions..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling, Barry A. Warsaw, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\number.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	96925
Entropy (8bit):	4.090264067537798
Encrypted:	false
SSDEEP:	1536:EMFqiQaQeUkknbkEEpeoc06BsJ7rajyCJrOiVDtT5U1464iPpAji6R449qVnSPt4:XFNXrtNajhJrOs5uPqe6CJn6KEVama39
MD5:	B62DA2724B0A357EC177E23DAB482A08
SHA1:	D5D617F2705CC9B32ADF437AF1E6BF0E54E0EBF8
SHA-256:	486B31E91AC1458820147A1F9D3642B9AD66B8AAE1710FBA7EE8796F63BCEBB9
SHA-512:	AFDC1C1325680382AD1AE995E9C8D8D065EBF3E3BC0FFD7F5A4F25349DF546BED695143F8D08AEF6BF515EB5CFE663FDB923CD6A0FD2FEC2FD8E6790A9D2D2E3
Malicious:	false
Reputation:	unknown
Preview:	#..# number.py : Number-theoretic functions..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling, Barry A. Warsaw, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\py3compat.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4015
Entropy (8bit):	4.9255698360596805
Encrypted:	false
SSDEEP:	96:WKYFQHvoA6pDLeAIeCGtFaVBS3ejRM4ksrgjNPwAEx2ppy/:W9QHvilIUwpjifpw
MD5:	604CA6E677B16FE3C31C484D7DBDCFE1
SHA1:	A63F01162B9689C48ECFFB408B8613D0EBAAB891
SHA-256:	C8A63F2C32121824D9F22575A682EB4AC2F6B519DC2CA8EEE0A4F7FF953C3382
SHA-512:	BF189365E0FC0885C4820243A1DB1B2C0973E1FEDE44566E4B516318C733345A9FD71D2B18FC7147EDBF9637A78192D3607DED9D7F482961577E69457BDA077A
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..#..# Util/py3compat.py : Compatibility code for handling Py3k / Python 2.x..#..# Written in 2010 by Thorsten Behrens..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWA

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\randpool.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2768
Entropy (8bit):	5.074677769152082
Encrypted:	false
SSDEEP:	48:6/2zC0f4QHlsyHIO5d3D1F5Vpyqrsm1yUtyjMfHCBTnN:6/I0QHzJDTPsmM2IN
MD5:	65565E1E99F1A6B4CC7FA8F07E85D9BD
SHA1:	9D3D1497C26D2C05B91041970DA402D4CB93C98C
SHA-256:	F2A4904E0FDA3DFE915079423592505D0E4B64296FC9D356685A840DA1BE1441
SHA-512:	DD2D619486A45B00C066E7B3F52C5F5D118CD86EFC1884C9B1309A2F807F227248F8DB5130B328B74C40A41E007D0776DB2C9323E4A232CBBC8A7F61F5497775
Malicious:	false
Reputation:	unknown
Preview:	#.# randpool.py : Cryptographically strong random number generation.#.# Part of the Python Cryptography Toolkit.#.# Written by Andrew M. Kuchling, Mark Moraes, and others.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WI

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\strxor.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.764993778836076
Encrypted:	false
SSDEEP:	96:37OcZGexWphdVwjni+t2ykYHwaP+chI+7X3XLPVAAD6eOWPQ96fh:FZxQdVMn55HwapI+7X3XLPVlD6vWPl
MD5:	364CD37D01FFEE88339FC96655F48680
SHA1:	E6D5FB6441479EE3CC09C30CB45B390AC4911CF2
SHA-256:	2BDF57598E67D712C1F73D264B00B8D77A5E5C276E5038A811D57F9D5D126E26
SHA-512:	EE2B0547FADF1B926A13F262C1D9ED9FCCF81112042858B72B9021CFF69250DE68BCDA39D65BA9680D5ED1E82ED7048076D7CF968BE68BE58C05041565239439
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6P.DW>.DW>.DW>.M/..FW>.+!..FW>.+!..EW>.+!..FW>._..GW>.DW?.aW>.+!..IW>.+!..EW>.+!..EW>.RichDW>.........PE..L....5.S...........!......................... ...............................P............@..........................%..K....!..P............................@....................................... ..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\Crypto\Util\winrandom.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	5.133894214902536
Encrypted:	false
SSDEEP:	24:w4y2my5vwgDrFU/F2bXPBlCXCpfK9QHlsUjH8Ok46+d5Eo3DqeFbCye:EyxwKzC0f4QHlsyHIO5d3D1FbCye
MD5:	85F5CD52D4CD16D3013133154F55B9A5
SHA1:	D0C2B993BAADD217C88A72C7149D896B19CE11E9
SHA-256:	221A44F6E20E74D9965E68F34880AB4CA115A0FD173B16AC6938B89B669F0792
SHA-512:	A1CC2DAB99BE12F700A18C04647FCB6E44DE878FA487C413368943751B5057080F5BAD19FB38D7C82E22BF6E706A07788988DBD80140624E8DD132FA5E7154A0
Malicious:	false
Reputation:	unknown
Preview:	#.# Util/winrandom.py : Stub for Crypto.Random.OSRNG.winrandom.#.# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>.#.# ===================================================================.# The contents of this file are dedicated to the public domain. To.# the extent that dedication to the public domain is not available,.# everyone is granted a worldwide, perpetual, royalty-free,.# non-exclusive license to exercise all rights associated with the.# contents of this file for any purpose whatsoever..# No rights are reserved..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN.# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\EasyHook.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	5.70105107484301
Encrypted:	false
SSDEEP:	768:JPeMSL1fhVolgAYdO2pGRBHF8+kPdSHHzmQy9UQkPC9bonO2vCl:+phAYdO2pGRBHF8+kP0HzngUQMC9by9e
MD5:	304D2A2A1370632114B65076180868D5
SHA1:	4A5DC8D953E6C55705C8C4728994625A26DD6B63
SHA-256:	D7D436862190195BC92980F97B4D07E1F2E999383775DE649CC03EDB7AFD80F6
SHA-512:	B47587E0751277CEC6E825DC778F7CE298389BE75C03660368DC6FE541BF56CF9A7202F8443CEB28AF97A2C0DB60E20A3D1A1933A961614323568893A6D23CEC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f..P...........!..................... ........@.. ....................... ......^.....@.................................H...S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........Q...}..................P .......................................1,.FH..o`9...u..\....U.w.j.O.d.U.1.6/,..m.B..8.8.....D._,...vwQY...L...2...W.Y..6D.....B...N.?#?.f...nf.....\|.("..f.....g...{.C`.........2.!.1..."...Fo......e.`.F.-U..+#5G..L......G..Eo........'+....<...7./?J[ZL.Q..'.F.J.W.....%.....'....0.........................(c...f.....(..... .......(......0..........~....%.(....~.......o....-.s.....~......o.......(......{....o....&..}.....{....o

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\EasyHook32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.0580652450698524
Encrypted:	false
SSDEEP:	1536:nplMtae1D8oDnT2QHcZIy9u3Wi8DBGGLGSA+cMhKLsZwjPo0J:sDX2QC9u3EUnSDcMELgwj/J
MD5:	01314B63A50E1243ADD195F74D403EDB
SHA1:	3C6DD06EEE906E5FE80C1779B6DEDCAFB91DE565
SHA-256:	778F2E07F23852132E5878DFCD1FEED2BB63E84A601E83289F777C23076DCC94
SHA-512:	8609FFBC0158EFBFC0D1847FC4320BFCBFB3FD3DF95185D135AF8B21075ED5E1426C35148C335A94B37B31E4C2A46A638C73717766B3F636D7162173677DA766
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#O..g...g...g...nVo.y...nVh.#...nVx.`...g........!..d...GW..f...nVa.t...nV~.u...nVy.f...nVz.f...Richg...................PE..L...t..P...........!................0................................................................................1..&....)..P....................................................................................................................text...P........................... ..`.rdata...X.......Z..................@..@.data....:...@....... ..............@....rsrc...............................@..@.reloc...............0..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\downloader.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	43425
Entropy (8bit):	4.72148123618982
Encrypted:	false
SSDEEP:	384:hBvAhhUqqhQ6dJdVbYDFu+kwl4MGINUCBv7VV/44hoa3tc1KsSgKgVwMEK7Sh:hB4A1pPdVh9ICYncoNh
MD5:	91CFF4C0BFF36F5401BE0573F248A6BF
SHA1:	15A6165B0AAAE2B098E411FC4891311D10D672BB
SHA-256:	AD635244E89647D1813F4196FF33C459FD26211343DCC374170D28EC72D8EC01
SHA-512:	3426DA9C195429B8005C99A9C396991E78913C3827EBA4E82CFD47ED20F4728170983470AB137F407DAC79818A437C1DCF2026C7E42D71C2EAA703BDA49D40E9
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.# 2017-10-18 win...import win_subprocess...Popen()..unicode...# 2018-01-07 ...............YouTube......................from __future__ import unicode_literals..import os, sys.import re.import shutil.import traceback.import threading.from youtube_dl.downloader.http import HttpFD, HttpNeedQueryRedirectFD.from youtube_dl.downloader.hls import HlsFD.from youtube_dl.downloader.M3u8Downloader import FFmpegFD as FFmpegFDEx.from youtube_dl.downloader.OldM3u8Downloader import WSM3u8FD as WSM3u8FD.from youtube_dl.downloader.external import FFmpegFD.from youtube_dl.downloader.httpCrul import HttpCurl.from youtube_dl.downloader.http_hb import HttpHB.from youtube_dl.utilsEX import (. get_top_host,. sleep,. GoogleAnalytics,. sandboxEnable.)..import youtube_dl.from youtube_dl.compat import (. compat_str,.).from youtube_dl.WS_Extractor import (. YoutubeDLPatch4Single.).try:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\is-I3H0J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	5.70105107484301
Encrypted:	false
SSDEEP:	768:JPeMSL1fhVolgAYdO2pGRBHF8+kPdSHHzmQy9UQkPC9bonO2vCl:+phAYdO2pGRBHF8+kP0HzngUQMC9by9e
MD5:	304D2A2A1370632114B65076180868D5
SHA1:	4A5DC8D953E6C55705C8C4728994625A26DD6B63
SHA-256:	D7D436862190195BC92980F97B4D07E1F2E999383775DE649CC03EDB7AFD80F6
SHA-512:	B47587E0751277CEC6E825DC778F7CE298389BE75C03660368DC6FE541BF56CF9A7202F8443CEB28AF97A2C0DB60E20A3D1A1933A961614323568893A6D23CEC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f..P...........!..................... ........@.. ....................... ......^.....@.................................H...S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........Q...}..................P .......................................1,.FH..o`9...u..\....U.w.j.O.d.U.1.6/,..m.B..8.8.....D._,...vwQY...L...2...W.Y..6D.....B...N.?#?.f...nf.....\|.("..f.....g...{.C`.........2.!.1..."...Fo......e.`.F.-U..+#5G..L......G..Eo........'+....<...7./?J[ZL.Q..'.F.J.W.....%.....'....0.........................(c...f.....(..... .......(......0..........~....%.(....~.......o....-.s.....~......o.......(......{....o....&..}.....{....o

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\is-O8S3K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.0580652450698524
Encrypted:	false
SSDEEP:	1536:nplMtae1D8oDnT2QHcZIy9u3Wi8DBGGLGSA+cMhKLsZwjPo0J:sDX2QC9u3EUnSDcMELgwj/J
MD5:	01314B63A50E1243ADD195F74D403EDB
SHA1:	3C6DD06EEE906E5FE80C1779B6DEDCAFB91DE565
SHA-256:	778F2E07F23852132E5878DFCD1FEED2BB63E84A601E83289F777C23076DCC94
SHA-512:	8609FFBC0158EFBFC0D1847FC4320BFCBFB3FD3DF95185D135AF8B21075ED5E1426C35148C335A94B37B31E4C2A46A638C73717766B3F636D7162173677DA766
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#O..g...g...g...nVo.y...nVh.#...nVx.`...g........!..d...GW..f...nVa.t...nV~.u...nVy.f...nVz.f...Richg...................PE..L...t..P...........!................0................................................................................1..&....)..P....................................................................................................................text...P........................... ..`.rdata...X.......Z..................@..@.data....:...@....... ..............@....rsrc...............................@..@.reloc...............0..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\is-VPUQ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	43425
Entropy (8bit):	4.72148123618982
Encrypted:	false
SSDEEP:	384:hBvAhhUqqhQ6dJdVbYDFu+kwl4MGINUCBv7VV/44hoa3tc1KsSgKgVwMEK7Sh:hB4A1pPdVh9ICYncoNh
MD5:	91CFF4C0BFF36F5401BE0573F248A6BF
SHA1:	15A6165B0AAAE2B098E411FC4891311D10D672BB
SHA-256:	AD635244E89647D1813F4196FF33C459FD26211343DCC374170D28EC72D8EC01
SHA-512:	3426DA9C195429B8005C99A9C396991E78913C3827EBA4E82CFD47ED20F4728170983470AB137F407DAC79818A437C1DCF2026C7E42D71C2EAA703BDA49D40E9
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.# 2017-10-18 win...import win_subprocess...Popen()..unicode...# 2018-01-07 ...............YouTube......................from __future__ import unicode_literals..import os, sys.import re.import shutil.import traceback.import threading.from youtube_dl.downloader.http import HttpFD, HttpNeedQueryRedirectFD.from youtube_dl.downloader.hls import HlsFD.from youtube_dl.downloader.M3u8Downloader import FFmpegFD as FFmpegFDEx.from youtube_dl.downloader.OldM3u8Downloader import WSM3u8FD as WSM3u8FD.from youtube_dl.downloader.external import FFmpegFD.from youtube_dl.downloader.httpCrul import HttpCurl.from youtube_dl.downloader.http_hb import HttpHB.from youtube_dl.utilsEX import (. get_top_host,. sleep,. GoogleAnalytics,. sandboxEnable.)..import youtube_dl.from youtube_dl.compat import (. compat_str,.).from youtube_dl.WS_Extractor import (. YoutubeDLPatch4Single.).try:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_bz2.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53760
Entropy (8bit):	6.634906459665055
Encrypted:	false
SSDEEP:	768:b/S40dpi3PMwtTEvqAZ2D2U0Nb3fj4GmlFPnrqugndA23ACKC:mrdGtTERQ0NLfcPrqugK8g
MD5:	FB47D434EDB65E28D9A05381F646DC01
SHA1:	D64F38C378625A21917A54C6E5C1D76430CCC679
SHA-256:	2E0CDAB46BF899F8A433D57643D909C3883F95E32CA37817BF4F9E72D84A5A5F
SHA-512:	448824D83F22C4343353E900666D095D89698AE6F80278A29B6061163313E9E53060568241682FB18DF430C5F1214836C4CF0B66C8AB2CD08CBD60F527FF7C66
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........F..w...w...w.d.....w..U....w..U....w..U....w..U....w.......w...v...w..U....w..U....w..U....w.Rich..w.........PE..L...K.vV...........!.........6...........................................................@.........................0...G...<...P...................................P...............................(...@...............<............................text............................... ..`.rdata..w...........................@..@.data...8...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_ctypes.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.536370052377606
Encrypted:	false
SSDEEP:	1536:Oo5A1EQ38XUL9c+mCvqM8SQMkN/E+yJipQo4AFAr4kRhH:OhDo4wO32/JyUpnFGMAhH
MD5:	5D1BC1BE2F02B4A2890E921AF15190D2
SHA1:	057C88438B40CD8E73554274171341244F107139
SHA-256:	97C3CDEF6D28AD19C0DACFF15DD66F874FE73C8767D88F3BC7C0BDE794D857DA
SHA-512:	9751F471312DD5A24F4A7F25B192DDCB64D28A332FF66F3AA2C3F7EF69127CF14C93043350397E9F884F1830F51D5E01214E82627158D37EF95CE4746A83BBD9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~n..~n..~n......~n......~n......~n......~n......~n......~n..~o..~n......~n......~n......~n.Rich.~n.........................PE..L...W.vV...........!.........z............................................................@.........................@/..........x............................`..........................................@...............`............................text............................... ..`.rdata...?.......@..................@..@.data...."...0... ..................@....reloc.. ....`.......8..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_hashlib.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.772226545230853
Encrypted:	false
SSDEEP:	12288:wNV4H+2h8eH2BrxU59LHF3mfJ/PBO9XDf6xka4m0SGI9wCTn4W3ZWpq5ac8B:JhP6rxU5bmfxj5Td3ZWpq5ac8B
MD5:	82AE4E8208D58BFFC95F68C2C1D8F280
SHA1:	8874B66DCAF142CFCA6B72AA46F2247AB6D96E8C
SHA-256:	2C905F0809749F5494B2A638A8551AF3D914A148D282FC3DA9D68CE12D067EB9
SHA-512:	737109F330F1AB8302C5F73EAD54DFA53B39D73A806054BA725F7F1E9BE82ADEC678E08FC127B6B5658DAF465AEA34D0C4226162F6E067B8D4C461B3D051CE37
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........qF.."F.."F.."]1M"L.."]1x"D.."]1O"B.."O.@"O.."F..".."F.."V.."]1y"5.."]1}"G.."]1H"G.."]1N"G.."RichF.."........................PE..L...i.vV...........!.....L..........&Q.......`...............................P............@..........................L..O....@...................................}...b...............................>..@............`..h............................text....K.......L.................. ..`.rdata.......`.......P..............@..@.data....u...P...T...>..............@....reloc..,...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_lzma.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.765495751811015
Encrypted:	false
SSDEEP:	3072:rv3U0gptgZxHExmkTm875ZLA57/u9mNok96j8mk:zAmkTm8FZMiYOk8w
MD5:	D97063F86333FC166B87E8E4F8F5E1DC
SHA1:	1CB2420B801A725DCB1E0227D9EEEC82563EC7A8
SHA-256:	B0F6CF621C166C6585E4D6346C244DA51ADDE42A5BBBBDD9EB89BEF84B1117EE
SHA-512:	0ACD16C4E8EE93F2966C7EC7C2BD2506D3D33A5139F5EBC22C379A8CBD8827A12BB97C88F9F9A390DC04D8381A4ECFC71A3DDB7866A55CB056DB04514AC20BD4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................qJ......q~......q.......qH......G......................qz......qO......qI.....Rich............................PE..L...F.vV...........!.....\|...................................................@............@.............................I.......P............................0..,...`...................................................L............................text...^{.......\|.................. ..`.rdata..9{.......\|..................@..@.data...(...........................@....reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_socket.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	6.443820605104129
Encrypted:	false
SSDEEP:	768:wh5oRXl9g8DnLwNruZWQbTGyRLkndosYlCrXMjYT7S0Cy:whmRxDLCELRLkiHkr4YTGFy
MD5:	EBC931925D333427E182EB58EB4CECCE
SHA1:	90A811FA23C1EA1244EDDEF5F3371411AF354FD6
SHA-256:	E29CC2340A9577F82C45ABE6707E2817575EE02AC374F4864885410D411E6BEA
SHA-512:	52767F0E49A600AB6B025265CD0220DFD84C24CCEC24F7268974123CAD41A287A015021357EC4B88EAE0DC0DD2517BB5D07F1AAAF08FD36E7BEDD0FAB8047AB9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H..P.s...s...s.......s....4..s....5..s.......s...s...s.......s....0..s.......s.......s..Rich.s..........PE..L...F.vV...........!.....V...`.......^.......p............................................@.............................M.......d...............................,....r..................................@............p..d............................text....U.......V.................. ..`.rdata..-"...p...$...Z..............@..@.data...l/...........~..............@....reloc..P...........................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_sqlite3.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	6.412877489153441
Encrypted:	false
SSDEEP:	768:rOMDygeHBIQZ0EKApX7z8zgPoW4ITfknPsPPkXOcndD0Wt:rOVg4KA97YUjj2sPPkXOct0
MD5:	41BF29D8682BACE4B3A2A16FFAE77B2B
SHA1:	1C59CDEC69C02B4523770C445B655E20C06140B7
SHA-256:	2B98A8396B7248C8838728370A61926651E21DB845E9F4600C4F89F608D64E82
SHA-512:	FDE367EC9B5C1B897E58D4880D9FD191D22A4473E0E40AB0FF524AA835755E7CB51D412153B6F8DC703B9E1062932FA9C5B8CE29F33DF59B3C894CDADBC10FB7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h............A......u......t......C.....qL.......A....q......D......B....Rich...........................PE..L...K.vV...........!.....d...T.......m....................................................@.........................@...O.......d...................................P..................................@...............8............................text....c.......d.................. ..`.rdata...0.......2...h..............@..@.data...............................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\_ssl.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1331200
Entropy (8bit):	6.769741329219818
Encrypted:	false
SSDEEP:	24576:wQUJ1CWw45GYnwZxxImdLzDm+KpPL9LUXbLPiIcR0+ej/Fdp/MHPSCK2T:G1CWwEwvZLnSDMqIejw/Dp/OK2T
MD5:	12B5156DD0E8DE73B6C96DC61729CBBD
SHA1:	126903AC9E8447D52745782A14CD95818C048A53
SHA-256:	7A622E57F85120CEFE38F473E57B7363C8AFC551A35A6E4A4677B05F5D43881B
SHA-512:	1C2DB35190861237259F1761C4C24BECAAE1C3A525EBB70DD9E68B1BE5B16EDEB3D1EBAD6E710B0880448CF4F6F4C72A37926D584FC034956A91E1600EF3F335
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iM...#..#..#....#....#....#..#..#...K.#..".v.#.p...#....#....#....#.Rich..#.........................PE..L...k.vV...........!................'.....................................................@.........................p...G.......................................@.......................................@............................................text...N........................... ..`.rdata..............................@..@.data...............................@....reloc..8...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-22CKM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1331200
Entropy (8bit):	6.769741329219818
Encrypted:	false
SSDEEP:	24576:wQUJ1CWw45GYnwZxxImdLzDm+KpPL9LUXbLPiIcR0+ej/Fdp/MHPSCK2T:G1CWwEwvZLnSDMqIejw/Dp/OK2T
MD5:	12B5156DD0E8DE73B6C96DC61729CBBD
SHA1:	126903AC9E8447D52745782A14CD95818C048A53
SHA-256:	7A622E57F85120CEFE38F473E57B7363C8AFC551A35A6E4A4677B05F5D43881B
SHA-512:	1C2DB35190861237259F1761C4C24BECAAE1C3A525EBB70DD9E68B1BE5B16EDEB3D1EBAD6E710B0880448CF4F6F4C72A37926D584FC034956A91E1600EF3F335
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iM...#..#..#....#....#....#..#..#...K.#..".v.#.p...#....#....#....#.Rich..#.........................PE..L...k.vV...........!................'.....................................................@.........................p...G.......................................@.......................................@............................................text...N........................... ..`.rdata..............................@..@.data...............................@....reloc..8...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-8G1K8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.822209358393255
Encrypted:	false
SSDEEP:	192:Tt/6BnL0X+6NQJ1NglNpMsfsMQLRMK5FlG3XHPVR6yOXc1U5fst:Z/CFmNpMsB26Knl63PV54uqs
MD5:	02FE0FA69127B978DD8B59BA23DB5206
SHA1:	ADD138744A45E836EDF526E74EFFE6813B40FD7F
SHA-256:	064F0873914F0CF6D91248B61B64A462F98BD470BA83570B9B82FE39B6F243A4
SHA-512:	BADBADB107270AE2E526FCE1B2F56D78A8FB2FD497F03A8485B7BE712CF44AC5275B1F4413B02A4E589EA883F0697446E1FC9DC7C3EAB320796395645A4452EF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../<..NRW.NRW.NRW...W.NRW...W.NRW...W.NRW...W.NRW.NSW.NRW.6.W.NRW...W.NRW...W.NRW...W.NRWRich.NRW........PE..L...S.vV...........!......................... ...............................P............@.........................P(..K...."..d............................@.......!...............................!..@............ ...............................text...k........................... ..`.rdata....... ......................@..@.data...8....0......................@....reloc.......@.......$..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-9G0V2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47104
Entropy (8bit):	6.443820605104129
Encrypted:	false
SSDEEP:	768:wh5oRXl9g8DnLwNruZWQbTGyRLkndosYlCrXMjYT7S0Cy:whmRxDLCELRLkiHkr4YTGFy
MD5:	EBC931925D333427E182EB58EB4CECCE
SHA1:	90A811FA23C1EA1244EDDEF5F3371411AF354FD6
SHA-256:	E29CC2340A9577F82C45ABE6707E2817575EE02AC374F4864885410D411E6BEA
SHA-512:	52767F0E49A600AB6B025265CD0220DFD84C24CCEC24F7268974123CAD41A287A015021357EC4B88EAE0DC0DD2517BB5D07F1AAAF08FD36E7BEDD0FAB8047AB9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H..P.s...s...s.......s....4..s....5..s.......s...s...s.......s....0..s.......s.......s..Rich.s..........PE..L...F.vV...........!.....V...`.......^.......p............................................@.............................M.......d...............................,....r..................................@............p..d............................text....U.......V.................. ..`.rdata..-"...p...$...Z..............@..@.data...l/...........~..............@....reloc..P...........................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-9GJV1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	758784
Entropy (8bit):	5.610283288651192
Encrypted:	false
SSDEEP:	12288:b+sJ1h36V8UTApugN1byv9rN30xD3dNZJB4pvdob91TaT:xh3lHfyD30t3dc5mbTaT
MD5:	F66CDE98CA47F122710E4008246D45E9
SHA1:	5CC592C03BE31F5D99D69A6EB83FAE44D2E1E8DE
SHA-256:	5DF0E5E83BE746D46DB28DA04B5936E0F178BE1D2F0B3C3A9CFDA8CC1553480D
SHA-512:	E2898A96243108DDCC3C07DEC7DB2CED1A995029D710F860C6CDDF4833E8BB41372939F96F7A0A23749C44A1C88AB5722764907024D1AF3CC3CDBD74FCCB17B0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)..P)..P)..P2beP+..P2bQP%..P2bPP+..P2bgP,..P .hP+..P)..Pi..P2bUP(..P2b`P(..P2bfP(..PRich)..P........PE..L...I.vV...........!.....(...l.......1.......@............................................@..........................t..U...<n..P................................... A..............................(m..@............@...............................text....'.......(.................. ..`.rdata...4...@...6...,..............@..@.data....).......&...b..............@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-GOHUU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.772226545230853
Encrypted:	false
SSDEEP:	12288:wNV4H+2h8eH2BrxU59LHF3mfJ/PBO9XDf6xka4m0SGI9wCTn4W3ZWpq5ac8B:JhP6rxU5bmfxj5Td3ZWpq5ac8B
MD5:	82AE4E8208D58BFFC95F68C2C1D8F280
SHA1:	8874B66DCAF142CFCA6B72AA46F2247AB6D96E8C
SHA-256:	2C905F0809749F5494B2A638A8551AF3D914A148D282FC3DA9D68CE12D067EB9
SHA-512:	737109F330F1AB8302C5F73EAD54DFA53B39D73A806054BA725F7F1E9BE82ADEC678E08FC127B6B5658DAF465AEA34D0C4226162F6E067B8D4C461B3D051CE37
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........qF.."F.."F.."]1M"L.."]1x"D.."]1O"B.."O.@"O.."F..".."F.."V.."]1y"5.."]1}"G.."]1H"G.."]1N"G.."RichF.."........................PE..L...i.vV...........!.....L..........&Q.......`...............................P............@..........................L..O....@...................................}...b...............................>..@............`..h............................text....K.......L.................. ..`.rdata.......`.......P..............@..@.data....u...P...T...>..............@....reloc..,...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-GUK5Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	133120
Entropy (8bit):	6.58086055514712
Encrypted:	false
SSDEEP:	3072:CVRvl+eH7aVhfl13FF3eDn3v+45cuMm74wEDINvKE5NnpRZ:Czvl+ebaVhfl1VFyZRb75EDkCE5Np
MD5:	B67B56F9D69DB0E8EDA23376DB188BE2
SHA1:	89E3347B77FFD3383A1E7C012F2396AB3A3B0431
SHA-256:	5906394063DF3355F8808ADEAE7786149E29C61ABFF031E7685FE3D62733CFDA
SHA-512:	DF3E5F1D93141928855DDFD9B1709AAA92F03B4F4AEF9D9E5833CB54C9292E0BC133CE362BB9CA4B3DF1974D1F05B0F3FAECF1AC949D1680188FA8761F7B2798
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............[...[...[...[...[..-[...[..,[...[...[...[...[...[...[..[..)[...[...[...[...[...[Rich...[................PE..L...H.vV...........!.........p...............................................@............@.............................M.......P............................ ..........................................@............................................text.............................. ..`.rdata..=@.......B..................@..@.data...............................@....reloc..$.... ......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-L2V8E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	6.412877489153441
Encrypted:	false
SSDEEP:	768:rOMDygeHBIQZ0EKApX7z8zgPoW4ITfknPsPPkXOcndD0Wt:rOVg4KA97YUjj2sPPkXOct0
MD5:	41BF29D8682BACE4B3A2A16FFAE77B2B
SHA1:	1C59CDEC69C02B4523770C445B655E20C06140B7
SHA-256:	2B98A8396B7248C8838728370A61926651E21DB845E9F4600C4F89F608D64E82
SHA-512:	FDE367EC9B5C1B897E58D4880D9FD191D22A4473E0E40AB0FF524AA835755E7CB51D412153B6F8DC703B9E1062932FA9C5B8CE29F33DF59B3C894CDADBC10FB7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h............A......u......t......C.....qL.......A....q......D......B....Rich...........................PE..L...K.vV...........!.....d...T.......m....................................................@.........................@...O.......d...................................P..................................@...............8............................text....c.......d.................. ..`.rdata...0.......2...h..............@..@.data...............................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-LQ3JT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.536370052377606
Encrypted:	false
SSDEEP:	1536:Oo5A1EQ38XUL9c+mCvqM8SQMkN/E+yJipQo4AFAr4kRhH:OhDo4wO32/JyUpnFGMAhH
MD5:	5D1BC1BE2F02B4A2890E921AF15190D2
SHA1:	057C88438B40CD8E73554274171341244F107139
SHA-256:	97C3CDEF6D28AD19C0DACFF15DD66F874FE73C8767D88F3BC7C0BDE794D857DA
SHA-512:	9751F471312DD5A24F4A7F25B192DDCB64D28A332FF66F3AA2C3F7EF69127CF14C93043350397E9F884F1830F51D5E01214E82627158D37EF95CE4746A83BBD9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~n..~n..~n......~n......~n......~n......~n......~n......~n..~o..~n......~n......~n......~n.Rich.~n.........................PE..L...W.vV...........!.........z............................................................@.........................@/..........x............................`..........................................@...............`............................text............................... ..`.rdata...?.......@..................@..@.data...."...0... ..................@....reloc.. ....`.......8..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-M241L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	524800
Entropy (8bit):	6.757763050454228
Encrypted:	false
SSDEEP:	6144:iZcv8KxeZ+VU3J8VXuU+uUU7rYL7OvDyz+NFU94/tMz0Wp5E5ghj6GgT54fc9ui9:P83J0uUnfiAA+5T6ngt8c9usC0ermB
MD5:	0734CB3BD3ABBC19228E6A1F383B1F42
SHA1:	8E92FE641AC3F9A35D24EFB0A20815B4C41F8358
SHA-256:	E97EF947B52A8970CA35A40DADAE19FA9B4D12D446079D11FC59349A2A0E5AE4
SHA-512:	B7D02808A2101B82EB3E34992E85DA731D9559A0499E3037DCD8BD35FEB064AF41713EFBC164EE77B80055D89E879352170F79545B6C3141B66440BE7D759B46
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wW..36.36.36.(.l.+6.(.Y.*6.(.m.o6.:NT.06.36.D6.(.i.26.(.\.26.(.Z.26.Rich36.........................PE..L.....vV...........!.........(...............................................P......qD....@.............................d.......(............................ ...,......................................@............................................text...]........................... ..`.rdata..$...........................@..@.data....3....... ..................@....rsrc...............................@..@.reloc..@-... ......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-QKDCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.765495751811015
Encrypted:	false
SSDEEP:	3072:rv3U0gptgZxHExmkTm875ZLA57/u9mNok96j8mk:zAmkTm8FZMiYOk8w
MD5:	D97063F86333FC166B87E8E4F8F5E1DC
SHA1:	1CB2420B801A725DCB1E0227D9EEEC82563EC7A8
SHA-256:	B0F6CF621C166C6585E4D6346C244DA51ADDE42A5BBBBDD9EB89BEF84B1117EE
SHA-512:	0ACD16C4E8EE93F2966C7EC7C2BD2506D3D33A5139F5EBC22C379A8CBD8827A12BB97C88F9F9A390DC04D8381A4ECFC71A3DDB7866A55CB056DB04514AC20BD4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................qJ......q~......q.......qH......G......................qz......qO......qI.....Rich............................PE..L...F.vV...........!.....\|...................................................@............@.............................I.......P............................0..,...`...................................................L............................text...^{.......\|.................. ..`.rdata..9{.......\|..................@..@.data...(...........................@....reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\is-QVUL5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53760
Entropy (8bit):	6.634906459665055
Encrypted:	false
SSDEEP:	768:b/S40dpi3PMwtTEvqAZ2D2U0Nb3fj4GmlFPnrqugndA23ACKC:mrdGtTERQ0NLfcPrqugK8g
MD5:	FB47D434EDB65E28D9A05381F646DC01
SHA1:	D64F38C378625A21917A54C6E5C1D76430CCC679
SHA-256:	2E0CDAB46BF899F8A433D57643D909C3883F95E32CA37817BF4F9E72D84A5A5F
SHA-512:	448824D83F22C4343353E900666D095D89698AE6F80278A29B6061163313E9E53060568241682FB18DF430C5F1214836C4CF0B66C8AB2CD08CBD60F527FF7C66
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........F..w...w...w.d.....w..U....w..U....w..U....w..U....w.......w...v...w..U....w..U....w..U....w.Rich..w.........PE..L...K.vV...........!.........6...........................................................@.........................0...G...<...P...................................P...............................(...@...............<............................text............................... ..`.rdata..w...........................@..@.data...8...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\pyexpat.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	133120
Entropy (8bit):	6.58086055514712
Encrypted:	false
SSDEEP:	3072:CVRvl+eH7aVhfl13FF3eDn3v+45cuMm74wEDINvKE5NnpRZ:Czvl+ebaVhfl1VFyZRb75EDkCE5Np
MD5:	B67B56F9D69DB0E8EDA23376DB188BE2
SHA1:	89E3347B77FFD3383A1E7C012F2396AB3A3B0431
SHA-256:	5906394063DF3355F8808ADEAE7786149E29C61ABFF031E7685FE3D62733CFDA
SHA-512:	DF3E5F1D93141928855DDFD9B1709AAA92F03B4F4AEF9D9E5833CB54C9292E0BC133CE362BB9CA4B3DF1974D1F05B0F3FAECF1AC949D1680188FA8761F7B2798
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............[...[...[...[...[..-[...[..,[...[...[...[...[...[...[..[..)[...[...[...[...[...[Rich...[................PE..L...H.vV...........!.........p...............................................@............@.............................M.......P............................ ..........................................@............................................text.............................. ..`.rdata..=@.......B..................@..@.data...............................@....reloc..$.... ......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\select.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.822209358393255
Encrypted:	false
SSDEEP:	192:Tt/6BnL0X+6NQJ1NglNpMsfsMQLRMK5FlG3XHPVR6yOXc1U5fst:Z/CFmNpMsB26Knl63PV54uqs
MD5:	02FE0FA69127B978DD8B59BA23DB5206
SHA1:	ADD138744A45E836EDF526E74EFFE6813B40FD7F
SHA-256:	064F0873914F0CF6D91248B61B64A462F98BD470BA83570B9B82FE39B6F243A4
SHA-512:	BADBADB107270AE2E526FCE1B2F56D78A8FB2FD497F03A8485B7BE712CF44AC5275B1F4413B02A4E589EA883F0697446E1FC9DC7C3EAB320796395645A4452EF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../<..NRW.NRW.NRW...W.NRW...W.NRW...W.NRW...W.NRW.NSW.NRW.6.W.NRW...W.NRW...W.NRW...W.NRWRich.NRW........PE..L...S.vV...........!......................... ...............................P............@.........................P(..K...."..d............................@.......!...............................!..@............ ...............................text...k........................... ..`.rdata....... ......................@..@.data...8....0......................@....reloc.......@.......$..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	524800
Entropy (8bit):	6.757763050454228
Encrypted:	false
SSDEEP:	6144:iZcv8KxeZ+VU3J8VXuU+uUU7rYL7OvDyz+NFU94/tMz0Wp5E5ghj6GgT54fc9ui9:P83J0uUnfiAA+5T6ngt8c9usC0ermB
MD5:	0734CB3BD3ABBC19228E6A1F383B1F42
SHA1:	8E92FE641AC3F9A35D24EFB0A20815B4C41F8358
SHA-256:	E97EF947B52A8970CA35A40DADAE19FA9B4D12D446079D11FC59349A2A0E5AE4
SHA-512:	B7D02808A2101B82EB3E34992E85DA731D9559A0499E3037DCD8BD35FEB064AF41713EFBC164EE77B80055D89E879352170F79545B6C3141B66440BE7D759B46
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wW..36.36.36.(.l.+6.(.Y.*6.(.m.o6.:NT.06.36.D6.(.i.26.(.\.26.(.Z.26.Rich36.........................PE..L.....vV...........!.........(...............................................P......qD....@.............................d.......(............................ ...,......................................@............................................text...]........................... ..`.rdata..$...........................@..@.data....3....... ..................@....rsrc...............................@..@.reloc..@-... ......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\pythondlls\unicodedata.pyd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	758784
Entropy (8bit):	5.610283288651192
Encrypted:	false
SSDEEP:	12288:b+sJ1h36V8UTApugN1byv9rN30xD3dNZJB4pvdob91TaT:xh3lHfyD30t3dc5mbTaT
MD5:	F66CDE98CA47F122710E4008246D45E9
SHA1:	5CC592C03BE31F5D99D69A6EB83FAE44D2E1E8DE
SHA-256:	5DF0E5E83BE746D46DB28DA04B5936E0F178BE1D2F0B3C3A9CFDA8CC1553480D
SHA-512:	E2898A96243108DDCC3C07DEC7DB2CED1A995029D710F860C6CDDF4833E8BB41372939F96F7A0A23749C44A1C88AB5722764907024D1AF3CC3CDBD74FCCB17B0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)..P)..P)..P2beP+..P2bQP%..P2bPP+..P2bgP,..P .hP+..P)..Pi..P2bUP(..P2b`P(..P2bfP(..PRich)..P........PE..L...I.vV...........!.....(...l.......1.......@............................................@..........................t..U...<n..P................................... A..............................(m..@............@...............................text....'.......(.................. ..`.rdata...4...@...6...,..............@..@.data....).......&...b..............@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\UniversalAnalytics\is-9AV9S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3861
Entropy (8bit):	4.753733639159968
Encrypted:	false
SSDEEP:	96:3nQELoKDqp3r/hG1QT6/8LWP5d1o09TC/Gq0n5kUS:3nQELoK+rpiQuUyho09TCeq05kUS
MD5:	61433E046034FB45EB49F7FCF71E007D
SHA1:	CC1DA42D8A6BE564101EDC0132BC302C9A28E619
SHA-256:	9D8C65FB472FEC7BA0DC36051CABB69A810AFEC697404D1B69B97BB73A1398DF
SHA-512:	A959D5438CB9842DE4529E1F5FA6DC787682002BD36D0C7F1078278420B3985595728A6027EDEBFCACF83A7E87CBB8350448EC081CA8C61B21512AC9FCCD11F2
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/python.###############################################################################.# Formatting filter for urllib2's HTTPHandler(debuglevel=1) output.# Copyright (c) 2013, Analytics Pros.# .# This project is free software, distributed under the BSD license. .# Analytics Pros offers consulting and integration services if your firm needs .# assistance in strategy, implementation, or auditing existing work..###############################################################################...import sys, re, os.from cStringIO import StringIO....class BufferTranslator(object):. """ Provides a buffer-compatible interface for filtering buffer content.. """. parsers = [].. def __init__(self, output):. self.output = output. self.encoding = getattr(output, 'encoding', None).. def write(self, content):. content = self.translate(content). self.output.write(content)... @staticmethod. def stripslashes(content):. return content.decode

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\UniversalAnalytics\is-HTTJV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19149
Entropy (8bit):	4.744382285838764
Encrypted:	false
SSDEEP:	384:XwfCcOhP3KfP3ba6aziFIWkXoH6KAjnr3AnFUHU:gFOhP3K6z5KAXiU0
MD5:	100B021B39432EB5EDFD5367A46F8CD4
SHA1:	C4D5AB57118917A31D1B146A23ED292C185E6F38
SHA-256:	EA2C400975D383B933C08DCFD9CE83FEE9C1F8E3128854A63C738CB781B21736
SHA-512:	7B025FFF34B1CAD3AD717F8260433FE866573C29561A40A467EC7971C29512699734A78B2C0AA92F23A47C198FAC153B368B379E514624AF2ACEFB0767D646E7
Malicious:	false
Reputation:	unknown
Preview:	###############################################################################.# Universal Analytics for Python.# Copyright (c) 2013, Analytics Pros.#.# This project is free software, distributed under the BSD license..# Analytics Pros offers consulting and integration services if your firm needs.# assistance in strategy, implementation, or auditing existing work..###############################################################################.from ..compat import (. compat_urllib_request,. compat_urllib_parse_urlencode,.)..from ..utils import YoutubeDLHTTPSHandler, YoutubeDLHandler.import datetime.import time.import uuid.import hashlib.import os..import sys.if sys.version_info < (3, 0):. str = basestring...def generate_uuid(basedata = None):. """ Provides a _random_ UUID with no input, or a UUID4-format MD5 checksum of any input data provided """. if basedata is None:. return str(uuid.uuid4()). elif isinstance(basedata, str):. checksum = hashlib.md5(bas

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\UniversalAnalytics\is-NOOPR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	4.7945129966212665
Encrypted:	false
SSDEEP:	48:0VZxUzMKdn5UKKqoD8pDKtiN12s10pbSTtqJ+chUywJHlpRBWEU2ZLyHfS:0VnQnnS8oIpDKtwfJIJzIFpW0F2S
MD5:	10C5735DE363C72D9C913ABF37DD3DC5
SHA1:	66B405FA5CCEA663C1CBB0E1260144B4B5A11AAF
SHA-256:	6814C9AEF952CF646210D7AE498F04BD0E08FA11E8F24601B586C593817481F3
SHA-512:	0C00573AE9D143B211BB6D42758E007E030B05FFA7A466504DA0136C3E515902996EC1F35863ED3E9C76A7735E0489BAEE66B9D78DCFF566E013EC3D9F03CB70
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/python.# -- encoding: utf-8 --.###############################################################################.# Test and example kit for Universal Analytics for Python.# Copyright (c) 2013, Analytics Pros.# .# This project is free software, distributed under the BSD license. .# Analytics Pros offers consulting and integration services if your firm needs .# assistance in strategy, implementation, or auditing existing work..###############################################################################..import unittest.import urllib..from UniversalAnalytics import Tracker.from UniversalAnalytics import HTTPLog...class UAMPythonTestCase(unittest.TestCase):. . def setUp(self):. self._buffer = HTTPLog.StringIO(). HTTPLog.consume(self._buffer) # Capture HTTP output in readible fashion. Tracker.HTTPPost.debug() # Enabled debugging from urllib2. . # Create the tracker. self.tracker = Tracker.create('UA-100395100-1', use_post = True)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-0HEL3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	4.802282299937059
Encrypted:	false
SSDEEP:	24:1R8l8vBWGslmuXHM9piXSaaC+hDc8jvnUTvl5DD+f:PuVTlmuXHMnESQ+VrnUTvvU
MD5:	1BDF3BB1B550F13F49ECB6D01A74E0F2
SHA1:	02284E1AD03DB624201CB1AF56F8D7C1D20FFE2A
SHA-256:	E596DFB8B3887EC230340756D47EAB3C90A61F06FCF3DC5070352C53295BA171
SHA-512:	9FC490FFFB86569256EF32BCCC60EA31AF59FD2F85761682ADB1F131A58040DEB6F0E3774887A14DC40D1338C47345164BE856D31C6DA860345EF12199102186
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from ..extractor.common import InfoExtractor.from ..utils import (. js_to_json.)...class porneqIE(InfoExtractor):. #http://www.txxx.com/videos/2631606/stepmom-seduces-teen-babe/. _VALID_URL = r'https?://(?:www\.)?porneq\.com'.. def _real_extract(self, url):. webpage = self._download_webpage(url, url).. jw_config = self._parse_json(. self._search_regex(. r'(?s)jwplayer$([\'"])(?:(?!\1).)+\1$\.setup\s$(?P<options>.+?)$;',. webpage, 'jw config', group='options'),. '', transform_source=js_to_json). info = self._parse_jwplayer_data(. jw_config, '123', require_title=False, m3u8_id='hls',. base_url=url).. title = self._og_search_title(webpage, default=None) or self._html_search_regex(. r'(?s)<title>(.?)</title>', webpage, 'video title',. default='video').. info.update({. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-0IEF5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3558
Entropy (8bit):	4.745742524039135
Encrypted:	false
SSDEEP:	96:DqJqTgUqAvUv985t8DoDnKsU2irVintI6NwAhn0:+vUqKxaoLKsteJ6NwAhn0
MD5:	211E64F15E5054F79B3BD8C15BC9A1EC
SHA1:	176FBF43A5D9A9A8CEB0939EABF528828D01E827
SHA-256:	4FA671805A5A07AB1A46316B76E3404C099DF3218061F7E621395CA9612B3B9E
SHA-512:	12554C7E921D245E165960760F0D550ADF92808B1C09A5DD51AB2A01B22406167CD9FA355E0B366D984C350F8B80A17E859ED7BD7FD61F3507A3AB9F5F7CA8FD
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..from ..extractor.mtv import MTVServicesInfoExtractor.from ..extractor import gen_extractor_classes.from ..utils import url_basename..class MTVPlaylistIE(MTVServicesInfoExtractor):. IE_NAME = 'mtv:playlist'. _VALID_URL = r'https?://(?:www\.)?mtv\.com/(?:video-playlists)/(?P<id>[^/?#.]+)'.. def _real_extract(self, url):. title = url_basename(url). webpage = self._download_webpage(url, title). mgid = self._extract_mgid(webpage). # ....... embed_url = 'http://media.mtvnservices.com/embed/mgid:arc:video:mtv.com:%s' % mgid. return {. '_type': 'url',. 'url': embed_url,. 'title': title,. 'ie_key': 'MTVServicesEmbedded',. }...class MTVNewsIE(MTVServicesInfoExtractor):. IE_NAME = 'mtv:news'. # http://www.mtv.com/news/3023803/siesta-key-new-series/. _VALID_URL = r'https?://(?:www\.)?mtv\.com/(?:news)/\d+/(?P<id>[^/?#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-0TCOQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.870491556194782
Encrypted:	false
SSDEEP:	48:DNu9IHSTd2Ib9BV6e2LHZ6Eq7TBRkbBBteBYxBU9tY:DqIyToI1N2V/t709tY
MD5:	5170D85ECDE26475FE3321BA58716009
SHA1:	D96E66B4948701A46E5B6029B2C3D0676CCB9C22
SHA-256:	910F6C306D2094266ABA5E799C6D733DFD6F32F489DD3BFF7BA5A5D0A63E1027
SHA-512:	0B0AB84AE524A0558AC019559D0481E607CFB460270247D3DF99BB1E8066204A2F854607907CF4720705C29AF5F2069CD12DF6CB9856569C3C67BD24F2372805
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..from ..extractor.common import (. InfoExtractor.).from ..utils import (. js_to_json,.)..class YesvideoIE(InfoExtractor):. # http://share.yesvideo.com/s/aQdzgvCKvcIBAvTb/embed. # http://share.yesvideo.com/s#/share/5962ad5b17744959bc002003. _VALID_URL = r'https?://(?:share\.)?yesvideo\.com'.. def _real_extract(self, url):. # ..s#/share......ID. if 's#/share' in url:. video_id = self._search_regex(r's#/share/([^/]+)', url, 'video_id'). if video_id:. api_url = r'http://share.yesvideo.com/api/v3/shares/' + video_id. video_data = self._download_json(api_url, video_id). link_url = video_data['share']['link_url']. if link_url:. return self.url_result(link_url).. if not '/s/' in url:. return super(YesvideoIE, self)._real_extract(url).. if not '/embed' in url:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-16LBG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	921
Entropy (8bit):	4.962528241802774
Encrypted:	false
SSDEEP:	24:1R8lp7HejteZUx4wF6IXhgtX1IB8Apvpaj:Pu5HGQexBFvXhkiB1va
MD5:	4BCFF71FD7D86D896539FA299AC7FA3E
SHA1:	CA0BCDAEEAB13CB044074B7FAC613030D7B3C6A3
SHA-256:	C26FB6E375DE192447D0B4E7A5D8E41021F01C9C621442CEEB5E3109DA54610A
SHA-512:	5748C89736338B692FE6109C291F0F27DA4AEAF93D2E3CB3255258C367C4C9846F51CF596AFCB1D5FB3B2DD233257BF82EFC78BD4BA51692C40B93E354A2CF88
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..extractor.espn import (. ESPNIE,. ESPNArticleIE as ESPNArticleIEBase.).ESPNArticleIEBase._VALID_URL = ESPNArticleIEBase._VALID_URL.replace('.com/', '.(?:com\|us\|co)')..class ESPNArticleIE(ESPNArticleIEBase):.. def _real_extract(self, url):. try:. return super(ESPNArticleIE, self)._real_extract(url). except:. pass.. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). if video_id == None:. video_id = self._search_regex(. # <a href="http://www.espn.com/video/clip?id=12302153"><b>Watch</b></a>. r'<a\s+href="http\://www\.espn\.com/video/clip\?id=(?P<id>\d+)".Watch.</a>',. webpage, 'video id', group='id').. return self.url_result(. 'http://espn.go.com/video/clip?id=%s' % video_id, ESPNIE.ie_key())..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-1FBMJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	725
Entropy (8bit):	4.975976005925401
Encrypted:	false
SSDEEP:	12:1RjYa4J5QfrPITSnQoYj81psB0vYERB2DUb2RKJFtH3flan0Kg9inQYV:1R8lTAIenQovzsavtn2DpRw00KdnQ2
MD5:	44F306EA4D4FE6235DE01898E4CF6187
SHA1:	85A283F627F3CC34598078E2128BC56C41B4C4E3
SHA-256:	40EB555F0FDF71B6E614D7735DC10C9B4998883CA1812A82D4EEE6E9DD60FB05
SHA-512:	07D609B0DA45125221E7FFEEEF676BB50F9B407CC1B222241BBA677CC09DE6542AD8868D532CDD18CE9EDAA359FB554EDF0B0D4081ECE414E1607C11DF9F9121
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..extractor.crackle import (. CrackleIE as CrackleBase.)..class CrackleIE(CrackleBase):. def _download_json(. self, url_or_request, video_id, note='Downloading JSON metadata',. errnote='Unable to download JSON metadata', transform_source=None,. fatal=True, encoding=None, data=None, headers={}, query={},. expected_status=None):. headers = {. 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36',. 'Referer': url_or_request. }. return super(CrackleIE, self)._download_json(url_or_request, video_id, headers=headers, query={})

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-1Q9R8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	823
Entropy (8bit):	4.792718295011931
Encrypted:	false
SSDEEP:	12:1RjYa4JCta0pxD0OolqnFxEpN7e6lrw9n4FUCvsf9n47iV9CaGEbEkMcS2:1R8l2pDoOFyT7e8MB5CvsfBgEbEkMcl
MD5:	5250B6AA217ECF97AA021F243478655C
SHA1:	62E7D2E36375FFB846BE4F7ECCD0FD799EEE1226
SHA-256:	91004A820BFE0D475F36C8EDC37AD1D62E0A2E9E11E915409BDBC8A7BB375ED7
SHA-512:	EEC5D30AAF9FFA192D26910FF2530934E76E092DAC348AADFDB18DC9481CFB601D47388B46B6CBC307BA759C5A810D8C8CA8BD80F8D0376B18E8AB6002924A23
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals.import re.import json..from ..extractor.funnyordie import FunnyOrDieIE.from .youtube import YoutubeIE..old_real_extract = FunnyOrDieIE._real_extract..def _real_extract(self, url):. try:. result = old_real_extract(self, url). if not result:. raise Exception('funnyordie parse error'). except:. webpage = self._download_webpage(url, ''). uuid = self._search_regex(r'data-volume-uuid="(.+?)"', webpage, ''). webpage2 = self._download_webpage('https://volume.vox-cdn.com/embed/%s' % uuid , ''). youtube_id = self._search_regex(r'"youtube_id":"(.+?)"', webpage2, ''). return self.url_result(. 'https://www.youtube.com/watch?v=' + youtube_id, ie=YoutubeIE.ie_key())...FunnyOrDieIE._real_extract = _real_extract.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-25IMR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1901
Entropy (8bit):	4.821700791148125
Encrypted:	false
SSDEEP:	48:PujHWCHleVrnUTReB/5vPoZPnveVUBFogBeVSqy7fVjYycBYlahTlto6ND:KWCHsUVWvPoZvvSLVS3YOlmTlto6ND
MD5:	0E0584A75A6980BE4F6A8434347A226B
SHA1:	A3845A445E89807A4669A0583264B8D61886E748
SHA-256:	68D8DCB283F891851CD3DD6E9D47BD2BA5CA2C02D1F27445AD9EAF75D0A18EC4
SHA-512:	83ECEC7ED248BE9CEB417565D8FBC5568DEE3C1357CD89D866E95C61F94FDF834E40608C59C2A7E775A62C8517CBC35CC42875600F068B39B67E101446FBEE67
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from ..extractor.common import InfoExtractor.from ..utils import (. int_or_none,. ExtractorError,. sanitized_Request,. UnsupportedError,. urlencode_postdata.).from ..compat import compat_urlparse..class ancensoredIE(InfoExtractor):. #http://www.txxx.com/videos/2631606/stepmom-seduces-teen-babe/. _VALID_URL = r'https?://(?:www\.)?ancensored\.com'.. def _real_extract(self, url):. webpage = self._download_webpage(url, url).. title = self._og_search_title(webpage, default=None) or self._html_search_regex(. r'(?s)<title>(.*?)</title>', webpage, 'video title',. default='video').. thumbnail = self._search_regex(r'background-image: url\((.+)', webpage, 'background', fatal=False). if thumbnail:. thumbnail = compat_urlparse.urljoin(url, thumbnail). else:. thumbnail = self._og_search_thumbnail(webpage) or self._html_search_meta('thu

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-28RCQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2781
Entropy (8bit):	4.37237752387841
Encrypted:	false
SSDEEP:	48:hNRu9oYNU+CQ1BwRLBUTvex5PwY6NJ9vbgWwVMPpDdDCDLCSRBTO6NR:X4oYNWc6HR6NngWwVMxDdDCDLTBTO6NR
MD5:	520FA83E796BBEC0CAE737E81385E752
SHA1:	C5BDA1FE9CC1E55EFF57E7A5AAEF0EEE511DA2CE
SHA-256:	E27B2E36641E7818270BF2F00A11485FB3EAFC0E8439683DC8510C7F5DB541A8
SHA-512:	A07B696B8ED3B2909EF54F594187B3A91DCB4E7A898BB52E3A4E36AD5DEF5F4F912C2433BCF33111184B4F38A48D9EBF3EF439BDB33E320FA813382934DFDC4A
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..utils import (.. int_or_none,..)....class JWIE(InfoExtractor): .. _VALID_URL = r'https?://(?:.+\.)?jw\.org/'.... def _real_extract(self, url):.. webpage = self._download_webpage(url, '', headers={.. 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36',.. }).. json_url = self._search_regex(r'data-jsonurl=(?:"\|\')([^\'\|^"]+)?', webpage, '123123', fatal=False).. if not json_url:.. video_id = self._search_regex(r'((pub\|docid).+?VIDEO)', url, 'id').. json_url = 'https://data.jw-api.org/mediator/v1/media-items/S/{0}?clientType=www'.format(video_id).. response = self._download_json(json_url,'', 'Downloading course curriculum').. media = response

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-2IF02.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1321
Entropy (8bit):	5.078776840594739
Encrypted:	false
SSDEEP:	24:zi8ljv1iGCGZoeIXjlgtPt9Tn2fnSP1kB50AtDlFgdeVpIBQF+EVn:+uRbCqojXjlkPU9BuuxFxVGBQYE9
MD5:	2A077A7AE92333A3A4DCAB89734DC52B
SHA1:	DC398E40FA52B2A80A1CEC1B26DDBD2E3E1EEA3A
SHA-256:	F1BBAC2F969C4F8A29DD5DD9885F38DFC7537AA3351D95C12E27D8322A95CBB8
SHA-512:	6A9F66FDB58FECD0D61796B55021EFE1FCC72D43B0374D8CFF35B9AE21C0D446CC04DDA675D26A0B32F08FB6C167BDB0C3673EFE69464FC673E29966033C0444
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.from ..extractor.common import InfoExtractor..class PrageruIE(InfoExtractor):. # https://www.prageru.com/videos/building-resilience-5-ways-better-life. _VALID_URL = r'https?://(?:www\.)?prageru\.com/videos/(?P<id>[^/]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). # ....youtube... # <video id="video" width="640" height="360" style="max-width: 100%;" controls="control" preload="none" webkit-playsinline="true" playsinline="true">. # <source src="https://www.youtube.com/vjMYCnI5kz0" type="video/youtube" >. # </video> -->. video_url = self._search_regex(r'(?s)<video id="video".*?src="([^"]+)', webpage, 'video_url'). if video_url and 'youtube' in video_url:. if not 'watch?v=' in video_url:. video_url = video_url.replace('.com/', '.com/watch?v=').

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-2LJFA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6942
Entropy (8bit):	4.347295968930268
Encrypted:	false
SSDEEP:	96:n+j5R5705Cx8Q3g4IiaJDQ3gpbUlPREFyH9/QU8ILFkqG8yqG8U+qG8YlcRKbQ:n+j5Nxbw7Cw1UEgYU8UOSyS5St
MD5:	BA82DF5E7195A29F62D1FCAC9AC6798B
SHA1:	B65D6AB566E7325D012D23B63BC15B4EFF09C4B9
SHA-256:	8605EE0912F4FB4FD61134B71769C42795ADE5261A10F49A57906A43D62DEC03
SHA-512:	29094AE1717B25EE56E7CB6E2CCF8D250DA86935666764277283936A5FD55D8BD9C30D0274004F2B92F6A610585F175B372A93E161909EB507A67C93A7B4C54D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.import re.import json.from operator import itemgetter.from difflib import SequenceMatcher as SM..from ..extractor.common import InfoExtractor..from ..utils import (. compat_urllib_parse_urlencode,. parse_duration,.)..class searchMusicIE(InfoExtractor):. _VALID_URL = r'searchMusic://metaTitle=(.+)?&metaArtist=(.+)?&(?:duration=(.+)?\|duration=)'. _TEST = {. 'url': 'http://gb.napster.com/artist/madness/album/keep-moving-salvo/track/wings-of-a-dove',. }.. def _real_extract(self, url):. mobj = re.search(self._VALID_URL, url). metaTitle = mobj.group(1). metaArtist = mobj.group(2). duration = mobj.group(3) if mobj.group(3) else '0'. result = self._get(metaTitle, metaArtist, duration). url = result['id'] if result['id'] != '' else None. if url:. entries = []. entries.append(self.url_result(url, ie='youtube')). return self.playlist_re

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-30ANJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.827324736307713
Encrypted:	false
SSDEEP:	48:+uj2HBKK8opEtBoyYBAXpjS44HysvF6XjlkbVUiM6fUeMn1DoGuL3BTM6Nu:v2hKK8opSBoyTNS8sBaifViDoGuL3BT+
MD5:	C5279FA1F3FBC8D936B028042603E90D
SHA1:	04C357F4D38CD21F76A31314E8E3B5AED0B4E5BE
SHA-256:	67D3EBF6BD53CB885305CFCFF9AE017EC3609BE57BFE095C6E24B6C09850DED7
SHA-512:	1E2803ACCEAF3B3DF8666E9BEDE0814707AED14F939AA3982FB50F7234296FF8EF6B7F6CCF3C4300FB9D1BAB1A3118ED7E62CFD41819D587ECE959152A90ACA2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from ..extractor.streamango import StreamangoIE as StreamangoBase, determine_ext.# .............packer........from ..utils import decode_packed_codes.from ..utilsEX import execjs_execute, downloadWebPage_BYHeadlessBrowser.import re..class StreamangoIE(StreamangoBase):. # ............. def _download_webpage(self, url_or_request, video_id, note=None, errnote=None, fatal=True, tries=1, timeout=5,. encoding=None, data=None, headers={}, query={}):. webpage = super(StreamangoIE, self)._download_webpage(url_or_request, video_id, note, errnote, fatal, tries, timeout,. encoding, data, headers, query). try:. # ....... pattern = r'eval$(.+)$'. packed_js = self._search_regex(pattern, webpage, 'js_code').. import execj

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-39GG8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	4.662154827592638
Encrypted:	false
SSDEEP:	48:+uIvBNvFkX0fS9dhkFS9SohCRh71hUJhanl2XXdNLI0au4gekJeBLeDhHhKDqtvK:cpY9XkU9oOhilIdNk0au4gnJeiBKDqti
MD5:	7A5D1C38D481C8F6249C67D31AB232A7
SHA1:	BE155882632D51165D0D7D7F8DE45ACC2271E84C
SHA-256:	40A4030ABFB7AC650F4107BB27FFCF1CBE693999F5A426E7729F0BE028650BA9
SHA-512:	C77767DC066620446936A0DCB3D88C90F91F9FBF5991B004F2D2C4B10CFE381E4B11A15241A2B2D28970C1B20B4BE8D709C4E255B264238BB19ED0262F93C574
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.import re.from ..extractor.nuvid import NuvidIE as oldIE.from ..utils import (. parse_duration,.).import json..class NuvidIE(oldIE):. def _real_extract(self, url):. try:. return super(NuvidIE, self)._real_extract(url). except:. video_id = self._match_id(url).. page_url = 'http://m.nuvid.com/video/%s' % video_id. webpage = self._download_webpage(. page_url, video_id, 'Downloading video page'). # When dwnld_speed exists and has a value larger than the MP4 file's. # bitrate, Nuvid returns the MP4 URL. # It's unit is 100bytes/millisecond, see mobile-nuvid-min.js for the algorithm. self._set_cookie('nuvid.com', 'dwnld_speed', '10.0'). mp4_webpage = self._download_webpage(. page_url, video_id, 'Downloading video page for MP4 format'). mobj = re.search(r'data-video_hash="([^"]+).+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-39OC2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (414)
Category:	dropped
Size (bytes):	23415
Entropy (8bit):	4.5046015839942335
Encrypted:	false
SSDEEP:	384:YGbso13rrUm6NATuAjU3w025s7i6Neiuv8l+41g6N+DIH9ODfOlOBTzkqkRzGzWq:YGP13rh8wum0Ss7i8Evi+41g8+O9ODfT
MD5:	061A6E0409EFFE24AB6763A05B049E33
SHA1:	A05A2A5C4BFE811EE0A4C7CE7FDC98686579F681
SHA-256:	2B5F1F8060B43499F0D993FD57FE5F8D3E6A97D82D55E9770EEE0F1D4D18AD81
SHA-512:	0F2B16E932167A9093A764AF9F4F0DA602D6AED2F838504EA700B563107324FB5F88198A9461BEF47652F415BF35577DBA3265168C1B6963DB7B0F5485058D2A
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals.import re.import sys .import threading..try:. import Queue.except:. . from queue import Queue..from ..extractor.common import InfoExtractor.from ..utils import (. urlencode_postdata,. sanitized_Request,. update_url_query,. smuggle_url,. unsmuggle_url.).from ..compat import (. compat_urllib_parse_urlparse,. compat_b64decode,. compat_parse_qs.).from ..utilsEX import JSInterpreter, downloadWebPage_BYHeadlessBrowser_withJS, downloadWebPage_BYHeadlessBrowser, downloadWebPage_BYHeadlessBrowser_localFile..class KissanimeIE(InfoExtractor):.. _VALID_URL = r'https?://(?:.+\.)?(?:kissanime\|kisscartoon)\.(?:io\|ru\|so\|me\|ac)'.. def _real_extract(self, url):. url = url.replace('.ru/', '.ac/').replace('.so', '.ac').replace('.io', '.ac').replace('.eu', '.ac'). id = self._search_regex(r'id=(\d+)', url, ''). headers = {'content-type': 'application/x-www-form-urlencoded; charset=UTF-8','re

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-3BLM6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	12413
Entropy (8bit):	4.881532559587672
Encrypted:	false
SSDEEP:	192:NBDwrE90hcYB4CWd+6NqUVOUCot+jTgkmhhZ+jGTpWho:nV0hcwEd+6NTO3F3vAr
MD5:	7D7B8B62F329481D87ABBB64467AB69B
SHA1:	17A6BF3BAB6DF3644BAF1885AD318620D89BD559
SHA-256:	D25545B20E48051A8C44646ABE4F8E911E0E4DBDB294B77D6396EAC16CDB33E4
SHA-512:	786AA1589D8BB210B08278C01097661CF79F5D746BFB1614092F5CEFF70F54CA86E581409D77475DF2C3173EE35D477B7A8BAF839B395C41F3C9660022E30CA4
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals.from ..extractor.common import InfoExtractor.from ..utils import determine_ext.import re..class Movies123IE(InfoExtractor):. _VALID_URL = r'https?://(?:www\w?\.)?123movies?\.\w+/'.. def _real_extract(self, url):. # https://123movies.film/film/the-handmaid-s-tale-season-1-2017.74909/watching.html?episode_id=93254. if '.film' in url:. return self._extract_film(url).. # http://123movies.net/watch/GpDJMmgG-shooter-season-2/episode-8.html/watching.html. # .net........url...base64............ if '.net' in url:. return self._extract_net(url).. # http://123movies.sc/watch-clouds-of-sils-maria-2014-123movies.html/watching.html. # .......openload.............. if '.sc' in url or '.ag' in url:. return self._extract_sc(url).. # https://www1.123movie.cc/mo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-3DT20.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (353)
Category:	dropped
Size (bytes):	4470
Entropy (8bit):	4.483740966563381
Encrypted:	false
SSDEEP:	48:+u5oHT2gkFxetlfFILQo8wehpgTs7Bcft+w/q0JnYTCrUmwY8hepIYNecq6NyBwb:lAx1tm7ftXLrUhlepIebq6NyBw8hBE39
MD5:	3F72D41E9C4DB605254AF16C7486F414
SHA1:	AB2B374CAFA58512F56F34DB57BAA9548A03AAFA
SHA-256:	40F280523D684E7248D84D8E1A378415ED23F42A89A04AF23E79A460DB829DB7
SHA-512:	5EAFC7A1B02DD151CFBB1688D8E615EBF298C0F98F837EA8A228ECF334C0C6B0AE5CC8A3F987D35484D726042C7C845B147003C7A225D52103E13543D5458FD5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.import re.import json.from ..extractor.nbc import NBCIE as Old.from ..extractor.common import InfoExtractor.from ..extractor.theplatform import ThePlatformIE.from ..utils import (. smuggle_url,. update_url_query,. int_or_none,. urlencode_postdata.)..class NBCIE(Old):. def _real_extract(self, url):. try:. result = super(NBCIE, self)._real_extract(url). ie = ThePlatformIE(). ie.set_downloader(self._downloader). testResult = ie._real_extract(result['url']). return result. except:. permalink, video_id = re.match(self._VALID_URL, url).groups(). webpage = self._download_webpage(url, url).replace('https://schema.org', 'http://schema.org'). video_data = self._search_json_ld(webpage, '', fatal=False).. if video_id:. try:. token = self._get_cookies(url).get('park-fr').value.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-3QRBN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	44650
Entropy (8bit):	4.482652114716241
Encrypted:	false
SSDEEP:	768:VY9oAOidxsCi5hrZKMhQHAkZysaZAdysC/iwfCOTQjbYijn2JBTRilinix4icieL:VY9oAOidxsCi5hrZKMhQHAKysaZAdysu
MD5:	AA610B93751DCAB848AD21EB03607023
SHA1:	53102658FAF5920F36FB7EEEC384F45306DB516D
SHA-256:	DC7D64989385C8A275691E7ABA8C2792127D1B7390043F981867650EEDD8AEF4
SHA-512:	7572E7EB0742809BC19C2A36E1A8A4090E1D842ED0596F7DC3ED95305C1CFF35106751F1F6674D112C28438C8F3FFFB7F105669FC8395A894E7AE1F20B22C63D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import xml.etree.ElementTree..from ..extractor.common import InfoExtractor.from ..extractor.bbc import (. BBCCoUkIE as OldBBCCoUkIE,. BBCIE as OldBBCIE,. BBCCoUkArticleIE as OldBBCCoUkArticleIE.).from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. parse_duration,. parse_iso8601,. remove_end,. unescapeHTML,.).from ..compat import (. compat_HTTPError,. compat_urllib_parse_urlparse,.)..class BBCCoUkIE(InfoExtractor):. IE_NAME = 'bbc.co.uk'. IE_DESC = 'BBC iPlayer'. _VALID_URL = r'https?://(?:www\.)?bbc\.co\.uk/(?:(?:programmes/(?!articles/)\|iplayer(?:/[^/]+)?/(?:episode/\|playlist/))\|music/clips[/#])(?P<id>[\da-z]{8})'.. _MEDIASELECTOR_URLS = [. # Provides HQ HLS streams with even better quality that pc mediaset but fails. # with geolocation in some cases when it's even not geo restricted at all (e.g.. # http://www.bbc.co.uk/programmes/b0

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-4NC3L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	65103
Entropy (8bit):	4.081615884245659
Encrypted:	false
SSDEEP:	1536:9mrguTCSn8c5QaLNhkm+PO6AQqw7S6Tp8yauPtaUIkeOlXR15/ZYAH+3GIBkyNkB:wrgo2BPeoDNGI
MD5:	27720A724AB7B09D1C663599769DA6BC
SHA1:	27A4C47781D240419630560D2D4EF2B77B6F6E5E
SHA-256:	5D6BCA202377AF75AAA4859BD50EE6635984F4934C3C2FC051B51FFFA056742C
SHA-512:	37ECB5D2BDA536ECC65750D5835F2B3B32BDD2FE606B7965601B4041F0C62CC69C67EE1D0DC9BBE5A2157F3DAC85D8DDA59075959A62C9C922CC61211EAF7D0F
Malicious:	false
Reputation:	unknown
Preview:	def localFrist():. return False.#--------------------------------------------------New---------------------------------------------------------------------.def CreateExtractor(BaseCLS,. try_get,. clean_html,. str_to_int,. smuggle_url,. int_or_none,. unescapeHTML,. mimetype2ext,. parse_codecs,. float_or_none,. remove_quotes,. unsmuggle_url,. ExtractorError,. compat_parse_qs,. parse_duration,. unified_strdate,. get_element_by_id,. compat_urllib_parse_unquote,. compat_urllib_parse_urlparse,. compat_urllib_parse_urlencode,. compat_urllib_parse_unquote_plus, . compat_str):. print('Youtube CoreVersion:[%s]' % '2019112601'). import re. import json. def CreateJSInterpreter(jsCode):. import operator. import re. import json. _OPERATORS = [. ('\|', operator.or_),. ('^', operator.xor),. ('&', operator.and_),. ('>>', operator.rshift),. (

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-57468.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11194
Entropy (8bit):	4.973696501663706
Encrypted:	false
SSDEEP:	192:4yefe9+s9ghhGPP9eHE9v8iGq+6NQk2n5F+JUlsZw7sNHu+VqRXW71hmDIdv:teff2whGPP9eHQv8iGq+6NSD+VwgNO+/
MD5:	B0C03B9C597AB5EEAE2A311200513E21
SHA1:	451987318F5FC9EEF801F5632A1F0FFD0E51F745
SHA-256:	798987A95E5BF392D866615B5571F172D528F64BCD051F6B0D6A5B534AAE50D4
SHA-512:	1ABF1E2E86799B820D1CC64CB8C4B8E9EC033F1F627EC7A579F2EF35459BEA277DAE5B978AE714B6C9CE63FF9366C582874156DB79C735D372C6B607ADBE0D98
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..from ..utils import (. determine_ext,. decode_packed_codes.).from ..utilsEX import execjs_execute, downloadWebPage_BYHeadlessBrowser_localFile.from ..extractor.common import InfoExtractor.import re.import math..class TxxxIE(InfoExtractor):. # http://www.txxx.com/videos/2631606/stepmom-seduces-teen-babe/. # https://www.vjav.com/videos/6471/natural-production-plants-shit-female-flight-principle/?source=2108980576#. # ............TXXX Network:TXXX hclips HDZog HotMovs PornQ VoyeurHit TubePornClassic VJAV Porn555 See.xxx PornL TheGay ShemaleZ. # 2019-03-01........video_url. _VALID_URL = r'https?://(?:.+\.)?(?:txxx\|hclips\|hdzog\|hotmovs\|pornq\|voyeurhit\|tubepornclassic\|vjav\|porn555\|see\|pornl\|thegay\|shemalez\|upornia)\.(?:com\|net\|xxx)'.. def _real_extract(self, url):. try:. import tempfile. import os, io ,sys. from ..utilsEX import d

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-5UCIF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (1469)
Category:	dropped
Size (bytes):	8259
Entropy (8bit):	4.378027258472282
Encrypted:	false
SSDEEP:	96:VasOGS7dZEoa1wibRFB1O8BnpJFB1O8cFj9fRwH7OKjl1gnEd3ySIpB5sao/j9o3:VRDS8twmBZPBSepGbRyju
MD5:	790F2AECF9D1D9A1CD40DE7765C10967
SHA1:	FBA3DAFD43055399C1CDD06D555D4274F7F587C6
SHA-256:	B0A0CD6C43F2DA47B9308CDC6FA35D57C3F4B1245452484BD3D7B10F35BA6DD3
SHA-512:	8269626EDADBE4CE367C4F2FAE7EC365E1A6262DEE202E1037F647ED54917413D5AFA9D5850A07340F18EAB4E981E3CE8F1A315D9142A92ABAF61069F2B38438
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json.from ..compat import (. compat_urlparse,.)..from ..extractor.common import (. InfoExtractor.)..from ..extractor.vevo import (. VevoBaseIE,. VevoPlaylistIE as old,. VevoIE.)..from ..utilsEX import download_webPage_by_PYCURL, url_result..class VevolyIE(VevoIE):. _VALID_URL = r'https?://(?:www\.)?vevo\.ly'.. def _real_extract(self, url):. req = self._request_webpage(url, None). video_url = req.geturl(). return self.url_result(video_url)..class VevoPlaylistBaseIE(old):.. def _real_extract(self, url):. try:. mobj = re.match(self._VALID_URL, url). playlist_id = mobj.group('id').. webpage = self._download_webpage(url, playlist_id). cookies = self._get_cookies(url). token = cookies.get('ApiToken').value if cookies and 'ApiToken' in cookies else None. if not token:. # tokenUrl = 'https://www.vevo.com/%

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-68Q6V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1765
Entropy (8bit):	5.028584459713193
Encrypted:	false
SSDEEP:	48:hNRu9oY3EzDPEL0sUGekE0BpMks/S3ZNksEtD59HLNfrONByoY:X4oY3Ez7EL0sUGhEuLs/SpysEtDTRKfs
MD5:	E0585F37981AC27BFE7922F8FC752623
SHA1:	594ECA2CA28825B9679AE35D5FB6A6CF32F8B6BC
SHA-256:	BAFD53996FD7EE21916B0AF31554E8226B2266A58E73285CB54A3D166EEDEBAE
SHA-512:	3DABB439FB7C5DEFD1F40BC1A46D33944D9344CE78076E2B8BDD763CC24D3A30684F84EDEE9F2641067B1F5BEFB5C32B7EB208605D92B30D6B17117E9866A13A
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..extractor.vimeo import VimeoIE....from ..utils import (.. int_or_none,.. merge_dicts,.. urlencode_postdata..)..from ..utilsEX import (.. url_result..)....class stockfeelIE(InfoExtractor): .. #https://www.stockfeel.com.tw/video_page/?watch=bnI1cnN3Q2ZKc1prUjVLWUNoVStzbTJCc2dDVTZFTXlPSFA0b2xZazh0OD0=.. _VALID_URL = r'https?://(?:.+\.)?stockfeel\.com\.tw/video_page/.'.... def _real_extract(self, url):.. video_id = '123'.. webpage = self._download_webpage(url, video_id).... hash_id = self._search_regex(r'hash_id\s=\s*\'([^\']+)', webpage, 'hash_id', default=None).. result = self._download_json('https://stockfeelapi.com/video/getVideoId', video_id, data=urlencode_postdata({'hash_id': hash_id, 'cookie_id': None})) .. #"referrer":url.... #{"sta

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-6F183.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25685
Entropy (8bit):	4.892109324864002
Encrypted:	false
SSDEEP:	768:zav8wWG7mCb8VGcdOxEsTzl+4BaH/K5sWPOB8W:zav8VGMV8EQl0WPOB8W
MD5:	A7200C72A23D53DD38CD0D0D92A5209D
SHA1:	F4201B0EB6A5A24CF78A899531E996140D234E11
SHA-256:	BCD223FD6A861FC87B82AFB61E1F133401141EC95C509FC2837945B12CB74B55
SHA-512:	0EACF3E37D1ADD1A411B3671158C4DB3751ACC60413AAA56E8AD14D0ADF0AC72229F9DB45F60F2080F0565AC375451C00DF14269DF4339F94058BA2CD99354FE
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.from __future__ import unicode_literals.import re.import os.import tempfile.import json.from ..extractor.cbsnews import CBSNewsIE as old.from ..utils import (. int_or_none.).from ..extractor.common import InfoExtractor.from ..utilsEX import downloadWebPage_BYHeadlessBrowser..class CBSNewsIE(old):. def _real_extract(self, url):. try:. webpage = self._download_webpage(url, url). formats = []. mobj = self._search_regex(r'data-cbsvideoui-options=\'([^\']+)', webpage, 'data', default=None). if mobj:. data = json.loads(mobj). vid = data['state']['video']['id']. title = data['state']['video']['title']. medias = data['state']['video']['medias']. thumbnail = data['state']['video']['image']['path']. for key, media in medias.items():. if media['url'].find('rtmp') != -1:. continue.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-6FCNB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	4.690440231242077
Encrypted:	false
SSDEEP:	96:+4HGS5pJW5fvZHZXFZ5FZ0mbaJ6OxRIHOkKoINVZt46NKC+tofz:+/YJW5/NYmbaTROOhoI/w6NKCfz
MD5:	8B79DFDF83AB2B29D7F76DBBE089F55D
SHA1:	8BAFA28124FA94165A5903580E7877A5B9CBE30A
SHA-256:	1CB8D4A3E2CDCF2225476954F9E1B022CAD6D08D795CA6FBE0B2DD49CD2839D5
SHA-512:	A9A480369489407984BD5A42AC0A668241B80CDA1162945BA3C85B7D22A75DE8224688B10DCA7AA5499292C88359D5D0A475C245266BB49FC94430E53C515634
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import os.import re.import sys..from ..extractor.common import InfoExtractor.from ..extractor.generic import GenericIE as OldGenericIE.from ..utils import (. sanitized_Request,. ExtractorError,. determine_ext,.)..from ..compat import compat_urllib_error..class CommonHTML5IE(InfoExtractor):. _VALID_URL = 'html5://(.*)'... def _is_valid_url(self, url, video_id, item='video', headers={}):. url = self._proto_relative_url(url, scheme='http:'). # For now assume non HTTP(S) URLs always valid. # if not (url.startswith('http://') or url.startswith('https://')):. # return True. try:. self._request_webpage(url, video_id, 'Checking %s URL' % item, headers=headers). return True. except ExtractorError as e:. if isinstance(e.cause, compat_urllib_error.URLError):. self.to_screen(. '%s: %s URL is invalid, skipping' % (v

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-6HKEO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4565
Entropy (8bit):	4.778919807150728
Encrypted:	false
SSDEEP:	48:PuEyb8CkCvgCTzIXLjWZc7Qo/EQsUFC9ejSvL+fZXhzO/BeBlXBx0lNz8/a2qZ6r:LKBz8EqQo/LsUFsmjSAi2DRFrYftR0
MD5:	5B5F0BC1DAA15BDE1A531635640BF45F
SHA1:	748D4F7A02309BD4F3E43320C27CA57C2314856F
SHA-256:	A1F8E5F8E858C2CD8CCF0F3AE328D0C959EE849B526B7A9ECCCB574637B006AC
SHA-512:	2023E0BBA942F2D09BBBAB024E949809069EA3C5F0E403469C9A1DAD977642D0F4A0A47238302BCE44DD48AD4EE2FF5A0C40538ADDB3C4A23A43DE35E3B0F9A0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals.from ..utilsEX import (. download_webPage_by_PYCURL,. downloadWebPage_BYHeadlessBrowser.).from ..compat import compat_kwargs.from ..extractor.udemy import (. UdemyIE,. UdemyCourseIE as OldUdemyCourseIE,.)..class UdemyExIE(UdemyIE):. def _download_webpage_handle(self, args, *kwargs):. headers = kwargs.get('headers', {}).copy(). headers['User-Agent'] = 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Mwendo/1.1.5 Safari/537.21'. headers['X-Requested-With'] = 'XMLHttpRequest'. headers['Host'] = 'www.udemy.com'. # This header is taken from https://github.com/FaisalUmair/udemy-downloader-gui thanks to @FaisalUmair for quick help.. for cookie in self._downloader.cookiejar:. if cookie.name == 'access_token':. headers['Authorization'] = 'Bearer ' + cookie.value. break. else:. headers['Authorization'] = 'Basic YW

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-6K02C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	12992
Entropy (8bit):	4.539021467668232
Encrypted:	false
SSDEEP:	384:wmFoQJa8Xdu0Ltf2pv+Mk20Tdkf2guSy7iwe0v6ObOriXIZeL:wmFoQJtd75f2h+Mk20Tdkf2guSymweJg
MD5:	1EF2A1E0BAACC0145C159D04604FA9D9
SHA1:	DEE16792FC0C9F660DE199CCD535E9F6FE54054F
SHA-256:	50048DF7852C3DF2931E5B3E0F2026C64978341729DC8A8185E7D10429D767ED
SHA-512:	13665F812877D5624C5234A3A08CFDF8B929E2278D95ACBAED5EF24052F224960943313FBB3E93A5186474C63D3C67554B166805ADA13B40956D434EC18E52EB
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..import re.import json.import itertools.import threading..from ..utils import (. smuggle_url,. determine_ext,. int_or_none,. sanitized_Request,. try_get,. parse_filesize,. unsmuggle_url,. std_headers,. RegexNotFoundError,. ExtractorError,.)..from ..compat import (. compat_str,. compat_urlparse,. compat_HTTPError.)..from ..extractor.vimeo import (. VimeoBaseInfoExtractor,. VimeoIE,. VimeoChannelIE,. VimeoReviewIE,. VimeoOndemandIE as OldVimeoOndemandIE.)...class VimeoBlogIE(VimeoBaseInfoExtractor):. IE_NAME = 'vimeo:Blog'. _VALID_URL = r'https://vimeo\.com/blog/([^/]+)'.. def _real_extract(self, url):. html = self._download_webpage(url, None). vid = re.search(r'data-config-url="(.*)/config', html) . if vid:. playUrl = vid.group(1). try:. ie = VimeoIE(self._downloader). ie_result = ie.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-6SD47.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1522
Entropy (8bit):	5.109985501863962
Encrypted:	false
SSDEEP:	24:1R8lpvk8WQ1VGV/x7uoeIXjvzc3yRrkBUtbMKzmhDc8jvnUTBeBXtvaHMdMMl5RD:PujWSVK7uojXjAtBSbLzmVrnUTBeB9vl
MD5:	A2BA2777C6FB8BE79CF0470058020D7D
SHA1:	9294CD38F6D35955B8EDDB693AEB2D704E778CB4
SHA-256:	709928A26AA7CD3F8B8012CFB48132ED81C33B1C20ED979C557B6AC1BB156F31
SHA-512:	0BFEEC90D27B9DAB61D8D3B9AFE60D0A42499F009864CD772AA754A6B4F811C88A5865DB2E2C69FC2D7A15CF783472DA8FEF70C80050049DDA82CA16EA651CA5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..extractor.common import InfoExtractor.from ..utilsEX import (. downloadWebPage_BYHeadlessBrowser,.).from ..utils import (. determine_ext.)...class CamwhoresIE(InfoExtractor):. # http://www.camwhores.tv/videos/1826836/lunaxjames-fucking-my-asian-sex-doll-premium3/. _VALID_URL = r'https?://(?:www\.)?camwhores\.(?:org\|tv)/(?:videos\|embed)/(?P<id>[^/]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage, _ = downloadWebPage_BYHeadlessBrowser(url). # <video class="fp-engine" src="http://www.camwhores.tv/get_file/23/f8920c78bd107adbbe6672961a3560190d7ed653dc/1826000/1826836/1826836.mp4/?rnd=1519807399739" preload="metadata" autoplay="" hola-pid="3" x-webkit-airplay="allow"></video>. video_url = self._search_regex(r'<video\s+class="fp-engine"\s+src="([^"]+)', webpage, 'video_url'). if not video_url:. return super(CamwhoresIE, self)._real_extract(url).. tit

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-6TNVG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.420521526199258
Encrypted:	false
SSDEEP:	24:1R8l8vaOidyc2kGBUSd244VKbfFqG6Om/9ZFX/:Puj2kjSd2pVeFqG6pNv
MD5:	7D95E6F27C32179F61EACCD5717CBDD2
SHA1:	B9ADE8E36829CBE35236086D8F904C8A00B808D6
SHA-256:	CC134F549559476AD5EA0A4D6D03F40D54D980C4A17C2F73034B73A7A7B62C64
SHA-512:	12CA324B9D1CBEBB975C6ECD3E0226E3063B56E85BDC1992BA5C27E02FD6BD0152F6C46E4CB4B215835D9BAD696380A1CC36B9CA938A989FC9C87561E373786B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from ..extractor.common import InfoExtractor.from ..utils import (. int_or_none,. ExtractorError,. sanitized_Request,. UnsupportedError.)..from ..extractor.veoh import VeohIE as OldIE...class VeohIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?veoh\.com/(?:watch\|iphone/#_Watch)/(?P<id>(?:v\|yapi-)[\da-zA-Z]+)'.. def _real_extract(self, url):.. if OldIE.suitable(url):. old = OldIE(). old.set_downloader(self._downloader). try:. result = old._real_extract(url). if result:. real_url = result['formats'][0]['url']. if real_url.find('anyclip')!=-1:. raise UnsupportedError(real_url). return result. except UnsupportedError as e:. raise e. else:. pass.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-7OVTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5067
Entropy (8bit):	4.749966752579689
Encrypted:	false
SSDEEP:	96:eUpVaDyxJJqUBnuo6/oIXCIZolW8ogeM2nJH7yXDC:e7yx7qUrCPgf47t
MD5:	89C25D43422E70438BF60F353B6E0E4F
SHA1:	5AB69D50D2AB16D5F0F691469FAE1066CCDECB51
SHA-256:	A3FF8618681FC4069301C6F2CD92C1C79FEEC966ACE6718A6C6CBCA12145FC42
SHA-512:	5E8104A24B9BD6C77255D6178A87D93FBB30056502E07D88CB12F3A6786A68B1A39A805DED9B1F6004632F467569013B5724738AFF9ED71759C6D1175833DAC5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import sys.import socket.import itertools..from ..compat import (. compat_HTTPError,. compat_urllib_request,. compat_urllib_parse_unquote_plus,. compat_urllib_error,. compat_http_client,..)..from ..extractor.common import InfoExtractor.from ..utils import (. str_to_int,. update_Request,. update_url_query,. sanitized_Request,. error_to_compat_str,. orderedSet, ExtractorError.)..from ..utilsEX import url_result..from ..extractor.pornhub import PornHubIE, PornHubPlaylistBaseIE..def _extract_entriesEx(self, webpage):. # Only process container div with main playlist content skipping. # drop-down menu that uses similar pattern for videos (see. # https://github.com/rg3/youtube-dl/issues/11594).. container = self._search_regex(. r'(?s)(<div[^>]+class=["\']container.+)', webpage,. 'container', default=webpage).. return [. url_result(. 'http://www.pornhub.com/%s' % v

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-8HMJU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4658
Entropy (8bit):	4.2461235940282025
Encrypted:	false
SSDEEP:	96:Y+njJZWQ3LdETujnEwQ8/F5L8QKshdbA5H8Wfbt:nnjJL7qCn/oQKshdbDWfbt
MD5:	B84C369D54A263A7DFFE8C9269077D3A
SHA1:	1F7A8FAF764D03B6AAE6F78570045704C7BD8101
SHA-256:	CEB65D0527719C24DFDBF4C085E471638873A01B89E7D711A492080A48DE7A54
SHA-512:	DEC68B711CEAC71347F5E01E92D84AA282B3BD92CDC335E50E18FB0FDF9985C27C84BEF239D0848DE1ADDC9F3F36BF92B518B8A0CCD7ACA3EE9AE13A544232C6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.import re.import threading.from ..extractor.common import InfoExtractor..from ..utils import (. compat_urllib_parse,. parse_duration,.)..class YoutubeExternallinkSiteIE(InfoExtractor):. _VALID_URL = r'https?://(.\.)napster.com/artist/(.)track/.*'. _TEST = {. 'url': 'http://gb.napster.com/artist/madness/album/keep-moving-salvo/track/wings-of-a-dove',. }. def __init__(self):. self._lock = threading.Lock().. def getVideoInfo(self, vid):. url = 'https://www.googleapis.com/youtube/v3/videos?part=snippet%2CcontentDetails' \. '&key=AIzaSyBW7ikTCKkhOZqSPUPkf5xVw12cjYKI5Ag&id=' + vid. data = self._download_json(url, url). return {. 'id': vid,. 'url': 'https://www.youtube.com/watch?v=%s' % vid,. 'title': data['items'][0]['snippet']['title'],. 'thumbnail': data['items'][0]['snippet']['thumbnails']['default'],. 'de

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-8OC4U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3649
Entropy (8bit):	4.53233105291734
Encrypted:	false
SSDEEP:	96:llD+7XatwwbG0c7g9fuCvfQX1wt/g9b3ergBT3xsxl6N38so:lFptw90tJuCnsO/gR3erwTBs76NMx
MD5:	733A542D2F0B78F173D08449A28AFCFC
SHA1:	5F54880D4C7C95AE25327C1B7D7E251BCB740019
SHA-256:	7613C5CEF8838CC8111897F17B0CA9BE9061945D3A332FC456510180B6DC0413
SHA-512:	DE413EFCC58FA1D0D2049171B94C80F52FB25CC40F760355873A99626B92981A87745818F0060B15D69832EB47D2AB952EB61DD10E5BE7CBEB505B2BCCAFC54B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from ..extractor.common import InfoExtractor.from ..utils import int_or_none...class CollegeHumorIE(InfoExtractor):. _VALID_URL = r'^(?:https?://)?(?:www\.)?collegehumor\.com/(video\|embed\|e)/(?P<videoid>[0-9]+)/?(?P<shorttitle>.*)$'.. _TESTS = [. {. 'url': 'http://www.collegehumor.com/video/6902724/comic-con-cosplay-catastrophe',. 'md5': 'dcc0f5c1c8be98dc33889a191f4c26bd',. 'info_dict': {. 'id': '6902724',. 'ext': 'mp4',. 'title': 'Comic-Con Cosplay Catastrophe',. 'description': "Fans get creative this year at San Diego. Too creative. And yes, that's really Joss Whedon.",. 'age_limit': 13,. 'duration': 187,. },. }, {. 'url': 'http://www.collegehumor.com/video/3505939/font-conference',. 'md5': '72fa701d8ef38664a4dbb9e2ab721816',. 'info_di

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-8SKHK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	4.664954311468465
Encrypted:	false
SSDEEP:	48:+uE08zfOM5HnFvXjlkeBDL5BYMaHDraX6XnqpeVrkZeXwG8t46Ng:ozfv5gaCDraXwqpFZRDt46Ng
MD5:	E5244DCE16FB493A51EF3B3C455E48A5
SHA1:	5AF528304930DF3CC45EEB1B9FF75F63529779EE
SHA-256:	5A5B183BD78405120E9F18D8C9C3DAEAE15C9BF10C2544B1D2F7F62ADE521A09
SHA-512:	5602ADBC73C8E888A59FA50882CEF5549B8000DE4AC5FC0DE7F5901D20C6EFC0FB468A576D2A12DE528D8DA670CEA0CB79FDE37A7E90AA32BA70D1BE4CF10679
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from ..extractor.tumblr import TumblrIE as TumblrBase.from ..utils import int_or_none...class TumblrIE(TumblrBase):. _VALID_URL = r'https?://(?P<blog_name>[^/?#&]+)\.tumblr\.com/(?:post\|video)/(?:[^/]+/)*(?P<id>[0-9]+)(?:$\|[/?#])'.. def _real_extract(self, url):. try:. return super(TumblrIE, self)._real_extract(url). except:. pass.. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). video_url = self._search_regex(. r'"hdUrl":"([^"]+)"', webpage,. 'video_url', fatal=False). if not video_url:. video_url = self._search_regex(. r'<source[^>]+src=(["\'])(?P<url>.+?)\1', webpage,. 'video_url', default=None, group='url'). video_url = video_url.replace('\/', '/').. formats = [{. 'url': video_url,. 'ext': 'mp4',. }]..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-8TADG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	882
Entropy (8bit):	4.612281380309176
Encrypted:	false
SSDEEP:	12:1RjYa4JvvifbxtYSJj28/XpIGCvLru3VSr4QN/W8Xeod15AxloH8FpRVWE:1R8ldvumGCvLzr4Q01yAxlo6RVWE
MD5:	D59B0F6DE7D0637C9AE5FAFC907DEE95
SHA1:	2F1EB7640494BD64ECA39563617702FBD9CBE953
SHA-256:	0DBC0765AADAC05553D2CA42436B0A55A54B4C6062038FC559B86C9CE99E342F
SHA-512:	203B67C7A9B511663E6197DA2955E9792D9C51FE620E7BF438950DA8C1D368D2A0AB42898CE6F474D0751503E94EE4231F6C1C5736169B5A276BBF2B0AEB8790
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals.import re..from ..extractor.common import (. InfoExtractor,.)..from ..compat import compat_urllib_parse_unquote..class VideoBashIE(InfoExtractor):. IE_NAME = 'VideoBash'.. _VALID_URL = r'https?://(?:www\.)?videobash\.com'.. def _real_extract(self, url):. html = self._download_webpage(url, url). mobj = re.search(r'&file="\s+\+\s+\'(.+)\'\s+\+\s+\'([^\']+)?', html). if mobj:. url = compat_urllib_parse_unquote(mobj.group(1) + mobj.group(2)). title = self._html_search_meta('og:title', html). thumbail = self._html_search_meta('og:image', html).. return {. 'id': 'xxx',. 'title': title,. 'formats': [{'url': url}],. 'thumbnail': thumbail,. }... else:. raise 'not support'.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-91K5H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	4.847726915049585
Encrypted:	false
SSDEEP:	48:Puw+qHl2VrnUTBeB1tBp8zpaeuXHMnEclOMCWGCAFWJhAeBT+to6Nz:7HcUdO91+bkMDAAJh3BT+to6Nz
MD5:	9A3D9580466630D946E33B761586423C
SHA1:	21BA6B46EF02FF8FF096612412D3887163808E6A
SHA-256:	66F20B1D41C71F660A01CEF4D7B281C5128AD60224CF67C7E51061CE3B50FA01
SHA-512:	0E43B1DFE5C30BAFDD5EE2D6FC001E622815D01709ADAD04643ADEE1E4BCF2B1E9810522E4C15352C49EDE6E0453FFAC86B67078F73CCBD8661EC51497EDD96A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from ..extractor.common import InfoExtractor.from ..utils import (. js_to_json.)...class sexixnetIE(InfoExtractor):. #http://www.txxx.com/videos/2631606/stepmom-seduces-teen-babe/. _VALID_URL = r'https?://(?:www\.)?sexix\.net'.. def _real_extract(self, url):. webpage = self._download_webpage(url, url). title = self._og_search_title(webpage, default=None) or self._html_search_regex(. r'(?s)<title>(.*?)</title>', webpage, 'video title',. default='video'). thumbnail = self._search_regex(r'image: \'([^\']+)', webpage, 'thumbnail', default=None). vid = self._search_regex(r'<iframe src="http://sexix.net/v.php\?u=([^"]+)', webpage, 'emb'). embUrl = 'http://sexix.net/v.php?u=%s' % vid. headers = {'Referer': url}. webpage = self._download_webpage(embUrl, vid, headers=headers).. jw_config = self._parse_json(. self._search_regex(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-96MJ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (3307)
Category:	dropped
Size (bytes):	15890
Entropy (8bit):	4.692279315383858
Encrypted:	false
SSDEEP:	192:1ldk77ibsDl/6q7xfV1pyXW+LO4SJvllrzHQEcaDN5580TaDtHQEo1+PSkJgQ80T:zdk77EsDp6qNw4Xk0Twm5MTC2
MD5:	A92EC1D8D3ABB3A09BF0AFF8793DD308
SHA1:	BE1B9034F465D6FCFF21BB8BD9AADB59F60D47B2
SHA-256:	9524EB783DEFABA6EB25B5CC1DC6ABD9D7CC521395A381736033C3113075B612
SHA-512:	C06F92243497F6E6A75ED4DC639316F4D8948859CCF5553ED930275D2F4303CB54EC3024B58321415B20E749479ADBB4C617FE5BBA2353AEC3FC30A7C460704E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json.import itertools.import threading..from ..utils import (. clean_html,. urlencode_postdata,. int_or_none.)..from ..compat import (. compat_urllib_parse_unquote_plus,.)..from ..extractor.dailymotion import (. DailymotionBaseInfoExtractor,. DailymotionUserIE as OldDailymotionUserIE,. DailymotionPlaylistIE.)..def url_result(url, ie=None, video_id=None, video_title=None, video_duration = None):. video_info = {'_type': 'url',. 'url': url,. 'ie_key': ie}. if video_id is not None:. video_info['id'] = video_id. if video_title is not None:. video_info['title'] = video_title. if video_duration is not None:. video_info['duration'] = video_duration. return video_info..def _extract_entries(self, id):. video_ids = set(). processed_urls = set(). for pagenum in itertools.count(1):. page_url = self._PAGE_TEMPLATE % (id, pagenum).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-9H02M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	4.65117714984295
Encrypted:	false
SSDEEP:	48:1uBOro/EyoylmAFSw/XjSKl9OupEudH4puCa7SR4LOF+B9i6NQ:OOro/joyYkzouSciuBSaLOF+Bk6NQ
MD5:	8476C32C2B6A098A4B8A4F7E2A66BCF0
SHA1:	D52EDC8FA3600DDD89EBD8C98B8E6A7337A4ED95
SHA-256:	73E45DC378C40CD09631297CB99DE7ADAA28C29F7C0D78A74356BFBD4D47B611
SHA-512:	CC3597141BE3BCF0C6FF45AFBF5A6EA9901C7A09EA0E78D0FFABA6FE350E2A9F250A57A0838940B929FAAB6589AC48B4DF2B79D99ED369FFF4C8EABB53B00D00
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8..from __future__ import unicode_literals.import re.import json.from ..utils import compat_str,determine_ext.from ..extractor.fox import FOXIE as Old, try_get.from ..utilsEX import download_webPage_by_PYCURL.import uuid.class FoxIE(Old):. def _download_webpage(self, url_or_request, video_id, note=None, errnote=None, fatal=True, tries=1, timeout=5, encoding=None, data=None, headers={}, query={}):. try:. return super(FoxIE, self)._download_webpage(url_or_request, video_id, note, errnote, fatal, tries, timeout, encoding, data, headers, query). except:. return download_webPage_by_PYCURL(self, url_or_request, timeout, data, headers, query).. def _real_extract(self, url):. try:. result = super(FoxIE, self)._real_extract(url). if not result:. raise Exception('ori parser fail'). return result. except Exception as ex:. video_id = self._match_id(url). head

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-9UCOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4916
Entropy (8bit):	4.500929267737223
Encrypted:	false
SSDEEP:	96:YOQPePjfwNohm+DJsHw1hfHX8JuaCJy5N4zbWdeLOt+BDBTL4F6Nu:tQPePcNcm+DJsHOfjy5mHW0LOt+BlTub
MD5:	B6DAFF5F0B9AACF894AD00902C773365
SHA1:	602BE5C6A6FF7AB53E8B71ED45D15A0B9B3D6EAB
SHA-256:	E4A559BEF9F4D82753B4EE2F5F3E44414374C4AB6584FFCBF8F6170FFBCBF545
SHA-512:	D9B7A71A6703EC41A46D0DC59E50C44F249BDF205C867CAF4A30A1B5A25DF535BC5B1DE1B348C5C37978387BF77FDFA66E37A20B79FE26028FA8DE96F93265E1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from ..compat import (. compat_cookies,. compat_HTTPError.)..from ..utils import (. sanitized_Request,. determine_ext,. int_or_none,. js_to_json,. ExtractorError,. urlencode_postdata.)..from ..extractor.funimation import FunimationIE as old..class FunimationIE(old):.. def _get_cookies(self, url):. """ Return a compat_cookies.SimpleCookie with the cookies for the url """. req = sanitized_Request(url). self._downloader.cookiejar.add_cookie_header(req). return compat_cookies.SimpleCookie(str(req.get_header('Cookie'))).. def _download_json(self, url_or_request, video_id,. note='Downloading JSON metadata',. errnote='Unable to download JSON metadata',. transform_source=None,. fatal=True, encoding=None, data=None, headers={}, query={}):. headers = {}. try:. _TOKEN = se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-AJO5T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	4.572268668824635
Encrypted:	false
SSDEEP:	24:1R8lLv9mRGglxBf59pBwGtXIGp+VNPgAxloiURVSIVCMCLZRFC3b:PuQRblxBR9pBwIYGpYNPgAohCwXeZw
MD5:	0F40F688B23FBE595DCDCB8980A55CE2
SHA1:	55C5A7FF12D9390010549952A72606B60ACC2B8C
SHA-256:	055A6353C5792AA8DBA9735AFB5E3E784C5EC4302FEF26325B3FDE091765844F
SHA-512:	49212DD36DCEA1B865ECB964D2A42377832A601FA4E66741FDCF7A71462C7FB1CA43102C442D80FC62E14AD347789498863D5371CD56BACFB4ACDC48B5D365FA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from ..extractor.common import (. InfoExtractor,.)..from ..utils import js_to_json...class StupidVideosIE(InfoExtractor):. IE_NAME = 'stupidvideos.com'. _VALID_URL = r'https?://(?:www\.)?stupidvideos\.com'.. def _real_extract(self, url):. webpage = self._download_webpage(url, url). id = self._search_regex(r'#([0-9]+)$', url, url, default=None). if not id:. id = self._search_regex(r'var\s+videoID\s=\s\'(\d+)', webpage, 'id', fatal=False). if id:. if len(id) < 6:. id = '0' + id. play_url = 'http://videos.stupidvideos.com/2/00/%s/%s/%s/%s.flv' % (id[0:2], id[2:4], id[4:6], id). title = self._html_search_meta('og:title', webpage). thumbail = self._html_search_meta('og:image', webpage).. return {. 'id': 'xxx',. 'title': title,. 'formats': [{'url': play_url}],.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-BBUIU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1985
Entropy (8bit):	4.909498260368371
Encrypted:	false
SSDEEP:	48:1u/f+RCZLfwpapPXSnDFBSPx5+bGUsBlmD0/LrJDku1aRNm6Nu:0iELfwIQniT+K/dRGNm6Nu
MD5:	A446672734A91562309B98675CA6D725
SHA1:	81613121D95D2088CC3420E0DE20393D564C7C4A
SHA-256:	F537D30CC2130DC688D0A5BA0D0BF4836149195D526983900AF9E233CBB330B5
SHA-512:	197D0147A18C2D8E4A4E5A9C0A683993A8F9723ED646DF8D72792206D29CD8CDF714072216FA78471694E3FF9ADF41D9B5C1528DF8D1A89961D962286F1AD877
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8..from __future__ import unicode_literals.import sys.if sys.version_info >= (3, 0):. from urllib.request import quote, unquote.else:. from urllib import quote, unquote.from ..extractor.common import InfoExtractor.from ..utilsEX import (. Kown_Video_EXTS,. Kown_Audio_EXTS.)...class OneDriverIE(InfoExtractor):. _VALID_URL = r'https?://(?:onedrive\.live\.com/.+authkey=\|1drv\.ms)'.. apiUrl = 'https://skyapi.onedrive.live.com/API/2/GetItems?authKey=%s&id=%s&cid=%s'. def _real_extract(self, url):. #self._downloader.cookiejar.clear(). webpage = self._download_webpage(url, url, ''). if url.find('1drv')> -1:. url = self._html_search_regex(r'"refresh" content="0;url=([^"]+)', webpage, ''). webpage = self._download_webpage(url, url, ''). filesConfig = self._search_regex(r'FilesConfig\=(.+);var', webpage, ''). filesConfig = self._parse_json(filesConfig, ''). authKey = quote(filesConfig['authKey']).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-BG4O1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	50632
Entropy (8bit):	4.648344761521366
Encrypted:	false
SSDEEP:	1536:T0lwezdkqllOlmWWHFYXPGckRu2jW/zw+loTpdb+8o4CkTpdbM8IV:T0ewiwcV
MD5:	BFCFDBA44319836993AF07C5A9895D59
SHA1:	890B2923346ADC7D5490ED8FD0B5A7FFDD6975FE
SHA-256:	1D2825EF2709EC916021438E9A89F94C0B2344EC810FC906EFFF1477475EFCA8
SHA-512:	3830EC7C78E4E661DCE37D7035D55E078C5452323DC438B4D4A944445F8D33870EB553F63DC7A451A2E272DE1C8BE8A9DAB0E9232047672C9E48F8F3754BD09F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals.import itertools.import re.import io.import os.import errno.import traceback..from ..extractor.common import InfoExtractor, SearchInfoExtractor.from ..extractor.youtube import YoutubeBaseInfoExtractor as _YoutubeBaseInfoExtractor.from ..extractor.youtube import YoutubeIE as _YoutubeIE.from ..jsinterp import JSInterpreter.from ..compat import (. compat_urllib_parse_unquote_plus,. compat_urllib_parse_urlencode,. compat_urlparse,. compat_urllib_parse_unquote,. compat_parse_qs,. compat_urllib_parse_urlparse,. compat_str.)..from ..utils import (. int_or_none,. clean_html,. ExtractorError,. get_element_by_attribute,. orderedSet,. unescapeHTML,. uppercase_escape,. sanitized_Request,. parse_duration,. expand_path,. smuggle_url,. unsmuggle_url,. get_element_by_id,. unified_strdate,. remove_quotes,. try_get,. str_to_int,. mimetype2ext,. parse_codecs,. float_or

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-BPKVA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	4.765138295932007
Encrypted:	false
SSDEEP:	24:Gacc8ldvJVNCGheIXjlgtRBJrmw4ZbWVhDcuhDCehDU8/lbSgRLEs:DNufVNCkjXjlkRBt5VzVCeVU8AgtEs
MD5:	E85C0E8905D92707329F765CD9D55527
SHA1:	55DF484C0CF7D13CA983BCE7B9EE5D32A891AED5
SHA-256:	E7F65579D69253AC6B0627DD595659F25C1982356F9B9DC6F8D6505612FF0567
SHA-512:	D8A6ECC3C9FF64128825390EB49D9E1B0EC0698CDE62D473878D648B47DA44BFB9C72A3ED2DBE78095CCD22608163B9194E60F29D08AE174A0B410385C0B1AD2
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..import re.from ..extractor.common import InfoExtractor..class PorntrexIE(InfoExtractor):. # https://www.porntrex.com/video/352482/owen-gray-rough-sex-and-creampie-with-ivy-lebelle. _VALID_URL = r'https?://(?:www\.)?porntrex\.com/video/\d+/(?P<id>[^/?#&]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). flashvars = self._search_regex(r'(?is)flashvars = {(.+?)};', webpage, 'flashvars'). video_urls = re.findall(r"'(?P<url>https://.*?.mp4[^']+)", flashvars). if video_urls:. video_url = video_urls[-1]. title = self._og_search_title(webpage). description = self._og_search_description(webpage). thumbnail = self._og_search_thumbnail(webpage).. return {. 'id': video_id,. 'url': video_url,. 'title': title,. 'descri

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-C7090.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4458
Entropy (8bit):	3.9461584623752928
Encrypted:	false
SSDEEP:	96:FaxwJg9kaWlttsr0lIrQThjNkiSs8K6qUBzqiiTTWj1N41mgC:cMg9kaWl6Oys8K6qciTT041mgC
MD5:	74E32FDD9CC2930662E0C305B21C743C
SHA1:	34E0322247771461AD777D84555F3A898A488ED3
SHA-256:	2439241AAB1664005E7C28F1A925C81877F8C892A2499B60FC221DD5FE70EF32
SHA-512:	C56D9737BAEEA03FE85A7C81516D6B5488D9C21DD35EC3FB5A2ACF438D87698420845B966A0937B45B8FDDE61884149CAB40F959591875A3AD3711063DB37D6B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.# ..............from __future__ import unicode_literals..from ..extractor.niconico import NiconicoIE as InconicoBase.from ..utils import (. float_or_none,. remove_start.).import json..class NiconicoIE(InconicoBase):. def _extract_format_for_quality(self, api_data, video_id, audio_quality, video_quality):. try:. def yesno(boolean):. return 'yes' if boolean else 'no'.. session_api_data = api_data['video']['dmcInfo']['session_api']. session_api_endpoint = session_api_data['urls'][0].. format_id = '-'.join(map(lambda s: remove_start(s['id'], 'archive_'), [video_quality, audio_quality])).. session_response = self._download_json(. session_api_endpoint['url'], video_id,. query={'_format': 'json'},. headers={'Content-Type': 'application/json'},. note='Downloading JSON metadata for %s' % format_id,. data=json.dumps({.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-CHR2O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	423
Entropy (8bit):	4.6694981019576165
Encrypted:	false
SSDEEP:	12:GaccjYa4JSQfuViKgqzguFhC2JYLbjHKOGsFEYmd:Gacc8lc5A74FhebjHjGsx+
MD5:	757DBFBD80E006AF1B695C1E7B2DD7DE
SHA1:	2C2B68F706C1F95E2791788CC338809DF9177B43
SHA-256:	82A74715BCEF5625A101140D63D3C0A0FD498696F46E737C9B84980DBDD41876
SHA-512:	3BB26753B8E21124630BED90AE1E86EF832C741EEE39CF2A9F4D02703D44DDC71BAFB7DA5B25F4FE4B0B12823A878ECA8D2924C901BE65B883F913B524AA75C4
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals.from ..extractor.rtbf import (. RTBFIE as OldRtbfIE.)..class RtbfIE(OldRtbfIE):. def _real_extract(self, url):. result = super(RtbfIE, self)._real_extract(url). # ....... if result.get('formats', None):. for i, format in enumerate(result['formats']):. format['preference'] = i.. return result

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-CLKAB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	4.897022826386292
Encrypted:	false
SSDEEP:	24:Gaci8lpvRU0FoiIneIXjCMKxL1vvytPMKMCtJe9TlHlDNEgebDNEgeUxlJRLv8cR:D9uUHnjXjCLxNvmPLMaej5M5Ltv8cig
MD5:	52E43FF889A9FC66D4E6D9F4FAC14F7E
SHA1:	AA997B036F97A131E68AB1169761F7706F6ED98B
SHA-256:	798528227E6EFFB76D6FB7ECD7DE5EBE64142297317BE0C6E3DDFFC9428FF3B0
SHA-512:	34E37A08EDBB7B6144DCDA72C2C90691AD02F16E45F86DC36021E14045584411191ECD07097A8D4A4D2353F0E150281977B1EDF5963E8DADCDDB4102D512A4AA
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals..from ..extractor.common import InfoExtractor..class VidyardIE(InfoExtractor):. # http://play.vidyard.com/tF8dPdhMoMgvTBpgcUhstT. # https://play.vidyard.com/9ngCG5NqECn4FXGEtC9ggi. # http://play.vidyard.com/Kc9BXQXgGyBYNg7smrRB9G.html?v=3.1&hide_html5_playlist=1&name_overlay=0&eloqua_id=&autoplay=0. _VALID_URL = r'(?:https?://)?play\.vidyard\.com/(?P<id>\w{22})'.. def _real_extract(self, url):. video_id = self._match_id(url). if not video_id:. return super(VidyardIE, self)._real_extract(url).. json_url = r'https://play.vidyard.com/player/%s.json' % video_id. video_data = self._download_json(json_url, video_id). if not video_data:. return super(VidyardIE, self)._real_extract(url).. try:. title = video_data['payload']['vyContext']['metadata']['name']. thumbnail = video_data['payload']['vyContext']['selectedThumbnail']['url_versions

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-CR5AF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	503
Entropy (8bit):	4.680348640896364
Encrypted:	false
SSDEEP:	12:UwNRjYa4J3M0ghy+263FMx6QZSviiOiCUGZ9GR+JJgU:UwNR8lVHiyHuF+ZSvb6L9GRK3
MD5:	14E41A060BBF591E64EEBA8E486CF164
SHA1:	73E13BD48249627FB062F9D20446A88B97D273D4
SHA-256:	2AD8C5EDE6CA941150077A9E48A99DF4000DA5105911BB10A483D1E2992E1F39
SHA-512:	9962FF9E475C99E7AD07314AFF5DFCBB9EF5B9286358FC5BEBC082D3965B1C072D049D70D59D6E932A0DC6BBEC7BD6C4D5AB7AF69DE8D02AFF2E9C0661FB3713
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..extractor.cbc import CBCWatchVideoIE as old..from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor....class CBCWatchVideoIE(old):.. def _real_extract(self, url):.. result = super(CBCWatchVideoIE, self)._real_extract(url).. for f in result['formats']:.. if f['vcodec'] == 'none':.. f['format_note'] = 'DASH audio'.. return result..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-CVNIU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	5.018196014475206
Encrypted:	false
SSDEEP:	96:X4dYQhMw/1dF4d6NzK6X+vWSuYatssYtsKpRW0owV:+1dFY6NzK6XxbsjRW0oQ
MD5:	8A2BDB64084C688390FE1D302609FAFF
SHA1:	7C366B6EBE4BBB7A3C87DAAB89E4BA5176A4BE66
SHA-256:	800B71CF3E807915DC1DA6EBA4E66BD8C8F0399BD0780C0E74E9CFE91932769F
SHA-512:	4ACC3703C5144FA316C95AD857E6B26AAD669039562BE15FA413D022B836296A2582134596811A529FCB0ABF93004A45D54765A14B806EAF8671773F283206D4
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..compat import compat_urlparse, compat_urllib_parse..from ..extractor.common import InfoExtractor..from ..utils import (.. urlencode_postdata,..)....from ..utilsEX import url_result....class gatechIE(InfoExtractor): ..#https://mediaspace.gatech.edu/media/Bill+Campbell+-+Astral+TravelingA+Exploring+Afro+Past%2C+Present%2C+and+Futures/1_st6k4thu.. _VALID_URL = r'https?://mediaspace\.gatech\.edu/(?:media/.+/\|media/)(?P<id>[^\\]+)$'.... def _real_extract(self, url):.. video_id = re.match(self._VALID_URL, url).groups()[0] .. webpage = self._download_webpage(url, '').. player_url = self._search_regex(r'src="(https\://cdnapisec\.kaltura\.com/[^"]+)/embedIframeJs', webpage, '123123', fatal=False).. m3u8_url = '%s/playManifest/entryId/%s/format/applehttp/protocol/https/a.m3u8' % (player_url, video_id).. formats = self._extract_m3u8_formats(m3u8_url,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-DA0IR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1483
Entropy (8bit):	4.563253848675161
Encrypted:	false
SSDEEP:	24:UwNR8lVHMkuF+ZSvb1iyd0zIX7j4IB5tstzxuVRIQhl0+5gndbTBH6KwClE:hNRu9MkuFoYKUX7jpB5tazoIOlRABTh4
MD5:	8A43559449924C4F0B6101D7FE5E6AD2
SHA1:	8244486F5B1AEA18F1BEB6C911A2EEB10FDB70ED
SHA-256:	B65A2C6BA9B1B17F18A41E9D0030D49A2015E8E794A58BC17DC6D356C7D8BEA4
SHA-512:	5F686BBDEA00E862835D0674792580B44E49F20AFB45A26E60364355BC555FFF210CFB3B72AFEA768AFFE3AEF39658FE2AF196C95D62566BAABDE04F96ACD7F6
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..extractor.kaltura import KalturaIE as Old..from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..utils import (.. int_or_none,..)....class MotoGPIE(InfoExtractor): .. _VALID_URL = r'https?://(?:.+\.)?motogp\.com/.+\/(?P<id>\d{6,})'.. #.. def _real_extract(self, url):.. video_id = self._match_id(url).. if url.find('video_gallery')> -1:.. webpage = self._download_webpage(url, '').. video_id = self._search_regex(r'<meta property="og:url".+n=(\d+)', webpage, '123123').... response = self._download_json('https://secure.motogp.com/en/demand/video/' + video_id, '').. title = response['video_info']['title'].. protocols = response['cdns'][0]['feeds'][0]['protocols'].. formats = [].. for protocol, value in protocols.items():.. if protocol == 'hls':.. format

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-DG6LS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	836
Entropy (8bit):	4.931322767387622
Encrypted:	false
SSDEEP:	12:GacGTjYa4JzviD17JzXpIGDlrRF+ns9n4j6cGKHtI5svns9n4M3GKTtIYkQ9d9MM:Gaci8lpv8170GDl+sBE3Rt62sBv31tl
MD5:	E1BBB6E4887C5636063B03F65A8A7AB9
SHA1:	49BAE46AB7D8B0CD927EB2888451872ABF1CE7A0
SHA-256:	F8099E0C23F264053066F07D880685ED141B92B91B8B105CB029EDD73BCB83A1
SHA-512:	82AE7156A52393AEA7826A7E311B337B927803E6E38F2DBABB3EC6C5635382B07727E9A95828B1E506043208ECEA816AE691666A4DEF3B299F1258E16599915A
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals..from ..extractor.common import InfoExtractor..class ThiruttuvcdIE(InfoExtractor):. # http://www.thiruttuvcd.biz/movie/2017/11/julie-2-2017-tamil-movie-watch-online/. _VALID_URL = r'https?://(?:www\.)?thiruttuvcd\.\w+/'.. def _real_extract(self, url):. webpage = self._download_webpage(url, 'video_id'). if 'openload' in webpage:. openload_url = self._search_regex(r'<iframe[^>]+?src="(https://openload[^"]+)', webpage, 'openload_url', fatal=False). if not openload_url:. openload_url = self._search_regex(r'(https://openload[^\r\n]+)', webpage, 'openload_url', fatal=False). if openload_url:. return self.url_result(openload_url).. return super(ThiruttuvcdIE, self)._real_extract(url)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-DJHJC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13965
Entropy (8bit):	5.121963757640023
Encrypted:	false
SSDEEP:	96:nHN/5TLe8Fo0gm6sFzKdENL5avFvTJdX+3gHfauvcp3yg0Uj8JWiDpzd3d6hI2ZS:nbF+m/5zQHfah9V8HxdghI2ZTKepxu
MD5:	0AEF26850D273AFBD78B4F61F96C4A65
SHA1:	13CCCDD4EEB89CF927FCAF092BB3376EF964202C
SHA-256:	86640DD0CCD056DB5914B5465535D90D1F1B47E8139D89DB5E1BDBF06A0C67B5
SHA-512:	2A5F79DFE30FCC8E63C18629B84284B9A166185F6400458E44A11EA7D73A147DAFDBB8A8522CF929F8586BB5761BFE958F611828BEFAC707F488517B021F2D86
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from ..extractor.common import (. InfoExtractor,.).from ..extractor.pbs import (. PBSIE.)..class Watch_Thirteen_IE(PBSIE):. _STATIONS = (. (r'(?:video\|www\|player)\.pbs\.org', 'PBS: Public Broadcasting Service'), # http://www.pbs.org/. (r'video\.aptv\.org', 'APT - Alabama Public Television (WBIQ)'), # http://aptv.org/. (r'video\.gpb\.org', 'GPB/Georgia Public Broadcasting (WGTV)'), # http://www.gpb.org/. (r'video\.mpbonline\.org', 'Mississippi Public Broadcasting (WMPN)'), # http://www.mpbonline.org. (r'video\.wnpt\.org', 'Nashville Public Television (WNPT)'), # http://www.wnpt.org. (r'video\.wfsu\.org', 'WFSU-TV (WFSU)'), # http://wfsu.org/. (r'video\.wsre\.org', 'WSRE (WSRE)'), # http://www.wsre.org. (r'video\.wtcitv\.org', 'WTCI (WTCI)'), # http://www.wtcitv.org. (r'video\.pba\.org', 'WPBA/Channel 30 (WPBA)'), # http://pba.org/. (r'video\.alaskap

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-DLF6C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.758828867843373
Encrypted:	false
SSDEEP:	6:1RMABYa4JWmG6y6fs+PoUdCdF/drdQn4NrxHqMCCLBQWQgmVvw9fB6Uuvn:1RjYa4Js6f6lrun4nkCLBQWp59Fuv
MD5:	AA3F697B0567A21436DC8AB1105B466F
SHA1:	49095B5E95D577254F712E32D1AD4F3731569A62
SHA-256:	4F6767BFC0F3D65AF16C660F606DAE706C31B631B243CAF184B1D7664B0AFC2A
SHA-512:	8C8B1DB2A5E2EC1D4188EB8D7FFB9ABB0E953CA52CC8480A39502358E41A93C54491F5B774B65FDEAAF81ED080066ABB0F99FE7EB54A88F385DB4A63BB9FB85F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals.from ..extractor.dropbox import (. DropboxIE,.)..class DropboxExIE(DropboxIE):. def _real_extract(self, url):. webpage = self._download_webpage(url, url, ''). if self._search_regex(r'<div class="error-type">404</div>', webpage, '', fatal=False):. raise Exception('404').. return super(DropboxExIE, self)._real_extract(url)..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-E39JN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2601
Entropy (8bit):	4.914129989019505
Encrypted:	false
SSDEEP:	48:DNuEZHl4BQeVmeBgTebByIOwto6NQFBWVrBHZeBgTebUYpC8OI1UwfjsV0Fy8B3j:D9ZHZdB4yIOwto6NQUZBs+ez65dGOt4n
MD5:	660DAF0FEE4807CAF0EDAE0304039C69
SHA1:	8CA61235877D0EA3E060587DF4AF9776B3FC8436
SHA-256:	8261CBF68DB3DC7CE5B7FCFA7A76E3E04438D882F881B67930EC14AEE9F19E4E
SHA-512:	8F9A73DC24218CE252FAEF6C981FF0E5D511BC8165211AA33EE739DBCB695ACA270196ED6686AA3DD21AB3B650723980637ED8007AE16687279414DA9F3E4E8B
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..import tempfile.import os.import io.import sys.from ..extractor.common import InfoExtractor..class avgle_IE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?avgle\.com'.. def _real_extract(self, url):. webpage = self._download_webpage(url, url). try:. video_url = self._search_regex(r'<source\s+src="([^"]+)', webpage, ''). title = self._og_search_title(webpage). thumbnail = self._search_regex(r'poster="([^"]+)', webpage, '', fatal=False) or self._og_search_thumbnail(webpage). # formats = [{'url': video_url}]. formats = []. formats.extend(self._extract_m3u8_formats(video_url, 'xx', 'mp4', m3u8_id='hls', fatal=True)).. return {. 'id': id,. 'title': title,. 'thumbnail': thumbnail,. 'formats': formats,. }. except:. pass.. video_id = self._s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-EM9DL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1543
Entropy (8bit):	5.038525645722351
Encrypted:	false
SSDEEP:	48:PuM/TWwFRoHCchuilndFvXjGoHCchuTkABU+PBzGmn:jL9F++i9z+wPuL
MD5:	94B06960523821C74DF83F64E166F0BE
SHA1:	77FDCF7B0177C4855EB35284819AA7075ED813B8
SHA-256:	98946AEBCE5DDD2EFB40184FDFB85202C69C487C5A8C2ECFFC9098A1A0A92C61
SHA-512:	EF9AC1229C986D8FB724C67D7E47AA37D263033AB752A322FD752057A99A3495FA4A10A4F46AED6B73CE5EDAB8169ACDD59BDEBCD4A6EC4A9C4FF39595E17C31
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals.from ..extractor.godtube import GodTubeIE as OldGodTubeIE..class GodTubeIE(OldGodTubeIE):.. def _download_xml(self, url_or_request, video_id,. note='Downloading XML', errnote='Unable to download XML',. transform_source=None, fatal=True, encoding=None,. data=None, headers={}, query={}):.. headers = {. 'Cookie': 'cf_clearance=da3be0f3bf2ec90e828c58fb21d5e41d78e80535-1515650775-57600',. 'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36'. }. return super(GodTubeIE, self)._download_xml(url_or_request, video_id, headers=headers).. def _real_extract(self, url):. try:. return super(GodTubeIE, self)._real_extract(url). except:. pass.. video_id = self._match_id(url). headers = {. 'Cookie': 'cf_clearance=da3b

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-FA6RM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	4.9227759481326565
Encrypted:	false
SSDEEP:	48:hNRu9oYz2lYRuqXnLZXKco0fEdX0Lpiu7VYpCX55r:X4oYzwOVLJo0fEl0Lpia24r
MD5:	DDAE23E9701789E0745284FE43BEAC20
SHA1:	EB4EC260EC18FE8D63EDCA04C7A0D3FB19D06E55
SHA-256:	F8C31043C303C5657B6840844A76D0C7C4B600BED1BDA4C3E721E4F6227D34E9
SHA-512:	6AB9E4E7CD1C408B14C153D722DDE996158E7A3A850D40257A5BA25081A349E6AAF3010DCB10D3744767689D4BAA37270AA9BEDC2D476A6EC5A6C98367B5A908
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..utils import (.. int_or_none,..)..from ..utilsEX import url_result..class educbaListIE(InfoExtractor): .. #https://www.educba.com/my-courses/course-lessons.php?xcdi=290.. _VALID_URL = r'https?://(?:.+\.)?educba\.com/my-courses/course-lessons.php\?xcdi=(?P<id>\d+)'.... def _real_extract(self, url):.. webpage = self._download_webpage(url, '') .. title = self._html_search_regex(r'<h2.+?>(.+)</h2>', webpage, 'title').. playlist_id = self._match_id(url).. webpage = self._download_webpage('https://www.educba.com/my-courses/lz_load-np.php?start=0&xcdi={0}'.format(playlist_id), '').. .. ids = re.findall(r'<li id = "li_topic_(\d+)">.+?</i>([^<]+)', webpage) .. entries = [url_result('https://www.educba.com/my-courses/pnn.php?id=li_topic_{0}&xcdi={1}

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-FBDH0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5808
Entropy (8bit):	4.487751065174883
Encrypted:	false
SSDEEP:	96:HtrDR6xyC9T8tUyvcjNWSy+TrptDgiv3BT6l6Nf0iKOb+vt/UstRWL:JDR6xrotUykg+fLgivRTi6NfFQtwL
MD5:	0006C34E3E79B6427FBCB6B6693393A0
SHA1:	2E1BF410BAACBB8D341255DFD2B6A05D3DB7F196
SHA-256:	7E8832CA2F2CF87459EE440D6C40AC004C612C9AC653D7E4D89024CA6CE538C5
SHA-512:	9AE7A19871A30D463EFA5F8BA0A90EADD42382036D492FEF1A3FC1BFB61B69D027D2509B71441660B296A0D5EAEA9C687E4FC0486AB46E5A1E630624D64DD7E2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from ..extractor.bilibili import BiliBiliIE as BiliBiliBase.import hashlib.import re..from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. parse_iso8601,. smuggle_url,. strip_jsonp,. unified_timestamp,. unsmuggle_url,. urlencode_postdata,.)...class BiliBiliIE(BiliBiliBase):. def getRate(self, f):. url = f['url']. rate = self._search_regex(r'rate=(\d+)', url, '', fatal=False, default='0'). return rate.. def _real_extract(self, url):. try:. result = self._real_extract_HightQuality(url). except:. result = False.. if not result:. result = super(BiliBiliIE, self)._real_extract(url).. if 'formats' in result:. result['formats'].sort(key = self.getRate, reverse=True). for f in result['formats']:. f['preference'] = - result['formats'].index(f) -

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-FNGP3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (698)
Category:	dropped
Size (bytes):	3748
Entropy (8bit):	4.705679979444177
Encrypted:	false
SSDEEP:	96:ybUsiIbxGY5FWgpYWgpz1v/pwddBTE6NLgPEzn:OUsiIbf1p4pFBwdjTE6NLgP6n
MD5:	9070DE60F4D09780E81799E38B31086D
SHA1:	B63AB42558C205AD148291F731933F0D86162CCD
SHA-256:	CD82D1335E99C6B06DBD467166792A154638899B3B6F7D596EA98B13AB05D624
SHA-512:	DEAC74D6F0505B6439F7CD847A2A7AF490972BE3282B5E16F3087000882E99258B60841C30227F6494F7CB232BD623C9E8B6607186EA64359EA31CF3E0D74762
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.from ..extractor.discovery import DiscoveryIE as Old..class DiscoveryIE(Old):.. def _real_extract(self, url):. try:. return super(DiscoveryIE, self)._real_extract(url). except:. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id). mobj = re.search(. r'window\.__reactTransmitPacket = (.);</script>',. webpage). if mobj:. json_string = mobj.group(1). mobj = re.search(. r'<title>(.)</title>',. webpage). title = mobj.group(1). json = self._parse_json(. json_string, display_id, transform_source=None, fatal=True). id = json.get('videoPlayer').get('players').get('eos-videos-short-form-layout-video-4').get('video').get('id'). duration = json.g

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-GFLEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1663
Entropy (8bit):	4.065096231527175
Encrypted:	false
SSDEEP:	48:PuJxvCBbpLXGUBSds4xPWRm1k7OUc42b6:k6B1fGem1kI422
MD5:	6EB284E916E1F35B963F7988F474DF54
SHA1:	9348E224753A7B11119857C2B35B3CA378E9F59C
SHA-256:	B0CD9A19B71A88AD5277A9AA0D5A570352220786E2F40EA394FF2BABAB99924A
SHA-512:	5C9E799ADEEC8EBA7FEDB6668FCAA235361B18B0ACC662342B5EDC58501DD7A422BC3C29C26892E358B32349CD46747F1FFB7F02BBE4D091C5A70C844CDA7A84
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..utils import (. update_url_query,. int_or_none.)..from ..utilsEX import url_result..from ..extractor.pluralsight import PluralsightCourseIE as Old...class PluralsightCourseIE(Old):. def _real_extract(self, url):. course_id = self._match_id(url).. # TODO: PSM cookie.. course = self._download_course(course_id, url, course_id).. title = course['title']. course_name = course['name']. course_data = course['modules']. description = course.get('description') or course.get('shortDescription').. entries = []. for num, module in enumerate(course_data, 1):. author = module.get('author'). module_name = module.get('name'). if not author or not module_name:. continue. for clip in module.get('clips', []):. clip_index = int_or_none(clip.get('index')). if clip_index is None:. con

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-H7CKL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	711
Entropy (8bit):	4.921261817870467
Encrypted:	false
SSDEEP:	12:UcjYa4JPn2Jo1AcHSw0FSnom6b7m1vJWKYmIui26JHc6StTYrotwYD:Uc8lk6Act08nom6b7m1/YmbR6JHc6ITX
MD5:	B9FD36D867ABE54155696BBD94650D95
SHA1:	FFCD5C7AC85789083768755C70E9DEC17AF8F040
SHA-256:	3EFF2AC92BAB1A2EA178028EC12B1C161552518E816E3789C79EE45C5133F1C8
SHA-512:	3FBA462B5F74CBD4CF60BD9E0EFC70F4F1FAAC71238AB41A5DBF3D7FC2E9813FAE0ADB5D9250CB6D74A643EB0BF8B5E58473BC72C77E022917AD362C928AFCBB
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8..from __future__ import unicode_literals.import re.from ..utilsEX import downloadWebPage_BYHeadlessBrowser.from ..extractor.openload import PhantomJSwrapper..def __init__(self, extractor, required_version=None, timeout=10000):. self.extractor = extractor...def _save_cookies(self, url):. pass...def _load_cookies(self):. pass...def get(self, url, html=None, video_id=None, note=None, note2='Executing JS on webpage', headers={}, jscode='saveAndExit();'):. html, _ = downloadWebPage_BYHeadlessBrowser(url). return html, _..PhantomJSwrapper.__init__ = __init__.PhantomJSwrapper._load_cookies = _load_cookies.PhantomJSwrapper._save_cookies = _save_cookies.PhantomJSwrapper.get = get

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-I8EE5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5410
Entropy (8bit):	4.720729721198928
Encrypted:	false
SSDEEP:	96:D+kjBLlC8CipEJp4VWNTWV9M1St0imiD0igNizd78CqrTQWBTbeIf:PdEN7gVO128CqrTQyTbeIf
MD5:	8B26418606EA98A3B2C9D6CCE49D0764
SHA1:	61EE6EFB975D4929B0A2648D6ED7E285DE8F7621
SHA-256:	E09384AB151AB2AC279DE3B78518560A7772BE019CAC3B887BB2F03C991A2A96
SHA-512:	5972F423D729D9FDD406097552A23CCBEDACFF16C769FBF38A57118A9DE9D24BEB9B38AE09EDBF5EFB61A0020DAC0CFCCF46C36DDE6BF9DE2C24636824821241
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals.import re.import base64.from ..utils import int_or_none.from ..extractor.arte import ArteTVBaseIE..from ..compat import (. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,. qualities,. try_get,. unified_strdate,.)..def _extract_from_json_url(self, json_url, video_id, lang, title=None):. info = self._download_json(json_url, video_id). player_info = info['videoJsonPlayer'].. vsr = try_get(player_info, lambda x: x['VSR'], dict). if not vsr:. error = None. if try_get(player_info, lambda x: x['custom_msg']['type']) == 'error':. error = try_get(. player_info, lambda x: x['custom_msg']['msg'], compat_str). if not error:. error = 'Video %s is not available' % player_info.get('VID') or video_id. raise ExtractorError(error, expected=True).. upload_date_str = player_info.get('shootingDate'). if not upload_date_str:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-ID9LN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6295
Entropy (8bit):	4.292522761081287
Encrypted:	false
SSDEEP:	192:ipeLZ9WXTJE0ypAxelXJOVkToV7LiTj6Ng:NLZ9MypAxel5OVkToV7LiTj6Ng
MD5:	5F033471B329B0580835579BDE87E8A9
SHA1:	7E711A4D8268AC35A900B9FA8582E067F8597D72
SHA-256:	A774456DA0AC3237F847F85EEE7FBB57D56A2216A05E1E0AADDD45720E7D08FC
SHA-512:	F74CF56AD5417DD165AFA85DB9BDC9B7F459A94A56515A4330529384360F7A1B42C6AA210BDB08DDF57FE7F6421CCEEECC701EAD752B9BDB3CE17780CFC49F9A
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8.from __future__ import unicode_literals.from ..extractor.common import InfoExtractor.import re.import time.import json.from ..compat import (. compat_urllib_parse_urlencode,.).from ..utils import (. determine_ext,. HEADRequest,.).from ..utilsEX import get_top_host..class SuperManIE(InfoExtractor):. # http://xpau.se/watch/prison-break/s5/e1. _VALID_URL = r'superMan://(.*)'.. def importCookie(self, url ,cookie, Jar):. import sys. if sys.version_info >= (3, 0):. from http import cookiejar. else:. import cookielib as cookiejar. def make_cookie(domain, name, value):. return cookiejar.Cookie(. version=0,. name=name,. value=value,. port=None,. port_specified=False,. domain=domain,. domain_specified=True,. domain_initial_dot=False,. path="/",. path_spe

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-IEHSM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.57686082002298
Encrypted:	false
SSDEEP:	6:SwlqDTMABYa4JW8e16BnsP1F+6f1ebKArvebjCCKbiXhqbGkJUCdF/vXlqBw9fuE:zGTjYa4JLsK6f1eWOMCrbini/g29G/M
MD5:	782D416B9CDE948F15CCC6CBDD67EBFB
SHA1:	9329C8C6EA131213713B798CAC0229FB5FD7938F
SHA-256:	D23938423DAAEECE9E69494D954C4B913A82F056D1742D11E802B7826F7CABD7
SHA-512:	C9C5B5CE61CE4D518185411C9AEBAB02522C5A7C133AC7491C7BBD9C14AB91696110250AC7494C83458E862FA2E70C76BCD2D75C3B1EABD4701EE93B1C23EE9F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from ..extractor.go import GoIE as OldIE.from ..utils import (. int_or_none,. determine_ext,. parse_age_limit,. urlencode_postdata,. ExtractorError,.)...class GoIE(OldIE):. def _real_extract(self, url):. self._GEO_BYPASS = False. return super(GoIE, self)._real_extract(url)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-IMR9K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	723
Entropy (8bit):	4.889504085437972
Encrypted:	false
SSDEEP:	12:wwNRjYa4J3M0Mx6QZSvii3Fi6Yyko9XpIjyv2ru9n4iWtRTQs9n4eqoNWt2/9/60:wwNR8lVH+ZSvb1iyko0a2KBjWtRssBzZ
MD5:	CA4E720F47A4DB91EF8169B7B9896E35
SHA1:	2E3408B28DB9CC1B254279683F1C0BC7E2262D57
SHA-256:	BB5CC96E352EADC95762BE83510BDB67D76276D48D557364E0CB74F2049BC191
SHA-512:	A2B938474831FADD949BADF8A379900FD3FC8653B3AC90A208D1C5A5D529B77E346C7750AC4C0896F6883A42425542DD57D8E173DAB28FE8151366E1AA3EA606
Malicious:	false
Reputation:	unknown
Preview:	....#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..utils import (.. int_or_none,..)....class hbrIE(InfoExtractor): .. _VALID_URL = r'https?://(?:.+\.)?hbr\.org/'.... def _real_extract(self, url): .. webpage = self._download_webpage(url, '').. title = self._search_regex('<meta name="twitter:title" content="([^"]+)', webpage, 'title') .. ebm_video = self._search_regex('<meta property="og:video" content="([^"]+)', webpage, 'ebmURL') .. return self.url_result(ebm_video, ie='BrightcoveNew', video_id = 'id', video_title=title) ..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-IQ4AR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2809
Entropy (8bit):	5.114262985295833
Encrypted:	false
SSDEEP:	48:yuNoKiHJyXjAUXMyZeXgxXdJTtSClBH9cijHB3QgL5+jL597gBdRnrdIPmCid6Ng:lY3yZxLJTtSyp9QaRnrdIPmB6N1tE
MD5:	C1ED08EE27CA7D68EDE7991B80F1C12B
SHA1:	E265713AC15AFB2E91382190BA5FA3D715F1716C
SHA-256:	8041A3BFC335736B7CF082FA8347E98FFAF956A26C39F7A1B3F76F4D334E082C
SHA-512:	F4952CFE76F23F9D6EFA1803B1C442D9AD8E27D5162A008A5147E383E87F1401D7B67ECC6B7572161170B556B051E400FC9BBDD3FE51CDED91F81255770A9590
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.# .AES.....# from __future__ import unicode_literals..import json.import os.from ..extractor.common import InfoExtractor.from ..utils import clean_html.from ..utilsEX import aes_decrypt, downloadWebPage_BYHeadlessBrowser..class MoresisekIE(InfoExtractor):. # https://moresisek.net/watch/AXQtab_KbIU6h0293Le5w0OJeFy7bBGkOWakFLZt-cA. _VALID_URL = r'(?:https?://)?(?:www\.)?moresisek\.(?:com\|net)/watch/(?P<id>[^/?#&]+)'.. def _real_extract(self, url):. # .video_url...win....Mac..aes... video_id = self._match_id(url). webpage, _ = downloadWebPage_BYHeadlessBrowser(url). title = self._html_search_regex(r'itemprop="name">([^<]+)</span>', webpage, 'title'). thumbnail = self._html_search_regex(r'<link\s+href="([^"]+)"\s+itemprop="thumbnailUrl"', webpage, 'thumbnail', fatal=False). video_url = self._html_search_regex(r'<video[^>]+\bsrc="([^"]+)', webpage, 'video_url', fatal=False). if video_url:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-IVGTS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	784
Entropy (8bit):	4.4684473774092
Encrypted:	false
SSDEEP:	24:UwNR8lVHJA+uF+ZSvb1iyumhiAiCKqBjCpuFMluJa:hNRu9y+uFoYaUiAicBjQr6a
MD5:	914DED39902A05C4337244115BF36566
SHA1:	58649B826071DC58D0D3B748BEBB711B99FDED6A
SHA-256:	DE4014D095B28E9D325587B6D576574112DAB7E5B3F5C7474C76EAB22E4389B4
SHA-512:	5BE7654CB3687DFA78ACF55CFD94B63DC44C3EC51C2390AC6E3126665689C91B8D9DC3CDCE5E08585537490A5EAFBF69A7452201C423DC07061D32A0060512D0
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..extractor.platzi import PlatziIE as Old..from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..utils import (.. int_or_none,..)....class PlatziIE(Old): .. def _real_extract(self, url):.. try:.. return super(PlatziIE, self)._real_extract(url).. except:.. webpage = self._download_webpage(url, '').. ebm_url = self._search_regex(r'(www\.youtube\.com\/embed\/.+?)\\', webpage, '').. return {.. '_type': 'url_transparent',.. 'url': 'https://' + ebm_url,.. 'ie_key': 'Youtube', .. 'id': 'video_id',.. }

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-J6RVK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2460
Entropy (8bit):	4.715527038227392
Encrypted:	false
SSDEEP:	48:+uP8w3Rj6RURgRN2U5zuKBTw24Bme/BewDtBV7eOBSeloBEe6a5qgLGHlDEl2BQM:Qw3Rj9U5zfBTFrwZY2/O1SHlDEnM
MD5:	92D741E078B1CC6DAB1F2BEE65CC8906
SHA1:	C803C7BEB1775231198E48E2C6A79AB479C451EC
SHA-256:	E628693757D88BFDFB6B787B0D7AE9860303BCC7F4855CF22B9860CBBC1F5928
SHA-512:	FC77D811EABF5B20E544DD960E7CABB1C19D3D41439690E55298F7529C4A8C5B60C1E61D7C271FB934A1CB4341F9AD5ECC651D91B15D3F42319B47FA4B7C0B64
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.import binascii.from ..compat import (. compat_cookies,.)..from ..aes import aes_cbc_decrypt..from ..utils import (. sanitized_Request,. bytes_to_intlist,. intlist_to_bytes.)..from ..extractor.viki import (. VikiIE as OldVikeIE,. VikiChannelIE as OldVikiChannelIE,.)..def hex_to_bytes(hex):. return binascii.a2b_hex(hex.encode('ascii'))..def decryptURL(txt, key, iv):. a = hex_to_bytes(txt). decrypted_data = aes_cbc_decrypt(. bytes_to_intlist(a), . bytes_to_intlist(key), . bytes_to_intlist(iv). ). decrypted_data = intlist_to_bytes(decrypted_data). return decrypted_data.decode('utf-8').split('\n')[0]...class VikiIE(OldVikeIE):. def _sort_formats(self, formats):. if (formats):. super(VikiIE, self)._sort_formats(formats) .. def _real_extract(self, url): . url = url.replace('http://', 'https://') . webpage = self._download_webpage(u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-JGT2F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	4.922479620208504
Encrypted:	false
SSDEEP:	96:pouHNxaA4vti1KdbZIIrpxH+zBT96NWfFlh7ljUu1:u0raA41i1Kdb24j+VT96NqFrlv
MD5:	A9C4DD92BD00F02FAD8B008C7E410679
SHA1:	1AEEA5A607C545AD9941A48C08C0A8064B570E08
SHA-256:	CE913DF4E18A0D56C81B7F600178C88AD1B5100D7877FCB2387ED7D232FD69B5
SHA-512:	F4BA43CF7425BBFFA60E7FD1186988529E36A154CA2069AFB1780ED0AF430C8EE1524A08B4D4B079BDA2365F136B7A7A1B414139D574D981E47A49056E2FEF9F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from ..extractor.common import InfoExtractor.from ..utils import (. qualities,.)...class ImdbIE(InfoExtractor):. IE_NAME = 'imdb'. IE_DESC = 'Internet Movie Database trailers'.. _VALID_URL = r'https?://(?:www\|m)\.imdb\.com/video/(imdb\|user)/vi(?P<id>\d+)'.. _TEST = {. 'url': 'http://www.imdb.com/video/imdb/vi2524815897',. 'info_dict': {. 'id': '2524815897',. 'ext': 'mp4',. 'title': 'Ice Age: Continental Drift Trailer (No. 2) - IMDb',. 'description': 'md5:9061c2219254e5d14e03c25c98e96a81',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage('http://www.imdb.com/video/imdb/vi%s' % video_id, video_id). descr = self._html_search_regex(. r'(?s)<span itemprop="description">(.*?)</span>',. webpage, 'description', fatal=False). player_url = 'http

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-JM63K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1541
Entropy (8bit):	4.765009791268098
Encrypted:	false
SSDEEP:	48:DNulhdVXjlkgBxuogaSQBHIwHVDeV5VWNgtpo:DWdA9ogppOUtpo
MD5:	A3698814A52347CB23A621D4286C83A2
SHA1:	2FC681178A0D4AAB3CC1C0DF7A59F9A3FF12DA89
SHA-256:	5ABE70BC9B19A0547BDB17A715532095248CF8A666F1BDF08BE630B3E625C84E
SHA-512:	15EE8FB126070F05970257037F7A4C6C5268878089711A36359A1127797F86BE4E77933317EEC250D771ACDFD6A81886903E54F24944CD8F15CBC93792008AB4
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals.from ..extractor.common import InfoExtractor..class YespornpleaseIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?yespornplease\.com/view/(?P<id>\d+)'.. def _real_extract(self, url):. # http://yespornplease.com/view/119147578. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). frame_url = self._search_regex(r'<iframe[^>]+src="([^"]+)"', webpage, 'frame_url'). # ....vshare... if frame_url and 'vshare.' in frame_url:. if '//' in frame_url and not frame_url.startswith('http'):. frame_url = 'https:' + frame_url. return self.url_result(frame_url). # ..flash.....flv... elif 'flashvars' in webpage and 'video_url' in webpage:. video_url = self._search_regex(r'video_url=([^&]+)', webpage, 'frame_url'). if '//' in video_url and not video_url.startswith('h

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-JS8DQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	5.233380933836488
Encrypted:	false
SSDEEP:	24:Gaci8lpvbKrRGXYneIXjbKPs4dwvqttkyRGZtVp:D9uA9YYnjXjbKESCeyt3
MD5:	3187EDB5B9E91D84D5D43F9900317689
SHA1:	8ED43CAD8C012F65BC5E16DD5FE94BB0A763AA31
SHA-256:	1C07F8F63C7F359CAED66A94935EDC8921587CCC10E2B0FEC945A4257D6662D9
SHA-512:	77EAD56974EE5F569FE80E01E5A14C811449A988777C9D4E63630019C866DDA4FD81AD3D06C3DA0A64E745951E8036E793CFA459828277E4C30AE3F2B5B88B2C
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals..from ..extractor.common import InfoExtractor..class PowtoonIE(InfoExtractor):. # https://www.powtoon.com/online-presentation/fz4lxkkm3Xk/?mode=movie. # https://www.powtoon.com/c/frsu2KT0bMm/1/m. # https://www.powtoon.com/html5-studio/#/edit/fzfvYtDUaHC. _VALID_URL = r'https?://(?:www\.)?powtoon\.com/.+/(?P<id>\w{11})'.. def _real_extract(self, url):. video_id = self._match_id(url). api_url = r'https://www.powtoon.com/api/v2/powtoons/%s?include_content=true' % video_id. headers = {'Accept': 'application/json'}. video_data = self._download_json(api_url, video_id, headers=headers). video_url = video_data['external_url'].. if video_url:. return self.url_result(video_url).. # https://www.powtoon.com/online-presentation/fI9nmoEkOrZ/wedding-invitation-main/?mode=movie. # .......canvas......... return super(PowtoonIE,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-K6IF7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1683
Entropy (8bit):	4.776637088968838
Encrypted:	false
SSDEEP:	48:Pu+sAONOQl9BJSBzBNk68BlWKCeBf7BReBjuIBF5N0t/8c26Ng:fsrIQ34Nt9KCM3ouIH5et/8V6Ng
MD5:	06987E632E0BD92BDC00B6A92D1AC4BA
SHA1:	1B6499FCFCA9F8FD42DD6C5A9C3845B846DC73E3
SHA-256:	7C2028791470E5469593A6124A54C4059F290B274D941A09D11A4539130BD71A
SHA-512:	174F562A4513BB31B8AD058CBAA22EC4FFD60E81860410215FC9EA071BAC0DFE495B8E17174843DA0707672E9A6BD14A2FED8688B4A4C23BCF2060EFCD4EE283
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..extractor.common import InfoExtractor..class IspotIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?www.ispot.tv'.. _TEST = {. 'url': 'https://www.ispot.tv/ad/ARfj/nike-unlimited-you-featuring-serena-williams-kevin-durant',. }.. def _real_extract(self, url):. webpage = self._download_webpage(url, url). video_id = self._search_regex('var\s+video_id="([^\"]+)', webpage, 'video_id', default='1'). title = self._search_regex('<meta property="og:title" content="([^\"]+)', webpage, 'video title', default='video'). if title == 'video':. title = self._search_regex(r'(?s)<title>(.*?)</title>', webpage, 'video title', default='video'). duration = self._search_regex(r'<meta itemprop="duration" content="([^\"]+)', webpage, 'duration', default=None). thumbnail = self._search_regex(r'<meta itemprop="thumbnailUrl" content="([^\"]+)', webpage, 'thumbail', default=None). vi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-KD70T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1588
Entropy (8bit):	4.9099744139268555
Encrypted:	false
SSDEEP:	48:hNRu9MkuFoYO74DXKKXCLzdPdu8f6Idnf6Id2f6rs:X4HuFoYq4wLzHfrfSfUs
MD5:	45F59EC18E0F29DB7867DE2669BC92A5
SHA1:	3230363DB03DB0C346B568CAAE9C8771FB9FC22B
SHA-256:	ADEA0D27429910EAD9F84CE4BCFC5B6C7348D9D48CEBADEC3603959598374EB2
SHA-512:	50719CA500EBC3FA204DFCF2658F15406CE0BAE7974BBBC98DDD2C66F83275B3C3C14849AA8F26A56617EA1B7401726DA053782D789DCB8B9E81E86E659B5BA3
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..extractor.kaltura import KalturaIE as Old..from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..utils import (.. urlencode_postdata,.. js_to_json..)....class Soap2dayIE(InfoExtractor): .. _VALID_URL = r'https?://(?:.+\.)?soap2day\.com/.+_(?P<id>.+)\.html'.... def _real_extract(self, url):.. video_id = self._match_id(url).. webpage = self._download_webpage(url, '').. title = self._html_search_regex(r'<h4>(.+)?</h4>', webpage, video_id, default='Scaop2day', fatal=False).. response = self._download_json('https://www.soap2day.com/home/index/GetMInfoAjax', video_id=video_id, headers={'referer': url}, data=urlencode_postdata({'pass': video_id}), transform_source=js_to_json).. if response['val'].find('http') == -1:.. response = self._download_json('https://www.soap2day.com/home/index/GetEInfoAjax', vide

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-KEANO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	5.046096047661053
Encrypted:	false
SSDEEP:	48:D9uAGHVBFvl8sBxzwp7RA7Ix7DhRBk0Lv2WlT32Qx6NFtJi:DgFvChRa0L+Wtfx6NFtJi
MD5:	E0145179EFDBD7723F92B0E7DD912236
SHA1:	67E8F5821255AD0E2CD0FA1B1B0C417538F6BA52
SHA-256:	DB6765CF4321159D53D526F2B817630AF066E11DB97F4F4D9236E202476D90DE
SHA-512:	6E532DC72C04C4E487259BE4700A950207FE4D2A2443D25C6B0B1EB3B92C02274FBBD38AA204DB445FC8FE916F2087B750807234D219A40BF5EB849D350C82CD
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals..from ..extractor.common import InfoExtractor.import json.from ..utils import int_or_none..class HudlIE(InfoExtractor):. # http://www.hudl.com/video/3/10371003/5a14f58c42061a246c9410fb. # http://www2.hudl.com/v/27tN4k. # http://www.hudl.com/v/28DQtZ. _VALID_URL = r'https?://(?:www2?\.)?hudl\.com/'.. def _real_extract(self, url):. webpage = self._download_webpage(url, 'video_id'). video_js = self._search_regex(r'(?<="video":)(.+)(?=,"clientIpAddress")', webpage, 'video_data'). video_data = json.loads(video_js). if video_data and 'sources' in video_data and isinstance(video_data['sources'], dict):. # "sources": {. # "mobile": "https://vf.hudl.com/p-highlights/User/10371003/5a14f58c42061a246c9410fb/051ead11_360.mp4?v=308649F50832D508",. # "sd": "https://vf.hudl.com/p-highlights/User/10371003/5a14f58c42061a246c9410fb/051ead11_480.mp4?v=308649F50832D5

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-KJOL2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.699773552432974
Encrypted:	false
SSDEEP:	24:1R8lpv6G4wUHSL/Vrdln4DsSmPReIXjKEUftQrzARSl4luX:PuY9B2V74DcpjXjKJKMbYX
MD5:	5F890E9DD83C7034AD0746CE3284E31D
SHA1:	AAC36ADAEA71C305362D7F20ADD447A7CC2CB17A
SHA-256:	B1D390C7101800E7CA866841E39F293321ECC3469061606D8F19B1D892928B44
SHA-512:	E45C56F867337123B0A8C86CB429A7FC8F1DA31B7DBD0D3A6E19641F07F8F631F5BCB4A73D7B8D7298549F134F10410B2641DC5D4852B39F1AC511B697B80937
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..extractor.common import InfoExtractor...class EbaumsWorldIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ebaumsworld\.com/(?:media\|videos)/[^/]+/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.ebaumsworld.com/video/watch/83367677/',. 'info_dict': {. 'id': '83367677',. 'ext': 'mp4',. 'title': 'A Giant Python Opens The Door',. 'description': 'This is how nightmares start...',. 'uploader': 'jihadpizza',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). config = self._download_xml(. 'http://www.ebaumsworld.com/video/player/%s' % video_id, video_id). video_url = config.find('file').text. if video_url.find('youtube.com') != -1:. return self.url_result(video_url, 'Youtube'). return {. 'id': video_id,. 'title': config.find('title').text,. 'url': vi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-KKMRJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	4.9616079398536925
Encrypted:	false
SSDEEP:	96:DTnboBgepptBSJJgFL5Q4Q/PINRu/YGQAjIOvnhGYAoB:sBgrgUNYvuwGQAjIOvnhGYj
MD5:	5ACB43793FA1FF5416A27ED0076A34F0
SHA1:	1B1BDC4680FA925CDA88091FDC87BD8729867F0D
SHA-256:	A41A520471CEE5786B2FEF172DC6ACA61C8039AC8667801C18C775638E5A7339
SHA-512:	3BCFB66073427A6327106C7C9CD54974B0AAA3A3857179E845F096570448D507F2D6DE1B6DE9FCF8FC64EFFDB534F41A6DC3FC6F9A1A9594750E298A9ED74EF5
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals..from ..extractor.common import InfoExtractor.from ..extractor.streamango import StreamangoIE as OldStreamangoIE.import re.from ..utils import (. urlencode_postdata,. js_to_json.).from ..utilsEX import (. downloadWebPage_BYHeadlessBrowser,. aes_decrypt,.)..class KShow123IE(InfoExtractor):. # http://kshow123.net/show/morning-forum/episode-8028.html. _VALID_URL = r'(?:https?://)?(?:www\.)?kshow123\.net/show/(?P<id>[^/]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). # ............... webpage, _ = downloadWebPage_BYHeadlessBrowser(url). title = self._og_search_title(webpage). thumbnail = self._og_search_thumbnail(webpage). description = self._og_search_description(webpage). video_url = self._search_regex(r'src="(.+?\.mp4)', webpage, 'video_url', fatal=False). if video_url:. return {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-L694K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (428)
Category:	dropped
Size (bytes):	8896
Entropy (8bit):	4.839502530212152
Encrypted:	false
SSDEEP:	96:PTf8TgLRHBV+ODd47qx+l2E2rU49rEDWX1Iv3CBTH6NonUNhRpoacDG02EB:z8TgLRHr273+XVv1Iv3GTH6NJ31eG3E
MD5:	2162896DC9C85DF0EE5283E8B2DB5E16
SHA1:	B923274FA2AA82D43B8EB394CB61EDF51077A0CD
SHA-256:	C9BD684A456988FF7A70FB1EDDA0DB70F3BED62D9BC4CAFF152CFE384DD79E69
SHA-512:	1FBE29DC30A466C72D83679CE1B5A38714535AAAF0E197A7738D901D6998A2D68A972C1AC1268D738840F367F98627CB1275207811B4615F338237BFECACFBBF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import uuid.import re.import json.from ..extractor.common import InfoExtractor.from ..extractor.yahoo import YahooIE as OldYahooIE.from ..compat import (. compat_urlparse,. compat_urllib_parse_urlencode,.).from ..utils import (. int_or_none,. ExtractorError,. clean_html,. unescapeHTML.)..class YahooIE(InfoExtractor):. IE_DESC = 'Yahoo screen and movies'. _VALID_URL = r'(?P<url>(?P<host>https?://(?:[a-zA-Z]{2}\.)?[\da-zA-Z_-]+\.yahoo\.com)/(?:[^/]+/)*(?P<display_id>.+)?-(?P<id>[0-9]+)(?:-[a-z]+)?(?:\.html)?)'.. def _real_extract(self, url):. if OldYahooIE.suitable(url):. old = OldYahooIE(). old.set_downloader(self._downloader). try:. result= old._real_extract(url). return result. except:. pass.. mobj = re.match(self._VALID_URL, url). display_id = mobj.group('display_id'). page_id = mobj.gr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-M4Q14.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6145
Entropy (8bit):	4.768273159889198
Encrypted:	false
SSDEEP:	96:80gdcE8uwP7xYvWaPMtd/1YskRCR/0XsH32synrO3WQ12jo7O:80gd/i7xaPMtwskM/THSrO3WaQuO
MD5:	C1792A9DF53793F73C07176F5FC793D3
SHA1:	C7FE234BF5EAE1CC91942578EEDA5F1F1AD6FAFB
SHA-256:	D40326782A01195E6DDC92602E6E536D7AA1A974704C7F44AFC0051CF8ADCD3E
SHA-512:	811332D0F5B64DDDEEC4014F0D6BA1E697104B7F39B5F6CE1F0114A466A39F202C9245F6E3D2A9C6039A0CA85B3BB839F8595C0E376E8EE97212EC712413C80A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.from ..extractor.common import InfoExtractor.import time.import datetime.from ..utilsEX import (. decode_str,. JSInterpreter.)..import json.import re.from ..utils import (. urlencode_postdata,. sanitized_Request,. int_or_none.)..import sys.if sys.version_info >= (3, 0):. from urllib.request import unquote.else:. from urllib import unquote...class SaveFromIE(InfoExtractor):. IE_NAME = 'savefrom.net'. _VALID_URL = r'https?://[^.]+\.savefrom\.net/\#url=(?P<url>.*)$'.. _TEST = {. 'url': 'http://en.savefrom.net/#url=http://youtube.com/watch?v=UlVRAPW2WJY&utm_source=youtube.com&utm_medium=short_domains&utm_campaign=ssyoutube.com',. 'info_dict': {. 'id': 'UlVRAPW2WJY',. 'ext': 'mp4',. 'title': 'About Team Radical MMA \| MMA Fighting',. 'upload_date': '20120816',. 'uploader': 'Howcast',. 'uploader_id': 'Howcast',. 'descr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-M6Q1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7164
Entropy (8bit):	4.884938011548994
Encrypted:	false
SSDEEP:	192:C0qCTEpqW6NyqN+OWT0Nz6N9fpqCD64IMv9v:ECTsqW6N9sOs096NeCDzIMv9v
MD5:	6CCEC7ADD4A71B334B196B05482678F4
SHA1:	B1BC791F5ADEA2D2C307C13BE7B8B19469822676
SHA-256:	FAACB701C3029F7328E170E02646B67B0C1AD0B33D4DA2E6BD71158032F9A523
SHA-512:	AD0EDBCDDCA3F51B091580607A900B0531287C1492A5D4544E01A073DC68E12F7553CAF381E2318F49ADEB8A16CDE675703E191229800ACB8E569B54758471AE
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..import re.from ..utils import (. js_to_json,. determine_ext,. urlencode_postdata.).from ..extractor.common import InfoExtractor..class VideojugIE(InfoExtractor):. # https://www.vjav.com/videos/6471/natural-production-plants-shit-female-flight-principle/?source=2108980576#. _VALID_URL = r'https?://(?:www\.)?videojug\.com/(?:[^/]+/)(?P<id>[^/?#&]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). # ........ pid = self._search_regex(r'.#pid=([^/?#&]+)', url, 'data_id', fatal=False). if pid:. pattern = r'src="//(.jsonp/pid=%s[^"])' % pid. else:. pattern = r'src="//(.jsonp[^"])'. js_url = self._search_regex(pattern, webpage, 'js_url', fatal=False). if js_url:. js_url = 'http://' + js_url. webpage = self._download_webpage(js_url, vi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-MA652.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1525
Entropy (8bit):	4.535865749216652
Encrypted:	false
SSDEEP:	24:3c8lOVObVmtTWE7Z2F40IXj0C/lGFLCwxdWdeGyB98ACsZ1NtZ23wVPTw:suOQhEWE7Z2FSXjT0lHdWdlAnzj8gZTw
MD5:	AD198D35EEA92F6C2F17E19BECB3B5DA
SHA1:	1B080257150100FEC7BF4215E8C1D7481B0AAC8E
SHA-256:	25AB683B58E5C5AD6E0A034C038E87D18B27F50B173CD0F5F4A307D210403596
SHA-512:	CECFA4D0B18288E721B35D0722DF374AAF5669919B4DA536BFECD59667358697A22AC4F28D36EBE6FCC9A50629A8A4DCE5BFA315435D154C3EDE26C6A8053159
Malicious:	false
Reputation:	unknown
Preview:	#coding: utf-8..from __future__ import unicode_literals.from ..extractor.toggle import ToggleIE as OldIE..class ToggleIE(OldIE):. #.................. _VALID_URL = r'https?://video\.toggle\.sg/(?:en\|zh)/(?:series\|clips\|movies\|tv-show\|video\|channels\|embed)/(?:[^/]+/)*(?P<id>\d+)'.. def _real_extract(self, url):. result = super(ToggleIE, self)._real_extract(url). try:. video_id = self._match_id(url). getSubtitleFilesForMedia = 'http://sub.toggle.sg/toggle_api/v1.0/apiService/getSubtitleFilesForMedia?mediaId=%s' % video_id. subtitlesData= self._download_json(getSubtitleFilesForMedia, getSubtitleFilesForMedia). subtitles = {}.. keysTranslate = {. 'ger': 'de',. 'deu': 'de',. 'eng': 'en',. 'epo': 'es',. 'fre': 'fr',. 'fra': 'fr',. 'ita': 'it',. 'por': 'pt',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-MAEJU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	5.017146051865068
Encrypted:	false
SSDEEP:	24:zi8ljvkN1jhkGDxoeIXjvzr2t67kBLuRlXnEQDUeX/5buQDZblJRLVV:+uQ9hkSxojXj/2xByDXnEDeX/5Cwt/
MD5:	3A3A6F2D82B20C620B3FA875A2AA5D1A
SHA1:	0A9D8A5C8746AEEC7B74A2E0AA37F0F0447EFBB9
SHA-256:	4B5A44290679C25B633925193FB2B0292AA23AB98E2D86F392762F20A7C689F1
SHA-512:	208B5EBA14DDAFBC7C7F6672C989FA895E8084DFDFF8C6929B4617152EA53260D2FDBFBDEC4C587541B310D7F6C497E4E43D1BEAAC7FF15F5A85880752D311BB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.from ..extractor.common import InfoExtractor.from ..utilsEX import (. downloadWebPage_BYHeadlessBrowser,. aes_decrypt,.)..class TubxpornIE(InfoExtractor):. # https://www.tubxporn.com/videos/12491/wild-and-wet-twin-sisters-get-fucked-and-creampie-outdoor/. _VALID_URL = r'https?://(?:www\.)?tubxporn\.com/videos/\d+/(?P<id>[^/]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage, _ = downloadWebPage_BYHeadlessBrowser(url).. # <iframe id="video_iframe" src="https://flashservice.xvideos.com/embedframe/41692293" frameborder="0" width="100%" height="100%" scrolling="no"></iframe>. video_url = self._search_regex(r'<video class.*?src="([^"]+)?', webpage, 'video_url', fatal=False). if video_url:. title = self._html_search_regex(r'<title>(.+?)</title>', webpage, 'video_title', default=None). thumbnail = self._html_search_regex(r'background-image:

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-MHPNA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	791
Entropy (8bit):	5.097896976763861
Encrypted:	false
SSDEEP:	12:zGTjYa4JFviZRtgXpIGMEn6jKnqtIXjlrMtGUT3pQt66Stk9n4huHt3BN9Q9o7aM:zi8ljvKttGcoeIXjlgt72t67kBTtR7H
MD5:	25FC7B61738F76C9114FC1888A3096EB
SHA1:	8EE2E90C814150A90E3B879B61D3445BC836D3E9
SHA-256:	DB63745C62F4259368CA3042DA42A00294D96B2536D96386379A25E559CAFD41
SHA-512:	B8951CFE7840302D803CEC03F921B879CEF7F9FC94BAABF5DD961DF3410723F43702CD9745D98BE2C2D97C6E5E047EFE5CC45C6E63027A2A660E76651FC6AC5C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.from ..extractor.common import InfoExtractor..class RexxxIE(InfoExtractor):. # https://rexxx.org/best-asian-whore-ever-seen. _VALID_URL = r'https?://(?:www\.)?rexxx\.org/(?P<id>[^/]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. # <iframe id="video_iframe" src="https://flashservice.xvideos.com/embedframe/41692293" frameborder="0" width="100%" height="100%" scrolling="no"></iframe>. video_url = self._search_regex(r'<iframe[^>]+?id="video_iframe"[^>]+?src="([^"]+)', webpage, 'video_url', fatal=False). if video_url:. return self.url_result(video_url).. return super(RexxxIE, self)._real_extract(url)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-MR3JC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.530884698012944
Encrypted:	false
SSDEEP:	24:lXm2wKwk3M4PRFaIpNECMKKIXjep8dRJke85BpHqYhM:Q2wKHMORFPpNECL/Xjep8d3k9BVqaM
MD5:	9E6B2E7DC4BFBE58C425FC5987888AA1
SHA1:	AAC75FBDFBED46DBE3EB367D4109C5604274EBAD
SHA-256:	453915EBDD17BA49D4BD664F094AD70E969DA5BE025A19F25401DC31D085955E
SHA-512:	D6B1B974A57000C01FC8211B4DCBCD2D56E779C0AD616B21B3983A43D6BB7573016452A6139EFD46BBB58528A37BF599D4849220082019C1440D3020CF28C978
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --..from ..extractor.cbssports import CBSSportsIE as CBSSportsBase..class CBSSportsIE(CBSSportsBase):. def _extract_video_info(self, filter_query, video_id):. return self._extract_feed_info('dJ5BDC', 'VxxJg8Ymh8sE', filter_query, video_id).. def _real_extract(self, url):. try:. return super(CBSSportsIE, self)._real_extract(url). except Exception as ex:. pass.. video_id = self._get_video_id(url). if not video_id:. video_id = self._match_id(url). return self._extract_video_info('byId=%s' % video_id, video_id).. def _get_video_id(self,url):. response = self._request_webpage(url, 'get cbssports video id'). body = response.read(). videoId = self._search_regex(. r'pcid\%3D([\d]+)\%26',. body, 'get videoId', default=''). return videoId..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-MRA9L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4525
Entropy (8bit):	4.527658503499564
Encrypted:	false
SSDEEP:	96:P9mvPvDXXWPD5Nqfe9NpwxYQsf+PNVad1ut/860UX9mq/KOF+SBSC0BBBTGeX:P9yXjWPD5NHtfTmmqiOF+SBSCGTGeX
MD5:	9A297ED959303D2FC5325E2866049E32
SHA1:	47A17A00F67686DC5F8B7F8FDE7EB026BCF276DD
SHA-256:	E9D314766A1D3A96C6EE47226034AD79F03F1B037E8736FD2B3F0F406B5B6DF2
SHA-512:	96A7319F48AB4C33E80A94C66DDC1771DE288A2CCFC6B593F919C0A28EAB0CFE9DB81C8458FADD3E8079CEE16B36D2BADF033449A824058598E7EA358D3F9EBF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from ..extractor.odnoklassniki import OdnoklassnikiIE as Old..from ..compat import (. compat_etree_fromstring,. compat_parse_qs,. compat_urllib_parse_unquote,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. unified_strdate,. int_or_none,. qualities,. unescapeHTML,.)..class OdnoklassnikiIE(Old):. _VALID_URL = r'https?://(?:(?:www\|m\|mobile)\.)?(?:odnoklassniki\|ok)\.ru/(?:video(?:embed)?\|web-api/video/moviePlayer\|live)/(?P<id>[\d-]+)'.. def _real_extract(self, url):. try:. return self._real_extract2(url). except:. return super(OdnoklassnikiIE, self)._real_extract(url)... def _real_extract2(self, url):. start_time = int_or_none(compat_parse_qs(. compat_urllib_parse_urlparse(url).query).get('fromTime', [None])[0]).. video_id = self._match_id(url).. webpage = self._download_webpage(. 'http://ok.ru/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-MU639.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4209
Entropy (8bit):	4.94896911820335
Encrypted:	false
SSDEEP:	48:DNumX8I9YjBjL0JdBmYRdqVJEEh1V+qOskLxqPSso1V+qnmbl3mR5RIL/mg6Go4N:DCIiWp2tx0oegK4hB9sBBRhkCFht46Nu
MD5:	89FD5D4B4AB48FEE697E342E79E245E4
SHA1:	E78A0E0D3354AD9D17BD897F4FEF1D752901B3D3
SHA-256:	FF9FBF07B30856C2497C706345A2954399E210EBD3A998A8F65C1C4FB481C623
SHA-512:	AB78C57A86D37F73FA1416A9D0B62C8F2E13D7C31D7F8ED668ABC189761F29BF0C4406AD9179237F3B431B855D2A1598F39EC225CFF4E7BEE6E7AC16FC0C13C3
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals.import json.from ..extractor.common import InfoExtractor.from ..utilsEX import sleep...class jibjabIE(InfoExtractor):. _USER_AGENT_IPAD = 'Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Mobile Safari/537.36'. _VALID_URL = r'https?://(?:.+\.)?jibjab\.com/view'.. # https://www.jibjab.com/view/make/revolves_around_you/f63ed47a-ec7f-4a05-9c56-7cf70f167086?utm_campaign=tx_recipient_noti.... # http://www.jibjab.com/view/xf7riuoigVakeOefkWbN. def _real_extract(self, url):. video_id = self._search_regex(r'/([a-z0-9-]{22,})', url, 'token', fatal=False). if not video_id:. # .token. token = self._search_regex(r'view/((?:[^?/]+){20,})', url, 'token', fatal=False) or \. self._search_regex(r'token=(.+)', url, 'token', fatal=False) or \. self._search_regex(r'view/(.+)\?', url, 'token',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-O0DBF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	5.324510563652872
Encrypted:	false
SSDEEP:	48:NNRu9MkuFoY/o2CXKhB8TvpqF+rsBRqO1gBT+6NxkQv:74HuFoY/o2OoFYsBRqO1gBT+6NxkQv
MD5:	446CBEF26CC282F81D84D00802884A99
SHA1:	770F6D5B0C38F8DDC442E99B05CCAE6BA8E1E92A
SHA-256:	04D16AD087BC44D38BB8D2A73BBBFCF7081C61C805268112C49021DC20C4169F
SHA-512:	C16E2C06C120C1FA86C516A2AF594C5609D6EFB3DAE59230EFF8087B7676BCFBD27DA0BB1D946AF9BF530608FC554203464953413698D521B038305EE573B922
Malicious:	false
Reputation:	unknown
Preview:	....#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..extractor.kaltura import KalturaIE as Old..from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..utils import (.. int_or_none,..)....class manoramamaxIE(InfoExtractor): .. #https://www.manoramamax.com/details/_6097031934001.. #https://www.manoramamax.com/page/5d39085623eec6001c799757?clip=_6097290177001&season=5d390892a0e845001caee24e.. _VALID_URL = r'https?://(?:.+\.)?manoramamax\.com/(?:details\|page)/.*_(?P<id>\d+)'.... def _real_extract(self, url):.. video_id = self._match_id(url).. webpage = self._download_webpage(url, '').. .. accountId = self._search_regex(r'"accountId":"(\d+)', webpage, '123123').. json_url = 'https://edge.api.brightcove.com/playback/v1/accounts/5574321162001/videos/' + video_id.. response = self._download_json(json_url,'', 'manoramamax', headers={'Accept': 'application/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-O2FKK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	20541
Entropy (8bit):	4.610345592890156
Encrypted:	false
SSDEEP:	192:Tz5Y0phqzfN269Z9F4BpmIyW30H9irzC4gi7RHY9CEeUnFy9NuC:Tlkzp9Z9F4Bp7yW30doUU0I+C
MD5:	213E2705933834E3C45BCDFF16945907
SHA1:	3424AD6DE6E415F5325AE99F4B51465F7A72291A
SHA-256:	107BC2D0ECA9CB58682118D7897A87080B1D08FCD262B1E38262A3C6B06A7723
SHA-512:	A3D94D59588FA2C763148DB3E0DD366F36308DCCD297FA1F438A9A9C805D459503951543947854CD970C3943C7155D81D91473C2E3FE3EC5AC65471098A47EA6
Malicious:	false
Reputation:	unknown
Preview:	# coding=utf-8.from __future__ import unicode_literals.import os, io.import sys.import json.import traceback..from ..utilsEX import (. debug,. injectYoutubeDL_make_HTTPS_handler.).from .. import YoutubeDL..from .savefrom import SaveFromIE.from .CommonHTML5 import CommonHTML5IE..class YoutubeDLPatch(YoutubeDL):. # py3...ssl....... def _setup_opener(self):. if sys.platform != 'win32':. debug("call injectYoutubeDL_make_HTTPS_handler"). injectYoutubeDL_make_HTTPS_handler(). try:. super(YoutubeDLPatch, self)._setup_opener(). except Exception as ex:. debug("_setup_opener exception:" + ex).. def print_debug_header(self):. #return. from ..utils import write_string. from ..version import __version__. import locale.. from ..compat import compat_str. if not self.params.get('verbose'):. return.. stdout_encoding = getattr(. sys.stdo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-OPB3N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6866
Entropy (8bit):	4.747011336058154
Encrypted:	false
SSDEEP:	192:x2Rb6jYgDWjbkzgb95Y6N04SgYr2P7yTCaOOFcRcTQ2zEogu+92P:x2t65qXkzgb95Y6N0qYrw7yTCnOFcRcV
MD5:	AB008F402BBE9501E8420CEF0512AA4D
SHA1:	1C758928529E00493E0CF829E096FC15DFCF9BB6
SHA-256:	653403A3D6A9C9B2F0C3F124913DF8A6D22C994BC96B0515C1C5090FC9C57887
SHA-512:	D17065E2B819609D5D61048CBB19631F961E788BCCD3D128B353722361BF562C9405537CFA9A4F89747D896BA8F9C439B4F9EBA3C98D736CDFC6143770D1D9EB
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals.import re.import base64.from ..utils import int_or_none.from ..utilsEX import download_webPage_by_PYCURL..from ..extractor.common import InfoExtractor.from ..extractor.generic import GenericIE.class GoMoviesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:gomovies\|gostream)\.\w+/film/[\w-]+-(?P<id>[\d]+)'. _DOMAIN = ''. _TESTS = [. {. 'url': 'https://gomovies.is/film/wonder-woman-20963/',. 'md5': '77108c1e4ab58f48031101a1a2119789',. 'info_dict': {. 'id': 'wonder-woman-20963',. 'ext': 'mp4',. 'title': 'Wonder Woman.',. 'duration': 141,. 'timestamp': 1205712000,. 'uploader': 'none',. 'upload_date': '20080317',. 'thumbnail': r're:^https?://.*\.jpg$',. },. },. ].. _url = ''.. def _download_webpage(self, url_or_request, video_id, no

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-ORPOK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (404)
Category:	dropped
Size (bytes):	7879
Entropy (8bit):	5.408487720360654
Encrypted:	false
SSDEEP:	192:65nhBjr0fTQW6NridHcTZcvodF6N5r4kOnGbSfyEBtCNs:65nbjCQW6N2cTCvodF6N5r4kOnGbSfyW
MD5:	BFD29ABA75007C75E0342BF96A5902E6
SHA1:	F3B61AB850F13D7C775DEEC7D8F78E29D1CF8BD7
SHA-256:	397BB6B76F092998FC70B45F949330641C98F0E78086D3D32FBE7C937C35B21E
SHA-512:	A6B533CD1771DA6BD1380CA3490B0FC19F6C0BEEC8EAD20E7FE8180FE44769B9842A45FB3B470A9DFFC098C84CBA65EB1453E6BAED4B9D72D50D75EFACE6D273
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..extractor.common import InfoExtractor..class GyaoIE(InfoExtractor):. IE_NAME = 'gyao.yahoo.co.jp'. _VALID_URL = r'https?://gyao.yahoo.co.jp'. _TEST = {. 'url': 'http://gyao.yahoo.co.jp/player/00597/v12448/v1000000000000003690/?list_id=1654725',. }.. def extractFromBCPlayer(self, title, video_id, webpage):. player_url = 'https://s.yimg.jp/images/gyao/bc-player/hls/player.gyao.js?0004'. space_id = self._html_search_regex(r'data-spaceid=([^\']+)', webpage, 'space_id'). service_id = self._html_search_regex(r'data-serviceid="([^"]+)', webpage, 'data-serviceid'). video_uni_id = self._html_search_regex(r'data-vid=([^\']+)', webpage, 'data-vid'). webpage = self._download_webpage(player_url, player_url). account = self._html_search_regex(r'videoElement\.setAttribute\("data-account","([^"]+)', webpage, 'account'). index_min_js_url = self._html_search_regex(r'BC_PLAYER_URL="([^"]

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-OSUL8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2878
Entropy (8bit):	4.760818969077181
Encrypted:	false
SSDEEP:	48:DNujWOGDr4m70jXjbaQyeFVNOv7brNsGy2frC6R0KPr5/I1pFROr4pfBixQVwz3a:D9Oy4mQ7aQ10vu2mzKPrGrOrKixQV63a
MD5:	564DA1F85C31544E3E300350DC3EA1F6
SHA1:	A79131AC822DF28BFA223BD1281D836DB41DF327
SHA-256:	2D8D8ADFF3DB29FEA194273AA28331BFB1946B21A2F257FF2C217B1ED931262E
SHA-512:	BCB98FAB168446B79F7887EEBE4BCAEADDAEDB05146AB501D5E8B50B9464F4FDFC9087610226E743130D7DE5ADC2BE36F65B6C3068CF166329D29D1E744FACF5
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..from ..utils import (. determine_ext,. qualities,.).from ..extractor.common import InfoExtractor..class MycanalIE(InfoExtractor):. # https://www.mycanal.fr/divertissement/la-semaine-des-guignols-semaine-du-21-05/p/1449485. _VALID_URL = r'https?://(?:www\.)?mycanal\.fr/(?:[^/]+/)*(?P<id>[\d_]+)$'.. def _real_extract(self, url):. video_id = self._match_id(url). api_url = r'https://secure-service.canal-plus.com/video/rest/getVideosLiees/cplus/%s?format=json' % video_id. video_data = self._download_json(api_url, video_id). if isinstance(video_data, dict):. return self._get_video_info(video_data, url). # https://www.mycanal.fr/cinema/debat-sur-vers-la-lumiere-le-cercle-du-12-01/p/1476850. elif isinstance(video_data, list):. for vi in video_data:. if isinstance(vi, dict) and vi.get('ID', '') == video_id:. return self._get

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-P1JU9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	825
Entropy (8bit):	5.025999690113611
Encrypted:	false
SSDEEP:	12:zNRjYa4J3MNXJSviimqXFGkDEaMH4+2o+u7ZfJMkTpD2bBtwEb5ntK1gzc7Fl0cn:zNR8lVqSvbmWle0u71YBtxxzcZl0ckk
MD5:	016F64FBD4455E7C29CF4327923714A5
SHA1:	33FC830060B87EB94C0864022EFB7F9E80609953
SHA-256:	172550A3D4C5A450455F4C0FC109EC4D05F4E913DC922364DB8555A52296B3D2
SHA-512:	2CDA338FB3DAD801C730B5E10524826AD918CE26A5C6D189B9DD30E70A7C04796831EC526B1539F57AC7222ED872AB200BF957C79A533D3E741F63A38E8E478E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import re..from ..extractor.common import InfoExtractor......class gotowebinarlIE(InfoExtractor):.. IE_NAME = 'gotowebinar.com'.. _VALID_URL = r'.*\.gotowebinar\.com/recording'.. def _real_extract(self, url):.. obj = re.search(r'viewRecording/([^/]+)?/([^/]+)?/.+registrantKey=([^&]+).+type=([^&]+)?', url).. temp = 'https://api.services.gotomeeting.com/registrationservice/api/v1/webinars/{0}/registrants/{1}/recordingAssets?type={2}&client=spa'.format(obj.groups()[0], obj.groups()[2],obj.groups()[3]).. data = self._download_json(temp, '').. return {.. 'id': obj.groups()[3],.. 'title': obj.groups()[3],.. 'formats': [{.. 'url': data['cdnLocation'],.. }],.. }..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-P9RF9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3182
Entropy (8bit):	4.236784953647822
Encrypted:	false
SSDEEP:	96:JYn3zPOb3ROXF7tu8C6NrSKsIbpROXF7tu8C6NM:QzUROXJC6NnxROXJC6NM
MD5:	52C34A53B8025A50BF374DC95E548390
SHA1:	5D5E6228C506A28710243D57DDCA5B759858A274
SHA-256:	9D23BFFEB7D6585F5169A949B577BFAEB26C39FF5F2E6BFD3DAA99C526E63B9E
SHA-512:	42D1FFD68C6CCB90BBCFDE4618DDE12B1B68EC38C0068B9521C8345F8FC47CA4612A05A1C35817887604997B77EE31F905B5DA17F72203F605CBB410D3DADFB5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals....import re..import json..import uuid......from ..extractor.common import InfoExtractor..from ..utils import (.. js_to_json..)......class plutoIE(InfoExtractor):.. #http://pluto.tv/on-demand/series/midsomer-murders/season/2/episode/death's-shadow-2-1.. _VALID_URL = r'https?://(?:www\.)?pluto\.tv/(?:on-demand)/series/(?P<series>.+)/season/(?:.+)/episode/(?P<video_id>.+)'.... def _real_extract(self, url):.. mobj = re.search(self._VALID_URL, url).. if mobj:.. .. data = self._download_json('http://api.pluto.tv/v3/vod/slugs/%s?deviceType=web&sid=%s' % (mobj.group(1), uuid.uuid4()), mobj.group(2)).. for seasion in data['seasons']:.. for episode in seasion['episodes']:.. if episode['slug'] == mobj.group(2):.. format_url = episode['stitched']['urls'][0]['url'] .. duration = episode['duration'].

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-PH7FF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	4.87564249324733
Encrypted:	false
SSDEEP:	48:DNut0vjB2NkdVnGoeVZV+iwjtOFXyBreBuzYFBmmVuyBypjdC:DGed6ofjt4odzZmkiaC
MD5:	7C22A6163326F7F1905B00825B11F711
SHA1:	791D9F3E0F3EAA4B9233B90EFFA0D03A936080A8
SHA-256:	BD1E4C353F60E5F7DD49435346CC859DE6FD8AB9D7682FE79031A7D6F4ABED43
SHA-512:	FE75A918490275CAFDC0CE91DA0B1B0FF972DE2CD2562B629901728A9A995E0E80E63624DD1583F5DEFF9ECA64F037381A3142389ACF4548A6ABB30DC03E88B8
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..from ..extractor.common import InfoExtractor.from ..utils import urlencode_postdata.from ..utilsEX import execjs_execute..class PutStreamIE(InfoExtractor):. IE_NAME = 'putstream'. _VALID_URL = r'https?://(?:www\.)?putstream\.com/'.. def _real_extract(self, url):. video_id = self._search_regex(r'watching=(\w+)', url, 'video_id'). webpage = self._download_webpage(url, video_id).. title = self._og_search_title(webpage). ridx = title.rfind(' - '). if ridx != -1:. title = title[0:ridx]. thumbnail = self._og_search_thumbnail(webpage). description = self._og_search_description(webpage). video_url = self.get_video_url(webpage, url).. return {. 'id': video_id,. 'title': title,. 'url': video_url,. 'thumbnail': thumbnail,. 'description': description,. }.. def get_video_url(self, webpage, url)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-PU44B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	4.855614040379376
Encrypted:	false
SSDEEP:	24:1R8l8vhGvlehDc8jvnUTtkP57xPaeBQbktZt0DJlJRLo6KwDv:PukkleVrnUTGP57xSeBukd6Bto6Nz
MD5:	95D85DCC75876BD2AF89389C8E5A41BF
SHA1:	4D7D6AADDDAB67472074977DA73ADE714A26AC12
SHA-256:	32F39556E37D1D2A9268D2F272B894CFDAA61F9AF649C0642C93A18C1B92B420
SHA-512:	6000C8358E0D4AB8B1A6F78884AF090C832E67D436AE52A541AA9D3A976867A900D2782031A9984BADF07C6B100CFD381E3CD89BB84BDC0E92C2D76E5C639A0F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from ..extractor.common import InfoExtractor.from ..utils import (. js_to_json.)...class thumbzillaIE(InfoExtractor):. #http://www.txxx.com/videos/2631606/stepmom-seduces-teen-babe/. _VALID_URL = r'https?://(?:www\.)?thumbzilla\.com'.. def _real_extract(self, url):. webpage = self._download_webpage(url, url).. title = self._og_search_title(webpage, default=None) or self._html_search_regex(. r'(?s)<title>(.*?)</title>', webpage, 'video title',. default='video').. list = re.findall(r'data-quality="(.+)">(.+)P', webpage).. formats = [{'url': item[0], 'height': item[1], 'ext': 'mp4'} for item in list].. thumbnail = self._search_regex(r'<img class="mainImage playVideo removeWhenPlaying" width="100%" height="100%" src="([^"]+)', webpage, 'thumbail', fatal=False) or \. self._og_search_thumbnail(webpage) or self._html_search_meta('thumbnailUrl'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-Q2QRN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5362
Entropy (8bit):	4.517255801491614
Encrypted:	false
SSDEEP:	96:DHjVUI3EPKqefFn9SNAIxwPXtTQWBT58atI6Nrfc6t7PS4U:XVU+EGIAPftTQyTiV6NLZhP2
MD5:	92E38992C5F6B0D14D71ADE1A23737CF
SHA1:	7EEA2C060816A596576E4256B8E7CE12743408E7
SHA-256:	416177AC8CD70F4F7FE8552691CB1BB893A6C7BC69B54992161136B358D15391
SHA-512:	05C793AB0C26575DDD7E351ED924C2551CC05E6A60EEEF60C4B0A79CFD8552D497650A18AAEC235094088A6FF8389B13130DB21D614D649BE3EE78D654A81B79
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..import re..from ..extractor.common import (. InfoExtractor,.).from ..extractor.lynda import (. LyndaBaseIE,. LyndaIE as OldLyndaIE.)..from ..utils import (. int_or_none,. ExtractorError.)..from ..compat import compat_str..class LyndaIE(OldLyndaIE):. _VALID_URL = r'https?://www\.lynda\.com/(?:[^/]+/[^/]+/\d+(-\d+)*\|player/embed)/(?P<id>\d+)'.. def _real_extract(self, url):. webPage = self._download_webpage(url, url). if OldLyndaIE.suitable(url):. ie = OldLyndaIE(). ie.set_downloader(self._downloader). result = ie._real_extract(url).. try:. self._downloader.params['listsubtitles'] = True. subtitles = self.extract_subtitles(result['id']). except:. subtitles = None.. self._downloader.params['listsubtitles'] = False. result['thumbnail'] = self._og_search_thumbnail(webPage).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-Q4021.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	4.720693737629698
Encrypted:	false
SSDEEP:	48:PucZe6BkUkK+BiRMeBklk1Bu0vnoOcKY/Za9eaVT+BTdtv8cG6NQ9:BZGRKt+5aHA1KvT+BTdtv8V6NQ9
MD5:	47D4F79206868050513C5F21946AC365
SHA1:	97D476ED43F60A84C6BBF0A274F9A5131AEA639F
SHA-256:	A2DB7519A1B8FBC3AA215983E98B3F4F37BE8705BF43AF522B552F2AA13EFC3E
SHA-512:	C71D016A4AA037C97F190F273AFFA584D78789C559EF5AA7B4C228CE1F76E5F9416079B3BE21C5E0ECF6835B1F6A262E5E02FEC2B57136456E8C8C3735E3085E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.from ..compat import (. compat_urllib_request,.).from ..utils import parse_duration..from ..extractor.fourtube import PornTubeIE as OldPornTubeIE.from ..utils import (. str_to_int,.)...class porntubeIE(OldPornTubeIE):. # http://www.porntube.com/videos/hot-maid-emy-reyes-sucks-fucks-awesome-dick_7213015. def _real_extract(self, url):. try:. webpage = self._download_webpage(url, url). duration = self._search_regex(r'<meta\sitemprop="duration"\scontent="([^\"]+)', webpage, 'duration', default=None). if duration:. duration = parse_duration(duration). title = self._search_regex(r'<title>(.)\\|.</title>', webpage, 'title', default='no title'). thumbnail = self._search_regex(r'<meta\sitemprop="thumbnailUrl"\scontent="([^\"]+)', webpage, 'thumbnail', default=None). video_id = self._search_regex(r'</i><button id=".?data-id="([^\"])', webpa

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-QEVA6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	496
Entropy (8bit):	5.064373715418688
Encrypted:	false
SSDEEP:	12:GaccjYa4J5viPy+sIVXpIGqoB+ZMyz4dd9m0ZHYuv:Gacc8lPv4LsvGq47yzIRZv
MD5:	AAB83F538156033CEF7858607C6C7CEF
SHA1:	4BA4431724D1DFB1993C616DADBE23BBF0F2D2E7
SHA-256:	379B9B65DCAF75E1AABE8A96F8EBC20BCD0F61EA6426EE4E135EFCDAD8664698
SHA-512:	05D716AFFA3451ABF9E44FF5EAA4B9DD40720698DF29CB5622C2FED2B812422BC1185B5C0B6AF2A31D65BE6DA70533F612681F82458D15B0A16F29B8505A3854
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals.import re.from ..extractor.common import InfoExtractor.from ..extractor.ximalaya import XimalayaIE as OldXimalayaIE..class XimalayaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.\|m\.)?ximalaya\.com/.*/(?P<uid>[0-9]+)/(?P<id>[0-9]+)'. def _real_extract(self, url):. ie = OldXimalayaIE(). ie.set_downloader(self._downloader). OldXimalayaIE._VALID_URL = self._VALID_URL. return ie._real_extract(url)..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-QL5TF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16468
Entropy (8bit):	4.559820533307283
Encrypted:	false
SSDEEP:	384:jsOvcivhHvMBTQtTtF6NqMb36xOwCvnntDpcKRVLgiLgOLTTYP6NeraHeZAhFLAy:jsOvcivhHvMBTQtTP8pb36xoRVLgiLg8
MD5:	A28538EA77710BA700B8DE49B71840E2
SHA1:	BED2C4D8EA695254B399522C22A5EBD0BF1B0766
SHA-256:	6BF8128624D19802A68BE6BAB5D7B5CDA0129C3C5BAD0372D9C5A26ED31EEC5F
SHA-512:	2CB7519E1D9571A11D3B621B609BC2AE47CB18A8CECB45791D23F94342E63B13613095C9CFDD04D4D78F36FF318915A7A2C56E336B947959EE0FF318BBE4720B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals....import re....from ..extractor.orf import ORFTVthekIE..from ..extractor.common import InfoExtractor....from ..compat import compat_str..from ..utils import (.. determine_ext,.. float_or_none,.. HEADRequest,.. int_or_none,.. orderedSet,.. remove_end,.. strip_jsonp,.. unescapeHTML,.. unified_strdate,.. url_or_none,..)....from ..utilsEX import url_result......class ORFTVthekVideoSingleIE(InfoExtractor):.. _VALID_URL = r'https?://tvthek\.orf\.at/[^/]+?/[^/]+?/\d+/[^/]+?/\d+/[^/]+?/(?P<id>\d+)'.... def _real_extract(self, url):.. need_video_id = self._match_id(url).. webpage = self._download_webpage(url, need_video_id).. .. data_jsb = self._parse_json(.. self._search_regex(.. r'<div[^>]+class=(["\']).?VideoPlaylist.?\1[^>]+data-jsb=(["\'])(?P<json>.+?)\2',.. webpage, 'playlist', group='json'),.. need_video_id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-RI480.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	5.116675574144298
Encrypted:	false
SSDEEP:	48:1uo4fiuxJZ9fshnPnEWBEYennXy28pjXyKdOB7UUBA7RahJt6Nu:afH9fsSTYEb8pdRRmJt6Nu
MD5:	1E63AC42020D7DA55F2A9A8DEB0A4E77
SHA1:	6BFE735FB16EEA449C07D3CF9A5DD5A0DC9C2937
SHA-256:	A654AECAD07478CC1A149357F162EA8D1EF3FCF966C61B08A5C7452B6E1ADA63
SHA-512:	E67E99C306E44D19F7D42A54FF47503D2DA1FF49C5358BD36F7369AB6FC590F5D6D09A282B1BE7340A6018CF417E878FD1C3F3A5B42EFD081108D81553CF2B04
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8..from __future__ import unicode_literals.import re.import json..from ..extractor.common import InfoExtractor.from ..compat import compat_urlparse..class BoxIE(InfoExtractor):. # https://www.bing.com/videos/search?q=youtube+supermarket+flowers&ru=%2fsearch%3fq%3dyoutube%2bsupermarket%2bflowers%26FORM%3dQSRE3&view=detail&mid=616B8E40E9346549CDBB616B8E40E9346549CDBB&&mmscn=vwrc&FORM=VDRVRV. _VALID_URL = r'https?://m.box.com/shared_item/'.. def _real_extract(self, url):. if re.search(r'info', url):. url = re.search(r'(.+)/info', url).group(1). webpage = self._download_webpage(url, url).. self._search_regex(r'(<audio\|<video)', webpage, '').. title = self._search_regex(r'<h1 class="ellipsis">(.+)</h1>', webpage, '', fatal= False) or 'title'.. video_url = self._html_search_regex(r'href="(/file.+)"\s+class="toolbar-btn "', webpage, ''). video_url = compat_urlparse.urljoin(url, video_url). info_url = self._htm

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-RIDMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.529369943366406
Encrypted:	false
SSDEEP:	12:UcjYa4JCTdkax66wHq6uFt16XWGxIvdb6XWGmit:Uc8lUkjH8Fv6mGmdb6mGz
MD5:	DF09B6FF9ECA301300BB083B9263DFBF
SHA1:	8B368C92AFF7CD716F882764FC4BB622401DA2DE
SHA-256:	BEB0D0958D1F86A9C054894AA244F2E94315F38D3337690FB135026C83547077
SHA-512:	CC37085BDA0A79AFA0B61976B957348610C8F27057E753AAA66CA794C0CB2D5EF57A14A31315BC5349C453997B6C6B0703D49EC9867686E1A59F9CB8C607A832
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8..from __future__ import unicode_literals.import re.import json..from ..extractor.kaltura import KalturaIE as Old.from ..compat import compat_urlparse..class KalturaIE(Old):.. def _real_extract(self, url):. result = super(KalturaIE, self)._real_extract(url). self._check_formats(result['formats'], ''). self._sort_formats(result['formats']). return result.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-RQR34.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8717
Entropy (8bit):	4.886173147862639
Encrypted:	false
SSDEEP:	192:ptdLe3oKUJMKwSTVmhHTw6NBn9Zv3FyiKbd:bdKrUJMKwSZmhHTw6NB4xbd
MD5:	83F567F5C97D167AC9B9482A7B7B2D70
SHA1:	C1342CAF9E1942E4C322478831EF9B2A2A66B461
SHA-256:	5AB8C8FD732A2FB61CCD26B8F818EEE9DF84D88363E4B6402EBB614B549A9421
SHA-512:	9E5B4E4A0EB5BCB071072D4C820139E429D777342B2584441BC171C74414B01DA7E87738960112711256F5D17507C449B6FC7CD6E6758BB4E4B3CC8F06FC373D
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals..import re.import json.from ..extractor.common import InfoExtractor.from ..extractor.crunchyroll import CrunchyrollIE as OldCrunchyrollIE.from ..compat import (. compat_urllib_parse,. compat_urllib_request,.).from ..utils import (. ExtractorError,. unified_strdate,. sanitized_Request.)...class CrunchyrollIE(OldCrunchyrollIE):. _VALID_URL = r'https?://(?:(?P<prefix>www\|m)\.)?(?P<url>crunchyroll\.(?:com\|fr)/(?:media(?:-\|/\?id=)\|[^/]/[^/?&]?)(?P<video_id>[0-9]+))(?:[/?&]\|$)'. # _VALID_URL = r'https?://(?:(?P<prefix>www\|m)\.)?(?P<url>crunchyroll\.(?:com\|fr)/(?:[^/]/[^/?&]?\|media/\?id=)(?P<video_id>[0-9]+))(?:[/?&]\|$)'. _NETRC_MACHINE = 'crunchyroll'.. def _convert_subtitles_to_srt(self, sub_root):. output = super(CrunchyrollIE, self)._convert_subtitles_to_srt(sub_root). return re.sub(r'\{\\i.?}', '', output).... def extract_subtitles(self, args, **kwargs):. keysTranslate = {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-S12PG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2059
Entropy (8bit):	5.376786569289905
Encrypted:	false
SSDEEP:	48:+uhrMXf4zMMdojXjlkVatSL+mGBBhV0BT49BtU:NrCfKMyoq8tb3hVLpU
MD5:	FC61E50211336FFC21299A7200E1AD2A
SHA1:	BF60BF1750C0ECD4EF930A7BA9D890DE9E48D3B9
SHA-256:	1487F4199FBBE5B8739F3BADD1FE59723456F5581552881D3772CC6DA8336948
SHA-512:	34EE5BBDA651838B1E45981F4439D140C35868B5693EC2D231232F32C186B424D9EF58B25FB087190BE0C7ECEC153539CE8D87C5C07CE8EF01B0E8950E360CA5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals.from ..extractor.common import InfoExtractor..# https://filmovi.ws.# https://andrija-i-andjelka.com.# https://filmovitica.com.# https://serijefilmovi.com.# https://serijehaha.com.# https://praveserije.com.# https://www.filmovi.me.# ........openload...class FilmoviIE(InfoExtractor):. # https://filmovi.ws/juzni-vetar-2018-domaci-film-gledaj-online/. # https://www.filmovi.me/the-horse-whisperer-1998. _VALID_URL = r'https?://(?:www\.)?(?:filmovi\|andrija-i-andjelka\|filmovitica\|serijefilmovi\|serijehaha\|praveserije)\.\w+/(?P<id>[^/]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. # ....openload... # <div style="margin: auto; text-align: center;">. # <p>PLAYER</p>. # <p><iframe src="https://serije.pw/openload/player.php?id=908fdc9d-d674-4d93-8e5b-cff4fd1029c4" scrolling="no" frameborde

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-S2903.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1557
Entropy (8bit):	4.431325718894404
Encrypted:	false
SSDEEP:	48:+uSp6it/hFkXRWb6SmRuDpwdWEQrkN8isRTQyem:OUileS+UidWf4qisRTQyem
MD5:	4151E2275837225B3A3F19EB16E4A866
SHA1:	519BC882EAA29710961B6F11EA9D558A0B56C3DA
SHA-256:	1EBC2E331DFE2F57DD37867F7BB04E593A9787F8B6A28824851C6A9D4BA4C9A2
SHA-512:	B97BF6CE00BF86F26F60E04D715400B4537ED42EFE2869C45A28F6A93C6C2448E8A5ABC8CD2EE58D2FB02E652B812938870F74D8A2E4AC2F9C4FB054CC72D310
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from ..extractor.common import InfoExtractor.from ..extractor.cloudy import CloudyIE as Old.from ..utils import (. str_to_int,. unified_strdate,.)...class CloudyIE(Old):.. def _real_extract(self, url):. try:. return super(CloudyIE, self)._real_extract(url). except:. video_id = self._match_id(url).. webpage = self._download_webpage(. 'http://www.cloudy.ec/embed.php?id=%s&playerPage=1&autoplay=1' % video_id, video_id).. info = self._parse_html5_media_entries(url, webpage, video_id)[0].. webpage = self._download_webpage(. 'https://www.cloudy.ec/v/%s' % video_id, video_id, fatal=False).. if webpage:. info.update({. 'title': self._search_regex(. r'<h\d[^>]*>([^<]+)<', webpage, 'title'),. 'upload_date': unified_strdate(self._search_regex(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-S5S07.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	4.369258851098515
Encrypted:	false
SSDEEP:	24:1I4w6o4FFaIXjlgt5IoBjayt3RYHZF+QEZwSDSbBswm:HwHMFPXjlkZBjzt33K9bBswm
MD5:	B27F4A9A7C03F29BE1418F7A599B7F50
SHA1:	D0571C1C341870BF384F47BC773266A3864748AE
SHA-256:	91FF13D8EC8A8EED7C6E359C1FFFD694E48470D6EC9F8CEC683C2AA6B3A983BF
SHA-512:	7376B4DFB524BF787B697E6B573AF28E0E9AC7689AE077D3B02C391761B7A2A08BC623C83969DD3873D1A90D71BEC0C713346FEED31DF94371BB5A0F99F008E1
Malicious:	false
Reputation:	unknown
Preview:	from ..extractor.howcast import HowcastIE as HowcastIEBase.from ..utils import parse_iso8601..class HowcastIE(HowcastIEBase):.. def _real_extract(self, url):. try:. return super(HowcastIE, self)._real_extract(url). except Exception as ex:. pass.. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. try:. embed_code = self._search_regex(. r'<iframe[^>]+src="[^"]+\bembed_code=([^\b]+)\b',. webpage, 'ooyala embed code').. return {. '_type': 'url_transparent',. 'ie_key': 'Ooyala',. 'url': 'ooyala:%s' % embed_code,. 'id': video_id,. 'timestamp': parse_iso8601(self._html_search_meta(. 'article:published_time', webpage, 'timestamp')),. }. except Exception as ex:. _url = self._search_regex(. r'<(?:phoenix-)?iframe[^>]+s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-SF6GU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	821
Entropy (8bit):	5.033972425137183
Encrypted:	false
SSDEEP:	24:zc8lmbz8HeIXjlgtbBnEEcXRuTJCkBM6Rn:wuzjXjlkbBnE1BaBM6V
MD5:	63369F99D91DB96B117B684F85D843D6
SHA1:	A8C86C71C9A823BE1DE27E159E4A5C5C4EDEA58A
SHA-256:	F2F0E63163043B30311FF152A5E5B88431DE3FAB1EFBCF74A1ADF89D8E05BB35
SHA-512:	19F1AF23661256668CDC2056BD52D9B069247D1B935CF3CCED6397B1024EBF668F6869ACE40557CB54F1FEF784F6CFE848F764B795B421BAEFF5C786EEC5D41E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals.from ..extractor.tnaflix import TNAFlixNetworkEmbedIE..class TNAFlixPLayerIE(TNAFlixNetworkEmbedIE):. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). title = self._search_regex(r'<title>(.+?)</title>', webpage, 'video title').. # <a href="https://www.tnaflix.com/oral-sex/Sexy-cuties-Allie-Haze-and-Jada-Stevens-fucking-in-threesome/video1781991" target="_blank">Sexy cuties Allie Haze and Jada Stevens fucking in threesome</a>. video_url = self._search_regex(r'(?is)<a href="([^"]+).+' + title, webpage, 'video_url', fatal=False). if video_url:. return self.url_result(video_url).. return super(TNAFlixPLayerIE, self)._real_extract(url)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-SK55S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	4.86129907482554
Encrypted:	false
SSDEEP:	24:Ui8ljvt2wM6sBMWZAB4wExOvqdeZBgOGcIZABdwQExOvEZBgOGcgkBAwbMK7v1:luJVdUMzB3EWqdQFBKQEWG7B/bLb1
MD5:	6ADC2ED447801899EF22E59F5157F09D
SHA1:	36F2DD0ECD49E98A8A3F6DB6E97C4186C03E4167
SHA-256:	65228E7FEC293926E25813F0F576620338A7EA5687F4F95CCAE2F27A026AC0DF
SHA-512:	7D55A11D602BB7FF8B7CBB36EAF507CFB240A9CF860E74827923A2F7C2FBE7012783BFAAEEAC0152D5ED5C2750B9A3FF48A0DD26CB7D2DC44823B3F647D895C2
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8.from __future__ import unicode_literals.from ..extractor.common import InfoExtractor.try:. from urllib.parse import urlparse.except ImportError:. from urlparse import urlparse..class XpauIE(InfoExtractor):. # http://xpau.se/watch/prison-break/s5/e1. _VALID_URL = r'(?:https?://)?(?:www\.)?xpau\.se/'.. def _real_extract(self, url):. # ....iframe. webpage = self._download_webpage(url, 'video_id'). frmae_url = self._search_regex(r'<iframe id="\w+" src="(.[^\"]+)"', webpage, 'url1'). if not frmae_url:. return super(XpauIE, self)._real_extract(url).. parts = urlparse(url). frmae_url = '%s://%s%s' % (parts.scheme, parts.netloc, frmae_url). webpage = self._download_webpage(frmae_url, 'video_id'). frmae_url = self._search_regex(r'<iframe\s?(?:id="\w+")? src="(.[^\"]+)"', webpage, 'url2'). if not frmae_url:. return super(XpauIE, self)._real_extract(url).. frmae_url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-SNGE1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	4.651492365405021
Encrypted:	false
SSDEEP:	6:SJaclbRMABYa4JWySL6lFMoQG+Jow8msCfdUxbJU2qv:GacNRjYa4J3SSF8G+KUKxb+2U
MD5:	1F674AD673C375616217C9FE0254C5F2
SHA1:	95CDC2729D3965F7E6B34CA3F956429138D3CD31
SHA-256:	6DA719837B22DDDE77B143848A87D89FAE646673E9AA0582DDAD053E14C2CC86
SHA-512:	40BCE884A74DE4B00EC2EFE7173F12A1419878D4E7C89AAEB0434C56382F398BB17ACB40C28BED22FADA2EB402D39B38A66DDE4E45583FE0934199E52D612F44
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals....from ..extractor.svt import SVTPlayIE as base....class SVTPlayIE(base): .. def _real_extract(self, url):.. result = super(SVTPlayIE, self)._real_extract(url).. return result..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-SQGF4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	4.761829823015527
Encrypted:	false
SSDEEP:	48:PuwV+jCDBrT0LJa6XhkV38BUglVIv+rgBAX5+KEi:pV+jGB/sJaNHvCZp+KEi
MD5:	6DED9196FAC45D747BB37BC7AF004EAE
SHA1:	B66F995C0C7BD4C7FF74079813401B6B00AC5D4A
SHA-256:	AD4245159E8627620C68DA33E2F7C4A11E36824EB5C15507C15A8951FF727C6C
SHA-512:	1510DC75A241226F2F7B11CD9841D6C05CE9B805CCE2F4D4460E4EFC7C718A084A23F5D32ABE346D182AD1E88C021AC583A17B5846738ECB1B0DAB04D7A31ACA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..compat import (. compat_urllib_parse_unquote,. compat_urllib_request.).from ..utils import HEADRequest.from ..extractor.common import InfoExtractor...class EHowIE(InfoExtractor):. IE_NAME = 'eHow'. _VALID_URL = r'https?://(?:www\.)?ehow\.com/[^/_?]*_(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.ehow.com/video_12245069_hardwood-flooring-basics.html',. 'md5': '9809b4e3f115ae2088440bcb4efbf371',. 'info_dict': {. 'id': '12245069',. 'ext': 'flv',. 'title': 'Hardwood Flooring Basics',. 'description': 'Hardwood flooring may be time consuming, but its ultimately a pretty straightforward concept. Learn about hardwood flooring basics with help from a hardware flooring business owner in this free video...',. 'uploader': 'Erick Nathan',. }. }.. def _real_extract(self, url):. url = url.replace('http://', 'https://'). video_id = self._

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-SUA6F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	665
Entropy (8bit):	4.147099159730003
Encrypted:	false
SSDEEP:	12:1RjYa4JgfMEwQhOit5qjQQksKQZJSZ9HQhEithjT3S3:1R8lZEwQhRt5YksxQDQhfthfC3
MD5:	9C13D10F129015AEB585D68686140BE3
SHA1:	A3AAC11A9BD2A5DED92D71F529CE63089CEE8595
SHA-256:	1BAD26B48F04B2CA39C0D81C4AC3B8529070AACF36DE8042D6913F46F36524E9
SHA-512:	E6DE96E36AB3A39174F5F65DE86D3AC79250D9D7DFFFB393A0829CF1AF358F23A77310629C194D431AB27DB02C0BBF0D6008C83E05D7A8C59F424AB17A1131A0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..extractor.mixcloud import (. MixcloudIE as MixcloudBase.)..class MixcloudIE(MixcloudBase):. def _extract_m3u8_formats(self, m3u8_url, video_id, ext=None,. entry_protocol='m3u8', preference=None,. m3u8_id=None, note=None, errnote=None,. fatal=True, live=False):.. if '.m4a' in m3u8_url:. ext = 'm4a'. return super(MixcloudIE, self)._extract_m3u8_formats(m3u8_url, video_id, ext, entry_protocol=entry_protocol,. m3u8_id=m3u8_id, fatal=fatal)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-SVNO9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2209
Entropy (8bit):	5.040328005260565
Encrypted:	false
SSDEEP:	48:1ufOa4fiuvml3Z4BReVBOTlqBUe758PIeBrueShOG6N+twVTFi+pgde2FGpGYdK:EOTfVu6tTl7Q8gRzhX6N+tSIedEL
MD5:	209958D61DA111198AE41F334BB31085
SHA1:	44C2AF3B21B47BBDAFE2CA637C9BF87D8610AA31
SHA-256:	7BE5FAFD6D6B63434FA58B63687CDEB78E4EF9AB9E819585330BD27D154BF467
SHA-512:	94FA6CE6BFF757288E377A505059229AAA1F5887971783B5ABB2F6CE2F67F2B759939127516C3789E0010ED8730EE6CE77068ECAE15EE901C33510010823F95B
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8..from __future__ import unicode_literals.import os.import json..from ..extractor.common import InfoExtractor.from ..extractor.googledrive import GoogleDriveIE as Old.from ..compat import compat_urlparse..# class GoogleDriverIE(InfoExtractor):.# # https://www.bing.com/videos/search?q=youtube+supermarket+flowers&ru=%2fsearch%3fq%3dyoutube%2bsupermarket%2bflowers%26FORM%3dQSRE3&view=detail&mid=616B8E40E9346549CDBB616B8E40E9346549CDBB&&mmscn=vwrc&FORM=VDRVRV.# _VALID_URL = r'https?://drive.google.com/(?:file/\|open\?)'.#.# def _real_extract(self, url):.# self._downloader.cookiejar.clear().# webpage = self._download_webpage(url, url).#.# self._search_regex(r'(<meta property="og:video"\|audio_favicon\.ico)', webpage, '').#.# title = self._search_regex(r'<meta itemprop="name"\s+content="([^"]+)', webpage, '', fatal=False).# # info = self._search_regex(r'_initProjector\([\s\S]+,\[null,"(.+)\[\[\["status","ok"\]', webpage, '').#

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-TA2L8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	4.669059788274495
Encrypted:	false
SSDEEP:	24:1R8l8v2DjGXl2hDc8jvnUTQkBflcJzeBQa0DhahTNlJRLo6KwDv:Purgl2VrnUT3BflcZeBj6hahTlto6Nz
MD5:	753E9070E779D8710039C225FE47ACBB
SHA1:	E1E27B388F1C3EC1E9EE462BAD1634B9682FD4CE
SHA-256:	2C3484A44588DDC18D8A0A9D00FF17ACAFE24A7055FD0130C321A06FE7959F04
SHA-512:	E859DFCC28C05DB81253EB673D086F05D06E6E50E2CCEB273DFF33EF3DECFFDC78838CE3928E9C128A2ACB53A14900C48D5421B05670E491B13D1609A2D62688
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from ..extractor.common import InfoExtractor.from ..utils import (. js_to_json.)...class hqcollectTVIE(InfoExtractor):. #http://www.txxx.com/videos/2631606/stepmom-seduces-teen-babe/. _VALID_URL = r'https?://(?:www\.)?hqcollect\.tv'.. def _real_extract(self, url):. webpage = self._download_webpage(url, url). title = self._og_search_title(webpage, default=None) or self._html_search_regex(. r'(?s)<title>(.*?)</title>', webpage, 'video title',. default='video'). video_url = self._search_regex('<source src="(.+)" type="video/mp4"', webpage, 'src'). thumbnail = self._search_regex(r'<video class="u-full-width" controls poster="([^"])', webpage, 'thumbail', fatal=False) or \. self._og_search_thumbnail(webpage) or self._html_search_meta('thumbnailUrl', webpage). formats = [{. 'url': video_url,. 'ext'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-TPBAO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2940
Entropy (8bit):	3.8804843883538966
Encrypted:	false
SSDEEP:	48:hNRu9oYe9KeVqu5XSgMKepGBO7eI1H2eGs80Blce6BlemExo:X4oYe9KeVqsU7P1H2js82crb
MD5:	20DC53B2FFE34730B37A7EF8AA2D890A
SHA1:	3D2F7C62BE286B63888C7C374AABDBD77AA59160
SHA-256:	4DAE9CE1B76C5157861C8F341656B3B939A1E6CA6111FCF61120D58A1AED09DE
SHA-512:	4FD913379CAEDCAA18EC02D4732B9E163ABA106D117E0CCFA3222C6FA2BD885314C4FC88827FEDB73F3889D124232E9AFF0AAF47DBD22CC9325331CB9CF9F9F5
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from .odnoklassniki import OdnoklassnikiIE..from ..utils import (.. int_or_none,..)..class orztoonsIE(InfoExtractor): .. #https://www.orztoons.com/clip/3861447/ .. _VALID_URL = r'https?://(?:.+\.)?orztoons\.com/clip/(?P<id>\d+)'.... def _real_extract(self, url):.. webpage = self._download_webpage(url, '').. video_id = self._match_id(url).. for i in range(4):.. try:.. webpage = self._download_webpage('https://www.orztoons.com/clip/play.php?id={0}&n={1}'.format(video_id,i), '').. title = self._html_search_meta('og:title', webpage).. thumbail = self._html_search_meta('og:image', webpage) .. webpage = webpage.replace('<source src="https://www.orztoons.com/clip/loadingx.mp4" type="video/mp4" />', '')..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-TPFDK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1052
Entropy (8bit):	5.104070827730519
Encrypted:	false
SSDEEP:	24:Uc8l/QvEHYfiuUFgLGi2c4TaBAXcqzQhh8Q8b1QhF0QJ:1ub4fiujoceaBAXcqEhKZbShFNJ
MD5:	B25932016995B587E78A3F3529BCA305
SHA1:	74A3A4441CF189D68D406FB95B6D3C0F7B4C9083
SHA-256:	1C44852587612BE60698E95D67B40CA7EE9450502CA022F25DD29235D0EBF7B6
SHA-512:	AA3202F1FE34459DC527A8AE74B5DA96746EE24A95719CC288C742A03F41FED96BCCE2AE5124F4572CA67777A7D2600C8FCFAA6CA9A2F9512E97BA0DB081A0F4
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8..from __future__ import unicode_literals..import json.from ..extractor.common import InfoExtractor..class BingIE(InfoExtractor):. # https://www.bing.com/videos/search?q=youtube+supermarket+flowers&ru=%2fsearch%3fq%3dyoutube%2bsupermarket%2bflowers%26FORM%3dQSRE3&view=detail&mid=616B8E40E9346549CDBB616B8E40E9346549CDBB&&mmscn=vwrc&FORM=VDRVRV. _VALID_URL = r'https?://(?:www\.)?bing\.com/videos/search\?q=(?P<real_url>[^/?#]+)'.. def _real_extract(self, url):. try:. webpage = self._download_webpage(url, url). pattern = r'VDMetadata=([^;]*)'. js_str = self._search_regex(pattern, webpage, 'js_str'). if not js_str:. return super(BingIE, self)._real_extract(url).. media_info = json.loads(js_str). if media_info and 'mediaUrl' in media_info:. return self.url_result(media_info['mediaUrl']).. return super(BingIE, self)._real_extract(url). except:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-UF16E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1256
Entropy (8bit):	4.926456416751899
Encrypted:	false
SSDEEP:	24:Gacc8lpvO4YlG8gIDoeIXjZBgtgBxCddoDmhDcvCbehDeqplptHl5RL46KwVdtUs:DNu/YlRgcojXjXkgBx0dGmVgCbeVeqpB
MD5:	68B8443D9F2461749A105505530E9B40
SHA1:	C86B460B89FA5721675DDC350A43BD348F4FC5EA
SHA-256:	FAFFDB2E3FB942831F23AB2CA7C61B530308519501D14288C3FA5A8444675EEF
SHA-512:	B0F164A35F0B7C43FAC571D0DE0B274FC42D72C0316347488234849BB25C565786D98C92A21CE2F2F6CBB7D4AB00CC4FEC950B4C9014B7C952C5F2A14C1DB2C1
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..from ..extractor.common import (. InfoExtractor.).from ..utils import (. js_to_json,.)..class KizzboyIE(InfoExtractor):. # http://www.kizzboy.com/2018/02/02/tricked-str8-18-year-old-from-poland-on-cam/. _VALID_URL = r'https?://(?:www\.)?kizzboy\.com/(?:[\d{2,4}/]+)(?P<id>[^/]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). # ..frmae url. webpage = self._download_webpage(url, video_id). frame_url = self._search_regex(r'<iframe[^>]+src="([^"]+")', webpage, 'frame_url'). if not frame_url:. return super(KizzboyIE, self)._real_extract(url).. title = self._og_search_title(webpage). title = title[0:title.index(' - GayBoysTube')]. thumbnail = self._og_search_thumbnail(webpage). formats = self._get_formats(frame_url, video_id).. return {. 'id': video_id,. 'title': title,. 'thumbnail':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-UIS6G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	4.860211236302024
Encrypted:	false
SSDEEP:	48:hNRu9oYzDMVCXKKXrQ9/E3BqUCROi96N5prZXKKXrQKigHyEKvoe:X4oYzYV+iUCROi96N51XpnKvoe
MD5:	344116C4E11FF09B05AA928DC5328F25
SHA1:	EFA2982E35909474F41773219D5CAF3BF9D398FB
SHA-256:	281BF1C2F31E2FFDDD3338CD67EE8502E2BECF93034DF27C608AF75B6F7F2F15
SHA-512:	A9883873BCACFCC3606CAF4056BDFA9EF587A11CC9DDBE15155CE80D85495AA55EDFF7F3A273899058FC2ED6F2B1CBDB830400B4A80AD7F03A05A14D1130C5A8
Malicious:	false
Reputation:	unknown
Preview:	#encoding: utf-8....from __future__ import unicode_literals..import re..import json....from ..compat import compat_urlparse..from ..extractor.common import InfoExtractor..from ..utils import (.. int_or_none,..)..from ..utilsEX import (.. url_result..)....class rijutvIE(InfoExtractor): .. _VALID_URL = r'https?://(?:.+\.)?rijutv\.com/player/(?P<id>\d+)'.... def _real_extract(self, url):.. video_id = self._match_id(url).. webpage = self._download_webpage(url, '').. title = self._html_search_regex(r'<title>(.+)</title>', webpage, '').. iframe_src = 'https:' + self._search_regex(r'<iframe\s+id="playPath".+src=\"([^\"]+)', webpage, '123123', fatal=False).. webpage = self._download_webpage(iframe_src, '').. m3u8_url = self._search_regex(r'url:\'(.+/index.m3u8)\'', webpage, '123123', fatal=False).. formats = [].. formats.extend(self._extract_m3u8_formats(.. m3u8_url, video_id, 'mp4', m3u8_id='m3u8', fatal=False))

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-UQ35V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1977
Entropy (8bit):	4.5385553079845184
Encrypted:	false
SSDEEP:	48:PuRwLWRPWleVrnUTnB4R5EcLNxEmLWDEpqeVhaHyQt46Nv8CCch+x:CzksUaclaCyQt46Nv8xx
MD5:	C09B71A209347272A12A0A1225DA0521
SHA1:	266A5E01A3960124A7CEA55ACAF90DA1F5E91365
SHA-256:	B1F83B2BB9D1FBE6A3446B3C3318D0FDCA78E500C6C131477862CD9ECB6729CE
SHA-512:	3B9AA6CCD9EF99AE14263D50252756F9D3C5CFEFC3BE417FDE229A5F89C4CEB826CD7E2005A8269D3ACB1B5C4459FCBA20320DA7871AC6C454047437FC48CD5A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from ..extractor.yourporn import YourPornIE.from ..utils import (. determine_ext.)..class YourpornSexIE(YourPornIE):. # https://yourporn.sexy/post/58789701d7925.html.. def _real_extract(self, url):. webpage = self._download_webpage(url, url).. title = self._og_search_title(webpage, default=None) or self._html_search_regex(. r'(?s)<title>(.?)</title>', webpage, 'video title',. default='video').. video_url = self._search_regex('video\sid=\'player_el\'\s*src=\'//([^\']+)', webpage, 'src', fatal=False). if not video_url:. if webpage.find('<div id=\'videos_container\'>') > -1:. ids = re.findall(r'<div class="pl_vid_el transition" data-source="blog" data-hash="([^"]+)', webpage). if ids:. entries = [self.url_result('https://yourporn.sexy/post/%s.html' % id, ie=yourpornSexIE.ie_key()) for. id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-V20V5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2415
Entropy (8bit):	4.924371207231644
Encrypted:	false
SSDEEP:	48:DNu7/QD6WH4kbVrHUTBeVHaUbw7kT6Oow51UfjrVT4B3XttZij:DW/QD6ezdUdKcReoNKttZij
MD5:	482D345500211250BF2628BE58C97DA4
SHA1:	B72A525915EFC2F807EA4D6B787106BFDBEA9D79
SHA-256:	27FB2D9ED5ADC30E4D491419D7EEB5843F9152696382D946835B137428C1A3B7
SHA-512:	AEAB502281A0916621A7E19560ED8A0233FAF1749C341BDCFC052094B5A874D8F42540314862416DFB6368F46CB3D1EC08810EC50D78ED10CB290435EA6B61F3
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..import re..from ..extractor.fourtube import FourTubeBaseIE as OldFourTubeBaseIE..class FourTubeBaseIE(OldFourTubeBaseIE):. _VALID_URL = r'https?://(?:(?P<kind>www\|m)\.)?(?:pornerbros\|fux\|4tube)\.com/(?:videos/(?P<display_id>[^/]+)_\|embed/)'.. def _real_extract(self, url):. try:. video_id = ''. webpage = self._download_webpage(url, video_id). title = self._og_search_title(webpage, default=None) or self._html_search_regex(. r'(?s)<title>(.*?)</title>', webpage, 'video title',. default='video'). thumbnail = self._og_search_thumbnail(webpage) or self._html_search_meta('thumbnailUrl', webpage).. import tempfile. import os, io, sys. from ..utilsEX import downloadWebPage_BYHeadlessBrowser.. # ....js... (fd, filename) = tempfile.mkstemp(prefix='kv', suffix='.js'). os.close

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-V8H9A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4827
Entropy (8bit):	5.061564384329279
Encrypted:	false
SSDEEP:	96:DnE5hgsoF5rBbs7yzH4ecvmeh2ADwpGSt46NchfPujjh1xl7B2aBTsA/4UQ9BVmd:EhPojrBbuJ/DD6Nc0fh1xJB2uTsu41Aj
MD5:	38603C93810E26A2BB1F35F8FBEDBE16
SHA1:	54B40C83A713A7E9F415EA1B32484879C413DCFC
SHA-256:	AC3893B0194363F3456A7679C40B2E4BE89EE5ECF91CEC8AAD9D5CE6B2EC6D37
SHA-512:	5F45E43C81D52289B38FD62ED169E5255B45D7EC6B74038B3573858DFC1CF0FEA9A7583BCCEE5386942FC3913E748B5595D918D576462BC742C754EB63686781
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals.import re.from ..compat import compat_urllib_parse.from ..extractor.common import InfoExtractor.from ..extractor.vshare import VShareIE as OldVShareIE...class VShareIE(OldVShareIE):. # http://yespornplease.com/view/353285165 .............vob.......... # https://vshare.io/v/fccdbc4/width-750/height-400/1. def _real_extract(self, url):. # ....... try:. return super(VShareIE, self)._real_extract(url). except:. pass.. # ....title......... video_id = self._match_id(url). # ..... webpage = self._download_webpage(url, video_id). # .....js........... formats = self.get_formats(webpage). if len(formats) == 0:. return super(VShareIE, self)._real_extract(url).. title = self._html_search_regex(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-VBU1K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4345
Entropy (8bit):	4.771456105586546
Encrypted:	false
SSDEEP:	96:0L4YoeNvYCUN1XX5YmuoXh5Ye8o3EubJccti0S:0+eNvfyuKn8KZvS
MD5:	DE59A7BFA758C1AD92D12D25112393BE
SHA1:	6C2195F83F1E99D7EC718395EFE0DE9495305D43
SHA-256:	1B962407B05B46AD59D7BAFA3B516A588801DB0AB6B3F9DBCF741779BA0A7D93
SHA-512:	8FCE2318749A209538638B62E31BAE6E2CE646C474F888EB5CFF99F9B3310BFC014A48174013EF7E19F8715CE5D3F0EEAC7CD74D0A54F9FB4446F129076AA4CB
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from ..extractor.common import (. InfoExtractor.).from ..extractor.fc2 import (. FC2IE as base,. FC2EmbedIE as base2,. hashlib,. compat_urllib_request,. compat_urlparse,. ExtractorError.)..class FC2IE(base):. _VALID_URL = r'^(?:https?://(?:video\.fc2\.com\|(?:jinniumovie\|chenghuavideo)\.be\|shanximovie\.net)/(?:[^/]+/)*content/\|fc2:)(?P<id>[^/]+)'.. def _real_extract(self, url):. try:. url = url.replace('jinniumovie.be', 'video.fc2.com').replace('chenghuavideo.be', 'video.fc2.com').replace('shanximovie.net', 'video.fc2.com'). return super(FC2IE, self)._real_extract(url). except:. return self._new_real_extract(url)... def _new_real_extract(self, url):. video_id = self._match_id(url). url = url.replace('jinniumovie.be', 'video.fc2.com').replace('chenghuavideo.be', 'video.fc2.com').replace('shanximovie.net', 'video.fc2.com'). self._login().

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-VC10R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5541
Entropy (8bit):	4.69215574444183
Encrypted:	false
SSDEEP:	96:/cBVdrpbRZvyf2ffRsDU057zEziHRlXMum7ek6C2I+YS3fjTeYqUvrjc:/Urxvg/7ziixlXbm7elC2I+P3fjTeYZw
MD5:	55045E29B4F7962B8B625C20B33A11F8
SHA1:	7FD114CB48EA0D3FF4967F1747681A3E90AEE17D
SHA-256:	8ADE5BE3373668B409B7EFAD2906A1B37CF221E9A399BF430AA59EDAA1EC33E3
SHA-512:	03015B26420526775150FE202D8D92198F9D41476AE11B2BAC4E2DC6EF7B6211752A6959EF88C5D52768266F1A57D7D13FCEAC69D763F0FDFC271AB9E9C90CF1
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..extractor.common import InfoExtractor.from ..utils import smuggle_url.from ..extractor.theplatform import ThePlatformIE, default_ns, OnceIE, determine_ext, update_url_query.from ..compat import (. compat_urllib_parse,. compat_urllib_parse_unquote.).import re..class HistoryIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?history\.com'.. _TESTS = [{. 'url': 'http://www.history.com/topics/valentines-day/history-of-valentines-day/videos/bet-you-didnt-know-valentines-day?m=528e394da93ae&s=undefined&f=1&free=false',. 'md5': '6fe632d033c92aa10b8d4a9be047a7c5',. 'info_dict': {. 'id': 'bLx5Dv5Aka1G',. 'ext': 'mp4',. 'title': "Bet You Didn't Know: Valentine's Day",. 'description': 'md5:7b57ea4829b391995b405fa60bd7b5f7',. },. 'add_ie': ['ThePlatform'],. }].. def _real_extract(self, url):. webpage = self._download_webpage(url, url). try

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-VM01N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3173
Entropy (8bit):	4.3910571560785625
Encrypted:	false
SSDEEP:	48:p8ud9KDavXjlNBq9jUm5pBmq6MPlyzl3znTqCTS7:pjgaEhUqt6MPly5G17
MD5:	4F9530A16313F465232991ED05DEB2C9
SHA1:	0A85E61B6F5C0D098F80ED49D844C542EC924746
SHA-256:	8E0641593DB8FC418973B2F96418847E8949846881E2F29356C6F13198CF3750
SHA-512:	9589273518DAC6544BA66F698DE4AD535D973A0841A1F1877E7F55395683D7ACE78FF01F4E29882EA79DCC37CD55261968A16F59AB22A13EC25F668A9EFE2956
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.# 2019-04-11, liujw..from __future__ import unicode_literals..import re..from ..extractor.common import InfoExtractor.from ..utils import (. int_or_none,. float_or_none,.)...class QQIE(InfoExtractor):. # https://v.qq.com/x/cover/rxqx32noqzdvziw/s0854s1zdp6.html. # https://v.qq.com/x/cover/x6aayd03yfxv3bv.html. _VALID_URL = r'https?://(?:.\.)?qq\.com/./(?P<id>\w+).html?'... def _real_extract(self, url):. vid = self._match_id(url). if len(vid) != 11:. webpage = self._download_webpage(url, url). vid = self._search_regex(r'vid=(\w{11})&', webpage, 'video_id'). if not vid or len(vid) != 11:. return super(QQIE, self)._real_extrace(url);.. def get_json(jsonp):. return self._search_regex(r'({.*})', jsonp, None).. video_data = self._download_json(. 'http://h5vv.video.qq.com/getinfo', vid, transform_source=get_json, query={. 'vid': vid,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\WS_Extractor\is-VP7PM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3514
Entropy (8bit):	4.9063220507910374
Encrypted:	false
SSDEEP:	96:GXQ4S8jrWKrgLpqsiegrgvelHq5f83Om/tJt46Ng:sbrKLVvvWHqh83Vtg6Ng
MD5:	37E3613C33E754A90BADAD5886667DED
SHA1:	15F85FFF0093F037FD8B82AE9674535C936DF297
SHA-256:	702404DA8D74AD3DE4ABBC853ADEB41C16CD0D9F58EEB06D9AE2ED64A645FFE5
SHA-512:	17189166BC538D63213B6E5E6B2350608E58A95527419D6270E5B738C027141259CCB8EF718A7934BD82D56BED6C441F0759694DD4978889062E2A55564AF5E6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import json.from ..extractor.common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,.).from ..extractor.aol import AolIE as OldAolIE...class AolIE(InfoExtractor):. IE_NAME = 'on.aol.com'. _VALID_URL = r'(?:aol-video:\|https?://(?:(?:www\|on)\.)?aol\.com/(?:[^/]+/)*(?:[^/?#&]+-)?)(?P<id>[^/?#&]+)'.. _TESTS = [{. # video with 5min ID. 'url': 'http://on.aol.com/video/u-s--official-warns-of-largest-ever-irs-phone-scam-518167793?icid=OnHomepageC2Wide_MustSee_Img',. 'md5': '18ef68f48740e86ae94b98da815eec42',. 'info_dict': {. 'id': '518167793',. 'ext': 'mp4',. 'title': 'U.S. Official Warns Of \'Largest Ever\' IRS Phone Scam',. 'description': 'A major phone scam has cost thousands of taxpayers more than $1 million, with less than a month until income tax returns are due to the IRS.',. 'timestamp': 1395405060,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\YoutubeDL.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	110719
Entropy (8bit):	4.233610803659247
Encrypted:	false
SSDEEP:	1536:jnOjTGC77i6oawPJx+Ab3MAR6XF8+zP6Afk+liP49hiP491PG6oPG6uies02BKN0:jnAKmi+wkLXtPNFmESg59LG9Np
MD5:	564804468B41DAE0FC73BCC8C4AA298F
SHA1:	CA7D9491C6F33335C7797233A6CCA5427C29DB91
SHA-256:	C69F1A2E3BBF98221D460C89B554FD06606C1646FFFB98BB5A53D56D6D4E0CC9
SHA-512:	4CF2876D550B0FE1EF4EEFA38050F45D6081D8784A4DC2F0FAE21ABB7B94D56697ABAE1127D379BA919A3F280BC52A3578A5F03CE75CA8E2284757BFE81941E8
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# coding: utf-8..from __future__ import absolute_import, unicode_literals..import collections.import contextlib.import copy.import datetime.import errno.import fileinput.import io.import itertools.import json.import locale.import operator.import os.import platform.import re.import shutil.import subprocess.import socket.import sys.import time.import tokenize.import traceback.import random..from string import ascii_letters..from .compat import (. compat_basestring,. compat_cookiejar,. compat_get_terminal_size,. compat_http_client,. compat_kwargs,. compat_numeric_types,. compat_os_name,. compat_str,. compat_tokenize_tokenize,. compat_urllib_error,. compat_urllib_request,. compat_urllib_request_DataHandler,.).from .utils import (. age_restricted,. args_to_str,. ContentTooShortError,. date_from_str,. DateRange,. DEFAULT_OUTTMPL,. determine_ext,. determine_protocol,. DownloadError,. encode_compat_str,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20502
Entropy (8bit):	4.550463650406318
Encrypted:	false
SSDEEP:	384:xZNDfuvgFvD7w3+MrwSp/U+7OEgYPSX6HwjN:xvDuvgFvD7w3+gp/U+7OEgYPSX6HUN
MD5:	4B9FCBD27F76AA8CA76134ECE37B7C46
SHA1:	9113469951FF1B78FF81DBC77E9655E68DB299F3
SHA-256:	7BF035C5C3AF5CEBD7EA3831EE259A868DAA213E691684E346C4DFCA8C948D95
SHA-512:	7C6769E2E0C188602F7C0F9E6833CAEE556E5A56132B5C72C8DA2F61E5C0ED15FA001DBCB1321CEA0C0D806AFDCC90B62CBFC8D337A6EF7FC80F6A971D017285
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# coding: utf-8..from __future__ import unicode_literals..__license__ = 'Public Domain'..import codecs.import io.import os.import random.import sys...from .options import (. parseOpts,.).from .compat import (. compat_getpass,. compat_shlex_split,. workaround_optparse_bug9161,.).from .utils import (. DateRange,. decodeOption,. DEFAULT_OUTTMPL,. DownloadError,. expand_path,. match_filter_func,. MaxDownloadsReached,. preferredencoding,. read_batch_urls,. SameFileError,. setproctitle,. std_headers,. write_string,. render_table,.).from .update import update_self.from .downloader import (. FileDownloader,.).from .extractor import gen_extractors, list_extractors.from .extractor.adobepass import MSO_INFO.from .YoutubeDL import YoutubeDL...def _real_main(argv=None):. # Compatibility fixes for Windows. if sys.platform == 'win32':. # https://github.com/ytdl-org/youtube-dl/issues/820. codecs.register

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\main.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.732497447823535
Encrypted:	false
SSDEEP:	6:HWaH+RMABYa4JW2afE74eFF2KyGbGm3EYhNzCRVl4KcQjum2uqkFuRS6D9vWtAAT:HIjYa4JwsF1yRetDMTcWuTD9+t802aA2
MD5:	59CCBEAD80D3088B81E48D69D9E377CA
SHA1:	A8D018BE700A285B7B0DB94058B95697DB2134B0
SHA-256:	413C5176FA7A74F1162E25597DF71F26F63C39713BEE9825B4AC77A7880C773D
SHA-512:	BFDE535CDAEE72A031E79D763377AAE2995CF096D7C754F4707BBCF2F9F57825F8DA69DBCC55F961E8ECEB4AA56670628DFD76D71EFAAA1EAC5FAB6ACD81A39B
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.from __future__ import unicode_literals..# Execute with.# $ python youtube_dl/__main__.py (2.6+).# $ python -m youtube_dl (2.7+)..import sys..if __package__ is None and not hasattr(sys, 'frozen'):. # direct call of __main__.py. import os.path. path = os.path.realpath(os.path.abspath(__file__)). sys.path.insert(0, os.path.dirname(os.path.dirname(path)))..import youtube_dl..if __name__ == '__main__':. youtube_dl.main().

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\aes.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16130
Entropy (8bit):	4.756629217139018
Encrypted:	false
SSDEEP:	384:IIChFH3xLxJCxwJNxwF5p8XUMsO7OXgJN9n85eK3z0HilY9n:IVX158tq
MD5:	D7214C3C57F0616BFBEAA995542D0F57
SHA1:	DBE4E7225B1F92542557F465E18041B26B77E19B
SHA-256:	329A210EAEAFA8B0758E02A1F7386A70823712623F4543AC492ACF86EDA97589
SHA-512:	F81E926329EAD46A1983581AC4CE4A7356002606F82F30685F8582202C07E55A0269DB0EB560328C64BBB793580CF4C46F8BC090D7726E43A648A8C632A3F3C9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from math import ceil..from .compat import compat_b64decode.from .utils import bytes_to_intlist, intlist_to_bytes..BLOCK_SIZE_BYTES = 16...def aes_ctr_decrypt(data, key, counter):. """. Decrypt with aes in counter mode.. @param {int[]} data cipher. @param {int[]} key 16/24/32-Byte cipher key. @param {instance} counter Instance whose next_value function (@returns {int[]} 16-Byte block). returns the next counter block. @returns {int[]} decrypted data. """. expanded_key = key_expansion(key). block_count = int(ceil(float(len(data)) / BLOCK_SIZE_BYTES)).. decrypted_data = []. for i in range(block_count):. counter_block = counter.next_value(). block = data[i * BLOCK_SIZE_BYTES: (i + 1) * BLOCK_SIZE_BYTES]. block += [0] * (BLOCK_SIZE_BYTES - len(block)).. cipher_counter_block = aes_encrypt(counter_block, expanded_key). decrypted_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\cache.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	4.3665794819916215
Encrypted:	false
SSDEEP:	48:Pue1fhfwJmFkmrrdjDJHaWpIe7IZJ0WPkmJxvaEpIeIiqOR/yfMHFIp3yh5elw7a:F/wARldQemWRmJxieUULyMa
MD5:	3929CC5F0C628C1B74CC7EB620C0317F
SHA1:	D41B6CCF7E574C1439475E17E1F297153ECC397B
SHA-256:	BA3DAA0BD84FF5D6A5F1EE544E0143276FB5BD7E0E0C6954D97992E9EC0DE6B8
SHA-512:	36357BE033E9AEEB86E62F2A9ABC5F1C002A1ABFDD629433758E3247EDB85366830EBDD3F9FB6E8C5900E67C7A2907DE927CE2BC966A0D0CDE966FB68D7D10A7
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import errno.import io.import json.import os.import re.import shutil.import traceback..from .compat import compat_getenv.from .utils import (. expand_path,. write_json_file,.)...class Cache(object):. def __init__(self, ydl):. self._ydl = ydl.. def _get_root_dir(self):. res = self._ydl.params.get('cachedir'). if res is None:. cache_root = compat_getenv('XDG_CACHE_HOME', '~/.cache'). res = os.path.join(cache_root, 'youtube-dl'). return expand_path(res).. def _get_cache_fn(self, section, key, dtype):. assert re.match(r'^[a-zA-Z0-9_.-]+$', section), \. 'invalid section %r' % section. assert re.match(r'^[a-zA-Z0-9_.-]+$', key), 'invalid key %r' % key. return os.path.join(. self._get_root_dir(), section, '%s.%s' % (key, dtype)).. @property. def enabled(self):. return self._ydl.params.get('cachedir') is not False.. def store(self,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\compat.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	92961
Entropy (8bit):	4.528254170194639
Encrypted:	false
SSDEEP:	768:bUVCMw26S3nsXPTVBt7GNa3WH+xKmwNmAlTIKPq2lLNGxMJj:QL6ssXPTVXGNaGMKVNdhRqeNnJj
MD5:	80570903320B4E25724E4197BAA35D92
SHA1:	8D1DEDFE54286CAD39E80A747FE14ED53D052CD3
SHA-256:	3EBC7A35B89C1750D8D551D755D2A995C4205B1033C9C9B56F8ABD5A35BCC306
SHA-512:	AE74B0BA6CD02C5428313020ECA4F82C7BE8F395E3A4BD704DFA3AAF5D7A043C80D97AAE06B0E25A726F665E2634D1AA8FCAF31AC808DE1FC30465851FF40F9C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import binascii.import collections.import ctypes.import email.import getpass.import io.import itertools.import optparse.import os.import platform.import re.import shlex.import shutil.import socket.import struct.import subprocess.import sys.import xml.etree.ElementTree...try:. import urllib.request as compat_urllib_request.except ImportError: # Python 2. import urllib2 as compat_urllib_request..try:. import urllib.error as compat_urllib_error.except ImportError: # Python 2. import urllib2 as compat_urllib_error..try:. import urllib.parse as compat_urllib_parse.except ImportError: # Python 2. import urllib as compat_urllib_parse..try:. from urllib.parse import urlparse as compat_urllib_parse_urlparse.except ImportError: # Python 2. from urlparse import urlparse as compat_urllib_parse_urlparse..try:. import urllib.parse as compat_urlparse.except ImportError: # Python 2. import urlpars

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\M3u8Downloader.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	18743
Entropy (8bit):	4.340134524696179
Encrypted:	false
SSDEEP:	384:w7go4u3ASSwB4jfvzgmQqATOiD3OrjR+Agh2WqnFo71J9qxEnno5JQI:w75uC2J6nW
MD5:	43816CBB99DE926A411A110561BC9B56
SHA1:	E5A2B2CB01DFBE0DD0FEFEA845DDBF897602C3D9
SHA-256:	39CC79DE4A6959BF25A987AC63332026658A19C634E87188328310B7A7B573AC
SHA-512:	5920A79B216EBA2D6A2E9917179F3E5277E09A69C1CD5AB20241CF029CB0FBF860202402EEE324B779614BA39B92BA47C4A4910BE19EE5CD7F768DB4D887E301
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals..import os.path.import subprocess.import sys.import re.import time.import traceback.from ..utilsEX import debug..from .common import FileDownloader.from ..compat import (. compat_setenv,. compat_str,.).from ..utilsEX import get_top_host..from ..postprocessor.ffmpeg import FFmpegPostProcessor, EXT_TO_OUT_FORMATS.from ..utils import (. cli_option,. cli_valueless_option,. cli_bool_option,. cli_configuration_args,. encodeFilename,. encodeArgument,. handle_youtubedl_headers,.. check_executable,. is_outdated_version,. detect_exe_version,.).from .external import ExternalFD..def getStartInfo():. IS_WIN32 = 'win32' in str(sys.platform).lower(). if IS_WIN32:. startupinfo = subprocess.STARTUPINFO(). startupinfo.dwFlags = subprocess.CREATE_NEW_CONSOLE \| subprocess.STARTF_USESHOWWINDOW. startupinfo.wShowWindow = subprocess.SW_HIDE. return startupinfo. else:. ret

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\OldM3u8Downloader.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10425
Entropy (8bit):	4.375320315458375
Encrypted:	false
SSDEEP:	96:2pM536qh06eIKVN+HG8TIp0qEX8tnCqmdTWso32mC4MZsUPgNm3sfq5HhfqhUN9U:2NdCMJ/mpmGiMKlCHF4UNVKYxlY
MD5:	B6728F4FE8AC8B79AEA13C8D7116D76A
SHA1:	3AE62AAC6A632688B9AB60C11AEB6EB3DC4BA613
SHA-256:	2D9538FD7A31B2FCD5F73BFF16CEB893BB97CED7B816A6A50123453CD512A1FA
SHA-512:	1B8C9C1C1CFADF2034E2A9D1EBDA73B925F5838F48B3ACBB3B0E4DF07448ADD4B066FE1603566D02E95A492DE1E3BE5E22EE0BA31F1000E2E7FABAF0EEDD913B
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.from __future__ import unicode_literals.import os.import time.import re.import sys.from .external import ExternalFD.from ctypes import *.from ..utils import (. int_or_none,. encodeFilename,. handle_youtubedl_headers,.).import struct.from ..utilsEX import (. debug,. sleep.)...class TestCanel(Exception):. pass...class OldM3u8downloader:. TestSucess = False.. def __init__(self, strUrl, strSavePath, strCookie, callback, http_headers, libPath):. if '#' in strUrl:. strUrl = strUrl.split('#')[0]. self.strUrl = strUrl. self.strSavePath = strSavePath. self.strCookie = strCookie. self.callback = callback. dll_path = os.getenv('M3u8DownloaderPath'). if dll_path is None:. debug('Find M3u8Downloader.dll Begin-------------------------------'). import sys. if sys.platform == 'win32':. debug('Find M3u8Downloader.dll Win-----------------------------

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\init.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1607
Entropy (8bit):	4.776289221958683
Encrypted:	false
SSDEEP:	24:1R8lFvAEJewzhaaEoWPWLry+M8tE15I/hxFVP0s9o2xq/+KdxqWxyiZvZ4G:PuZh1EPWLuWE1S/hxP8sTcWUlxyiNp
MD5:	556D0BA45E280BA14ED6B44861CDF4F7
SHA1:	C0C805F21E5858EE042A4A8D6E584F13BF62BB4E
SHA-256:	872448490A3A1B7F0ECFF1794ADE9B05D92D21A996FC372B7E9FD906FBF50F0A
SHA-512:	22F7168087426B7DA3509E31566FDE01BDF205DACE28DE87952623AF487C528276736D9FE3677672B05B56068B5FFC248346901F01DAFE25AF18BB7B1E9DFEB4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import FileDownloader.from .f4m import F4mFD.from .hls import HlsFD.from .http import HttpFD.from .rtmp import RtmpFD.from .dash import DashSegmentsFD.from .rtsp import RtspFD.from .ism import IsmFD.from .httpCrul import HttpCurl.from .external import (. get_external_downloader,. FFmpegFD,.)..from ..utils import (. determine_protocol,.)..PROTOCOL_MAP = {. 'rtmp': RtmpFD,. 'm3u8_native': HlsFD,. 'm3u8': FFmpegFD,. 'mms': RtspFD,. 'rtsp': RtspFD,. 'f4m': F4mFD,. 'http_dash_segments': DashSegmentsFD,. 'ism': IsmFD,.}...def get_suitable_downloader(info_dict, params={}):. """Get the downloader class that can handle the info dict.""". protocol = determine_protocol(info_dict). info_dict['protocol'] = protocol.. # if (info_dict.get('start_time') or info_dict.get('end_time')) and not info_dict.get('requested_formats') and FFmpegFD.can_download(info_dict):. # return FFmpegFD.. external_do

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\common.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14774
Entropy (8bit):	4.391430302306946
Encrypted:	false
SSDEEP:	384:s3OgsgnBx/JSoHw0TvV92rgJk1dSwlxZGbfxVe0o4THAHC9ad83:s3Of2BxhfQ0JfAEb5EiTHAq
MD5:	3E5AF146154A6F0F82B5E0B2A5EE79EF
SHA1:	B26FA29CE08098D31C28FD00C5408CBDA977B376
SHA-256:	BA02AF503100DF6176AEC740020051F428A81CA61CE877971F90A9D48D7725FE
SHA-512:	23B61370D6AC812EA579B50EDED6B5AE16AB7752F3EC8152F209F796E14955482BE0E523651D9380E965DA05164358CFF56516462FFBB059A0287946099AA605
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import division, unicode_literals..import os.import re.import sys.import time.import random..from ..compat import compat_os_name.from ..utils import (. decodeArgument,. encodeFilename,. error_to_compat_str,. format_bytes,. shell_quote,. timeconvert,.)...class FileDownloader(object):. """File Downloader class... File downloader objects are the ones responsible of downloading the. actual video file and writing it to disk... File downloaders accept a lot of parameters. In order not to saturate. the object constructor with arguments, it receives a dictionary of. options instead... Available options:.. verbose: Print additional info to stdout.. quiet: Do not print messages to stdout.. ratelimit: Download speed limit, in bytes/sec.. retries: Number of times to retry for HTTP error 5xx. buffersize: Size of download buffer in bytes.. noresizebuffer: Do not automatica

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\curlDownload.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10130
Entropy (8bit):	4.633577760043911
Encrypted:	false
SSDEEP:	192:5Vke14LjkDWbwy+1hP2mXjcim+nCRfunWU2W105hA:Sau+CRe105+
MD5:	46FDE20D5C9B45E721C94406D0CC9AEA
SHA1:	FF4F7214009DC7544531207A75E9E14C2918A12D
SHA-256:	33708FF64CDEA0F76B2E4842156E19FE9D38C0F6553A0E51D5C4CA39BDA8FAEF
SHA-512:	73B33FE03825D5A709903AB6C1742347573A5FBD4805DF014259CDC96D5E946BF07A6F43B45926F77A9E76C9AB0DEEF9332C670617973922BF23E9478589B3FB
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..import os, sys.import threading.import time.import math.import traceback..try:. import pycurl.except Exception as e:. print('not surpot curl')...class CurlDownloader:. def __init__(self, target_address):. # Set variables of the downloader ########. '''. :type target_address: object. '''. self.output_file = '' # Downloaded file is stored here. self.fileName = ''. self.targetURL = target_address. self.curl_obj = ''. self.fp = None. self.resumdataerror = False. self.downloadbyte = 0. self.resumSize = 0. self.rang_start = 0. self.rang_end = sys.maxsize. self.checkResum = False. self.checkResumSize = 16. self.clientError = False. self.isFinish = False. self.stop = False. self.errorCode = 0. self.initCurl().. def initCurl(self):. self.curl_obj = pycurl.Curl(). self.curl_obj.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\dash.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3004
Entropy (8bit):	4.336775711279586
Encrypted:	false
SSDEEP:	48:DNugtDGbJvCNVZ7e4PguUY9ZpYp2qpRp2CdL3nU1kp2HiPWxy0WsPprY/MJ54ar6:D/yVWVte4hfa33U1VKA13q
MD5:	657E196D3BEE75FD3E605FED5EDC1353
SHA1:	835CEE7AEABC58FF32590CE30D9B29C16BCA0FA5
SHA-256:	3255EB21DB3CEFD7701AE97241E13A5C0C0E7D119CD43EEC00A113122801C7DC
SHA-512:	69C86BF667399A2C04AF15522B3A63A06E563096BF28CBE325DD4D2CB058F52C533BDC757CA99D5E9891869C9B333D0515B4C44E9562D27B1986B7B54EE1ACBF
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..from .fragment import FragmentFD..from ..compat import (. compat_urllib_error,. compat_urlparse,. compat_struct_pack,.)..class DashSegmentsFD(FragmentFD):. """. Download segments in a DASH manifest. """.. FD_NAME = 'dashsegments'.. def real_download(self, filename, info_dict):. segments = info_dict['fragments'][:1] if self.params.get(. 'test', False) else info_dict['fragments']. #compat_urlparse.urljoin(man_url, line). # .vimeo................... if 'fragment_base_url' in info_dict:. base_url = info_dict['fragment_base_url']. for segment in segments:. if 'path' in segment and not ('url' in segment):. segment['url'] = compat_urlparse.urljoin(base_url, segment['path']).. ctx = {. 'filename': filename,. 'total_frags': len(segments),. }..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\external.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13796
Entropy (8bit):	4.62026724021925
Encrypted:	false
SSDEEP:	384:6346rFSVgh+2WBuF28RAX3/EqnFrX71B9qCeJQDrJk:6hrAfHpFk
MD5:	A963F843FB6DF928721935A4A71A448B
SHA1:	81A805211931468CB606B429D64A5EF5128EE9E9
SHA-256:	947503504A7D79D71B727C2006B81A633A954B8987F47F5ACAD2A2AF2C20D40B
SHA-512:	98B62980CE322C420894259815D3F780A55F057639CC43E46735B11152F5E11534FD23FE48BD111995A4AEACEAAE829A8BC877156F53B2DFBF45BB679DCC7F46
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os.path.import re.import subprocess.import sys.import time..from .common import FileDownloader.from ..compat import (. compat_setenv,. compat_str,.).from ..postprocessor.ffmpeg import FFmpegPostProcessor, EXT_TO_OUT_FORMATS.from ..utils import (. cli_option,. cli_valueless_option,. cli_bool_option,. cli_configuration_args,. encodeFilename,. encodeArgument,. handle_youtubedl_headers,. check_executable,. is_outdated_version,.)...class ExternalFD(FileDownloader):. def real_download(self, filename, info_dict):. self.report_destination(filename). tmpfilename = self.temp_name(filename).. try:. started = time.time(). retval = self._call_downloader(tmpfilename, info_dict). except KeyboardInterrupt:. if not info_dict.get('is_live'):. raise. # Live stream downloading cancellation should be considered as. # correct an

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\f4m.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	16837
Entropy (8bit):	4.4919492840691015
Encrypted:	false
SSDEEP:	192:U/leyTFirWJkNxCPkE97Q167OQldNo5WtbC9YqPM+ahu3VrQy4QkuCU:4XirWJkGPrNo5WtbC9YqPM+Tr3tkuCU
MD5:	E38E134F0B3A4655F598E5279DDF025F
SHA1:	B9811B02890F543970F869267A51A96CB5405BA9
SHA-256:	DE385410C092C3F7B374651CA134E46B274EDFDF560E97AF072909063FD8C702
SHA-512:	19A67E13F9ADFD78D456D0D90A01FD843AA924B03FE0820A359942F130C330A4882EB08F73EF7F1BAA6A2AA8A87DF64C50DA43F87E8A9BFD3A49B76C71A569C1
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --.from __future__ import division, unicode_literals..import io.import re.import itertools.import time..from .fragment import FragmentFD.from ..compat import (. compat_b64decode,. compat_etree_fromstring,. compat_urlparse,. compat_urllib_error,. compat_urllib_parse_urlparse,. compat_struct_pack,. compat_struct_unpack,.).from ..utils import (. fix_xml_ampersands,. xpath_text,.)..def _add_ns(prop, ver=1):. return '{http://ns.adobe.com/f4m/%d.0}%s' % (ver, prop)..def get_base_url(manifest):. base_url = xpath_text(. manifest, [_add_ns('baseURL', 1), _add_ns('baseURL', 2)],. 'base URL', default=None). if base_url:. base_url = base_url.strip(). return base_url..class DataTruncatedError(Exception):. pass...class FlvReader(io.BytesIO):. """. Reader for Flv files. The file format is documented in https://www.adobe.com/devnet/f4v.html. """.. def read_bytes(self, n):. da

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\fragment.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10426
Entropy (8bit):	4.337893592072577
Encrypted:	false
SSDEEP:	192:u7i2qOMVAdWYplYVlOmAVDVsgDJIzgaM0qP0Aph0AnvbkZRCC7e:uQ/nlr4xs+JIzW0qaFM
MD5:	CF2E9F03DF82E5E2A40566F4FDE920DE
SHA1:	623BE5CBA2160C3D7552C0DEA26C56DBFC6C2792
SHA-256:	6C71055C807CA6C512EEA56531A2C1EE864031F52944DFA66A25B0073E50E6C8
SHA-512:	02EEF35B96DD9D4D42E7765659FEF5D06D9C8B48114F58989EDC2280378D8DA92BEBE304B1D805EAE9CF53333D00C68036C43C4114E9DC185A8CF1F6606313DF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import division, unicode_literals..import os.import time.import json..from .common import FileDownloader.from .http import HttpFD.from ..utils import (. error_to_compat_str,. encodeFilename,. sanitize_open,. sanitized_Request,.)...class HttpQuietDownloader(HttpFD):. def to_screen(self, args, *kargs):. pass...class FragmentFD(FileDownloader):. """. A base file downloader class for fragmented media (e.g. f4m/m3u8 manifests)... Available options:.. fragment_retries: Number of times to retry a fragment for HTTP error (DASH. and hlsnative only). skip_unavailable_fragments:. Skip unavailable fragments (DASH and hlsnative only). keep_fragments: Keep downloaded fragments on disk after downloading is. finished.. For each incomplete fragment download youtube-dl keeps on disk a special. bookkeeping file with download state and metadata (in future such files wi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\hls.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9950
Entropy (8bit):	4.538192839016185
Encrypted:	false
SSDEEP:	192:oJhm7uXxo8+bXlAkjmj5rTFf2wITFTFQR1UvvDb5ZQSm5L:oJ46XxoBlAey5rTp2wITFT/vvZfmd
MD5:	9822BFFA52097D51FF930704ED2767D6
SHA1:	091FCEA19576A0536445C2AFF7012783B175D4B7
SHA-256:	DF66EE26AFDA47FD60727CDA45EA0F003E479E59ED9C57651EB03A9A6E2E13DE
SHA-512:	019CA1B99D696D8D1BA859F11C8A53405B3A77FABF32818642B4F041CDE76A692E57E2D6C5BD6FFEA1852C0F992B66CC93834515F606B4DEA8BC2237E7F10AF5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals....import re..import binascii..try:.. from Crypto.Cipher import AES.. can_decrypt_frag = True..except ImportError:.. can_decrypt_frag = False....from .fragment import FragmentFD..try:.. from .M3u8Downloader import FFmpegFD..except:.. from .external import FFmpegFD....from ..compat import (.. compat_urllib_error,.. compat_urlparse,.. compat_struct_pack,..)..from ..utils import (.. parse_m3u8_attributes,.. update_url_query,..)..from ..extractor.common import InfoExtractor....class HlsFD(FragmentFD):.. """ A limited implementation that does not require ffmpeg """.... FD_NAME = 'hlsnative'.... @staticmethod.. def can_download(manifest, info_dict):.. UNSUPPORTED_FEATURES = (.. r'#EXT-X-KEY:METHOD=(?!NONE\|AES-128)', # encrypted streams [1].. # r'#EXT-X-BYTERANGE', # playlists composed of byte ranges of media files [2].... # Live streams heuristic does not always work (e

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\http.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17801
Entropy (8bit):	4.073010266795983
Encrypted:	false
SSDEEP:	192:tl0DheRz6Hv3xZhF3OHbC0VloPCULJK0AKnfiwULK:tlcep6HvBZhF3O7z7o6ULJK07nfiwUW
MD5:	BF9CB3474030D746B877F9FA95ED27D9
SHA1:	5AC6F066164F5EA0AB1F3A92FE91F57B3D769304
SHA-256:	352D6FFA43F26605B2CBD8A0E41954117954FEBCD6D74053C46069ADDC4AAB42
SHA-512:	5602091E773C52583FE805C6F080608A587189B42796AF0AC1A2FB0D5910522330866D52DE4BFC2A58E6B01F673044659BC2E365A84E2874E5030CCFE888F5ED
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import errno.import os.import socket.import time.import random.import re.import base64.from .common import FileDownloader.from ..compat import (. compat_str,. compat_urllib_error,.).from ..utils import (. ContentTooShortError,. encodeFilename,. int_or_none,. sanitize_open,. sanitized_Request,. write_xattr,. XAttrMetadataError,. XAttrUnavailableError,. bytes_to_intlist.)..try:. from Crypto.Cipher import AES. can_decrypt_frag = True.except ImportError:. can_decrypt_frag = False..def decode_base64(data, altchars=b'+/'):. """Decode base64, padding being optional... :param data: Base64 data as an ASCII byte string. :returns: The decoded byte string... """. data = re.sub(r'[^a-zA-Z0-9%s]+' % altchars, b'', data).encode() # normalize. missing_padding = len(data) % 4. if missing_padding:. data += b'='* (4 - missing_padding). return base64.b64decode(data, altchars)..def hex2dec(str

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\httpCrul.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (337)
Category:	dropped
Size (bytes):	32971
Entropy (8bit):	4.40949856818488
Encrypted:	false
SSDEEP:	384:OTELJlJiLVh8/NpY88o/4V+UBYlbettw7tzFHbaF04pbvwONgK8S1Nv4tTGQ4xlU:OwmX8FK88o/4+Hba/D49GjRpS0Jg
MD5:	BE4A3D97510F3AE41A8FC32E25B052BA
SHA1:	D986512B0491BE0B75D890F5AC60661653C12B77
SHA-256:	8982FFAAFED3CAF51ACCA153D81C49A07CF7EA93CA613FA68EEDAD2755726974
SHA-512:	8C33D210BCAEEC439797B4185C32187443D97B682DB48210623407E419539439087E27D2E301725C9E7F20FAA14C30F247C53DC2619BC6DF698F6795AF0D323F
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from __future__ import unicode_literals..import errno.import os.import sys.import socket.import time.import re.import traceback..from .common import FileDownloader.from ..compat import compat_urllib_error.from ..utils import (. ContentTooShortError,. encodeFilename,. sanitize_open,. sanitized_Request,. write_xattr,. XAttrMetadataError,. XAttrUnavailableError,.)..try:. import pycurl.except Exception as e:. print('not surpot curl')..import threading.from .curlDownload import CurlDownloader..g_nodata_maxS = 60...class HttpCurl(FileDownloader):. def __init__(self, ydl, params):. # type: (object, object, object) -> object. FileDownloader.__init__(self, ydl, params). self.resume = True. self.chunk = 5 * 1024 * 1024 # Define the chunk size to be downloaded at once. self.thread_list = []. self.curlDownload_list = []. self.fileSize = 0. self.num_thread = 2.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\http_hb.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	4.338784178558187
Encrypted:	false
SSDEEP:	24:GacQ8lxOcuzwM2zT6Xhwwdn74GWGo4K4RLGS:DfuxOctTzT2Gw9s4RLGS
MD5:	99739767A6689E204DC1C2EEA06E5E97
SHA1:	A9C296D432142EF252E32774FAF69E8FABF6E5C4
SHA-256:	BD500995A859431B097323687FC5199B4DCCBADA4B16ADE82E297D4E8602A0C4
SHA-512:	B5A8EDFDB4C28435573DA16BF986CCCA2B15CEACB4DFBBE7F2EFC900A0C924EE4030A49C62239232D9071A0111DC9A42866D4280D00D6EE29247996C22CB7FD0
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.# ......from __future__ import unicode_literals..import sys.import threading.if sys.version_info >= (3, 0):. from urllib.request import urlopen.else:. from urllib2 import urlopen.from ..utilsEX import debug.from .http import HttpFD..class HttpHB(HttpFD):. def real_download(self, filename, info_dict):. result = False. if 'heartbeat_url'in info_dict:. def heart_beat():. try:. urlopen(url=info_dict['heartbeat_url'], data=info_dict['heartbeat_data']). debug('........................................heart beat!'). except Exception as ex:. debug('........................................heart beat fail: ' + ex.message). pass.. if not result:. timer = threading.Timer(25, heart_beat). timer.start().. heart_beat().. result = super(HttpHB, self).real_download(filen

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-2733H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10565
Entropy (8bit):	4.8277227147741675
Encrypted:	false
SSDEEP:	96:+kO3ue2yEPPAk96aovhz+Wg2ymfZ9aBroS0Ttxd2hF7eF9KXYwmZOFP43hJVsE6C:+kkunyE6ZMLO0I5JqIx51a9E39uEoq
MD5:	D97D94BE0E790E809FCF16FB555315B0
SHA1:	2E39D81E16C442D6DDF63B871DA82231A424C846
SHA-256:	5BE5146D1AEE33AA25961C9063F513AE6DCFED11719FE8E237C86E9AD7191013
SHA-512:	6ECFC6117D4A4BBD53DE322402B0E75A52A3241816BFDC7DE638F10FCB1825B755CAED8956BF6041D064574864DF70DAE6E6FD50C66389E883DBC1A068D36A8D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import time.import binascii.import io..from .fragment import FragmentFD.from ..compat import (. compat_Struct,. compat_urllib_error,.)...u8 = compat_Struct('>B').u88 = compat_Struct('>Bx').u16 = compat_Struct('>H').u1616 = compat_Struct('>Hxx').u32 = compat_Struct('>I').u64 = compat_Struct('>Q')..s88 = compat_Struct('>bx').s16 = compat_Struct('>h').s1616 = compat_Struct('>hxx').s32 = compat_Struct('>i')..unity_matrix = (s32.pack(0x10000) + s32.pack(0) * 3) * 2 + s32.pack(0x40000000)..TRACK_ENABLED = 0x1.TRACK_IN_MOVIE = 0x2.TRACK_IN_PREVIEW = 0x4..SELF_CONTAINED = 0x1...def box(box_type, payload):. return u32.pack(8 + len(payload)) + box_type + payload...def full_box(box_type, version, flags, payload):. return box(box_type, u8.pack(version) + u32.pack(flags)[1:] + payload)...def write_piff_header(stream, params):. track_id = params['track_id']. fourcc = params['fourcc']. duration = params['duration']. timescale = params.g

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-4EAAL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17801
Entropy (8bit):	4.073010266795983
Encrypted:	false
SSDEEP:	192:tl0DheRz6Hv3xZhF3OHbC0VloPCULJK0AKnfiwULK:tlcep6HvBZhF3O7z7o6ULJK07nfiwUW
MD5:	BF9CB3474030D746B877F9FA95ED27D9
SHA1:	5AC6F066164F5EA0AB1F3A92FE91F57B3D769304
SHA-256:	352D6FFA43F26605B2CBD8A0E41954117954FEBCD6D74053C46069ADDC4AAB42
SHA-512:	5602091E773C52583FE805C6F080608A587189B42796AF0AC1A2FB0D5910522330866D52DE4BFC2A58E6B01F673044659BC2E365A84E2874E5030CCFE888F5ED
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import errno.import os.import socket.import time.import random.import re.import base64.from .common import FileDownloader.from ..compat import (. compat_str,. compat_urllib_error,.).from ..utils import (. ContentTooShortError,. encodeFilename,. int_or_none,. sanitize_open,. sanitized_Request,. write_xattr,. XAttrMetadataError,. XAttrUnavailableError,. bytes_to_intlist.)..try:. from Crypto.Cipher import AES. can_decrypt_frag = True.except ImportError:. can_decrypt_frag = False..def decode_base64(data, altchars=b'+/'):. """Decode base64, padding being optional... :param data: Base64 data as an ASCII byte string. :returns: The decoded byte string... """. data = re.sub(r'[^a-zA-Z0-9%s]+' % altchars, b'', data).encode() # normalize. missing_padding = len(data) % 4. if missing_padding:. data += b'='* (4 - missing_padding). return base64.b64decode(data, altchars)..def hex2dec(str

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-4I4OA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3004
Entropy (8bit):	4.336775711279586
Encrypted:	false
SSDEEP:	48:DNugtDGbJvCNVZ7e4PguUY9ZpYp2qpRp2CdL3nU1kp2HiPWxy0WsPprY/MJ54ar6:D/yVWVte4hfa33U1VKA13q
MD5:	657E196D3BEE75FD3E605FED5EDC1353
SHA1:	835CEE7AEABC58FF32590CE30D9B29C16BCA0FA5
SHA-256:	3255EB21DB3CEFD7701AE97241E13A5C0C0E7D119CD43EEC00A113122801C7DC
SHA-512:	69C86BF667399A2C04AF15522B3A63A06E563096BF28CBE325DD4D2CB058F52C533BDC757CA99D5E9891869C9B333D0515B4C44E9562D27B1986B7B54EE1ACBF
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..from __future__ import unicode_literals..from .fragment import FragmentFD..from ..compat import (. compat_urllib_error,. compat_urlparse,. compat_struct_pack,.)..class DashSegmentsFD(FragmentFD):. """. Download segments in a DASH manifest. """.. FD_NAME = 'dashsegments'.. def real_download(self, filename, info_dict):. segments = info_dict['fragments'][:1] if self.params.get(. 'test', False) else info_dict['fragments']. #compat_urlparse.urljoin(man_url, line). # .vimeo................... if 'fragment_base_url' in info_dict:. base_url = info_dict['fragment_base_url']. for segment in segments:. if 'path' in segment and not ('url' in segment):. segment['url'] = compat_urlparse.urljoin(base_url, segment['path']).. ctx = {. 'filename': filename,. 'total_frags': len(segments),. }..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-4PDD4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1607
Entropy (8bit):	4.776289221958683
Encrypted:	false
SSDEEP:	24:1R8lFvAEJewzhaaEoWPWLry+M8tE15I/hxFVP0s9o2xq/+KdxqWxyiZvZ4G:PuZh1EPWLuWE1S/hxP8sTcWUlxyiNp
MD5:	556D0BA45E280BA14ED6B44861CDF4F7
SHA1:	C0C805F21E5858EE042A4A8D6E584F13BF62BB4E
SHA-256:	872448490A3A1B7F0ECFF1794ADE9B05D92D21A996FC372B7E9FD906FBF50F0A
SHA-512:	22F7168087426B7DA3509E31566FDE01BDF205DACE28DE87952623AF487C528276736D9FE3677672B05B56068B5FFC248346901F01DAFE25AF18BB7B1E9DFEB4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import FileDownloader.from .f4m import F4mFD.from .hls import HlsFD.from .http import HttpFD.from .rtmp import RtmpFD.from .dash import DashSegmentsFD.from .rtsp import RtspFD.from .ism import IsmFD.from .httpCrul import HttpCurl.from .external import (. get_external_downloader,. FFmpegFD,.)..from ..utils import (. determine_protocol,.)..PROTOCOL_MAP = {. 'rtmp': RtmpFD,. 'm3u8_native': HlsFD,. 'm3u8': FFmpegFD,. 'mms': RtspFD,. 'rtsp': RtspFD,. 'f4m': F4mFD,. 'http_dash_segments': DashSegmentsFD,. 'ism': IsmFD,.}...def get_suitable_downloader(info_dict, params={}):. """Get the downloader class that can handle the info dict.""". protocol = determine_protocol(info_dict). info_dict['protocol'] = protocol.. # if (info_dict.get('start_time') or info_dict.get('end_time')) and not info_dict.get('requested_formats') and FFmpegFD.can_download(info_dict):. # return FFmpegFD.. external_do

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-8MLDH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13796
Entropy (8bit):	4.62026724021925
Encrypted:	false
SSDEEP:	384:6346rFSVgh+2WBuF28RAX3/EqnFrX71B9qCeJQDrJk:6hrAfHpFk
MD5:	A963F843FB6DF928721935A4A71A448B
SHA1:	81A805211931468CB606B429D64A5EF5128EE9E9
SHA-256:	947503504A7D79D71B727C2006B81A633A954B8987F47F5ACAD2A2AF2C20D40B
SHA-512:	98B62980CE322C420894259815D3F780A55F057639CC43E46735B11152F5E11534FD23FE48BD111995A4AEACEAAE829A8BC877156F53B2DFBF45BB679DCC7F46
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os.path.import re.import subprocess.import sys.import time..from .common import FileDownloader.from ..compat import (. compat_setenv,. compat_str,.).from ..postprocessor.ffmpeg import FFmpegPostProcessor, EXT_TO_OUT_FORMATS.from ..utils import (. cli_option,. cli_valueless_option,. cli_bool_option,. cli_configuration_args,. encodeFilename,. encodeArgument,. handle_youtubedl_headers,. check_executable,. is_outdated_version,.)...class ExternalFD(FileDownloader):. def real_download(self, filename, info_dict):. self.report_destination(filename). tmpfilename = self.temp_name(filename).. try:. started = time.time(). retval = self._call_downloader(tmpfilename, info_dict). except KeyboardInterrupt:. if not info_dict.get('is_live'):. raise. # Live stream downloading cancellation should be considered as. # correct an

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-9199H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9950
Entropy (8bit):	4.538192839016185
Encrypted:	false
SSDEEP:	192:oJhm7uXxo8+bXlAkjmj5rTFf2wITFTFQR1UvvDb5ZQSm5L:oJ46XxoBlAey5rTp2wITFT/vvZfmd
MD5:	9822BFFA52097D51FF930704ED2767D6
SHA1:	091FCEA19576A0536445C2AFF7012783B175D4B7
SHA-256:	DF66EE26AFDA47FD60727CDA45EA0F003E479E59ED9C57651EB03A9A6E2E13DE
SHA-512:	019CA1B99D696D8D1BA859F11C8A53405B3A77FABF32818642B4F041CDE76A692E57E2D6C5BD6FFEA1852C0F992B66CC93834515F606B4DEA8BC2237E7F10AF5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals....import re..import binascii..try:.. from Crypto.Cipher import AES.. can_decrypt_frag = True..except ImportError:.. can_decrypt_frag = False....from .fragment import FragmentFD..try:.. from .M3u8Downloader import FFmpegFD..except:.. from .external import FFmpegFD....from ..compat import (.. compat_urllib_error,.. compat_urlparse,.. compat_struct_pack,..)..from ..utils import (.. parse_m3u8_attributes,.. update_url_query,..)..from ..extractor.common import InfoExtractor....class HlsFD(FragmentFD):.. """ A limited implementation that does not require ffmpeg """.... FD_NAME = 'hlsnative'.... @staticmethod.. def can_download(manifest, info_dict):.. UNSUPPORTED_FEATURES = (.. r'#EXT-X-KEY:METHOD=(?!NONE\|AES-128)', # encrypted streams [1].. # r'#EXT-X-BYTERANGE', # playlists composed of byte ranges of media files [2].... # Live streams heuristic does not always work (e

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-BRROF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10077
Entropy (8bit):	4.165085577035063
Encrypted:	false
SSDEEP:	96:b/N6qOmdXquW529d7sCJsTzc8eyBGCaJmV5ekT0TLWJI9YxD8UeqFrjZKBMwyZuK:bMqOuXjZbYJI+FrgBc5tHV8Rk0VyfWSH
MD5:	E4345648115F4BAF3A492FDCFCF3F7EB
SHA1:	C245103EF597E396E19551342D7242D1946806FF
SHA-256:	D597A6EA26CD66B813151DC3482DE7CC746B9E845E1D229C5A80FB4520E1EDAA
SHA-512:	99F7F40DFB5570744BB5470810B13E5B22F5172CC3E444E0A87FE94494357DEDE12525CD2E61B7F93E1D85F35755CD4804B82E3E272B0C7B5409B83EFB6A35D0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os.import re.import sys.import traceback.import subprocess.import time..from .common import FileDownloader.from ..compat import compat_str.from ..utils import (. check_executable,. encodeFilename,. encodeArgument,. get_exe_version,.)...def rtmpdump_version():. return ''. # return get_exe_version(. # 'rtmpdump', ['--help'], r'(?i)RTMPDump\s*v?([0-9a-zA-Z._-]+)')..def getStartInfo():. IS_WIN32 = 'win32' in str(sys.platform).lower(). if IS_WIN32:. startupinfo = subprocess.STARTUPINFO(). startupinfo.dwFlags = subprocess.CREATE_NEW_CONSOLE \| subprocess.STARTF_USESHOWWINDOW. startupinfo.wShowWindow = subprocess.SW_HIDE. return startupinfo. else:. return None..class RtmpFD(FileDownloader):. def getRTMPLocation(self):. import sys. if sys.platform == 'win32':. return r'DownloadRes\rtmpdump.exe' if os.path.exists(r'DownloadRes\rtmpdump.exe') else 'rtmpd

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-I0I3J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	18743
Entropy (8bit):	4.340134524696179
Encrypted:	false
SSDEEP:	384:w7go4u3ASSwB4jfvzgmQqATOiD3OrjR+Agh2WqnFo71J9qxEnno5JQI:w75uC2J6nW
MD5:	43816CBB99DE926A411A110561BC9B56
SHA1:	E5A2B2CB01DFBE0DD0FEFEA845DDBF897602C3D9
SHA-256:	39CC79DE4A6959BF25A987AC63332026658A19C634E87188328310B7A7B573AC
SHA-512:	5920A79B216EBA2D6A2E9917179F3E5277E09A69C1CD5AB20241CF029CB0FBF860202402EEE324B779614BA39B92BA47C4A4910BE19EE5CD7F768DB4D887E301
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.from __future__ import unicode_literals..import os.path.import subprocess.import sys.import re.import time.import traceback.from ..utilsEX import debug..from .common import FileDownloader.from ..compat import (. compat_setenv,. compat_str,.).from ..utilsEX import get_top_host..from ..postprocessor.ffmpeg import FFmpegPostProcessor, EXT_TO_OUT_FORMATS.from ..utils import (. cli_option,. cli_valueless_option,. cli_bool_option,. cli_configuration_args,. encodeFilename,. encodeArgument,. handle_youtubedl_headers,.. check_executable,. is_outdated_version,. detect_exe_version,.).from .external import ExternalFD..def getStartInfo():. IS_WIN32 = 'win32' in str(sys.platform).lower(). if IS_WIN32:. startupinfo = subprocess.STARTUPINFO(). startupinfo.dwFlags = subprocess.CREATE_NEW_CONSOLE \| subprocess.STARTF_USESHOWWINDOW. startupinfo.wShowWindow = subprocess.SW_HIDE. return startupinfo. else:. ret

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-I6BK7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10425
Entropy (8bit):	4.375320315458375
Encrypted:	false
SSDEEP:	96:2pM536qh06eIKVN+HG8TIp0qEX8tnCqmdTWso32mC4MZsUPgNm3sfq5HhfqhUN9U:2NdCMJ/mpmGiMKlCHF4UNVKYxlY
MD5:	B6728F4FE8AC8B79AEA13C8D7116D76A
SHA1:	3AE62AAC6A632688B9AB60C11AEB6EB3DC4BA613
SHA-256:	2D9538FD7A31B2FCD5F73BFF16CEB893BB97CED7B816A6A50123453CD512A1FA
SHA-512:	1B8C9C1C1CFADF2034E2A9D1EBDA73B925F5838F48B3ACBB3B0E4DF07448ADD4B066FE1603566D02E95A492DE1E3BE5E22EE0BA31F1000E2E7FABAF0EEDD913B
Malicious:	false
Reputation:	unknown
Preview:	# -- coding: utf-8 --.from __future__ import unicode_literals.import os.import time.import re.import sys.from .external import ExternalFD.from ctypes import *.from ..utils import (. int_or_none,. encodeFilename,. handle_youtubedl_headers,.).import struct.from ..utilsEX import (. debug,. sleep.)...class TestCanel(Exception):. pass...class OldM3u8downloader:. TestSucess = False.. def __init__(self, strUrl, strSavePath, strCookie, callback, http_headers, libPath):. if '#' in strUrl:. strUrl = strUrl.split('#')[0]. self.strUrl = strUrl. self.strSavePath = strSavePath. self.strCookie = strCookie. self.callback = callback. dll_path = os.getenv('M3u8DownloaderPath'). if dll_path is None:. debug('Find M3u8Downloader.dll Begin-------------------------------'). import sys. if sys.platform == 'win32':. debug('Find M3u8Downloader.dll Win-----------------------------

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-IA34E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (337)
Category:	dropped
Size (bytes):	32971
Entropy (8bit):	4.40949856818488
Encrypted:	false
SSDEEP:	384:OTELJlJiLVh8/NpY88o/4V+UBYlbettw7tzFHbaF04pbvwONgK8S1Nv4tTGQ4xlU:OwmX8FK88o/4+Hba/D49GjRpS0Jg
MD5:	BE4A3D97510F3AE41A8FC32E25B052BA
SHA1:	D986512B0491BE0B75D890F5AC60661653C12B77
SHA-256:	8982FFAAFED3CAF51ACCA153D81C49A07CF7EA93CA613FA68EEDAD2755726974
SHA-512:	8C33D210BCAEEC439797B4185C32187443D97B682DB48210623407E419539439087E27D2E301725C9E7F20FAA14C30F247C53DC2619BC6DF698F6795AF0D323F
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from __future__ import unicode_literals..import errno.import os.import sys.import socket.import time.import re.import traceback..from .common import FileDownloader.from ..compat import compat_urllib_error.from ..utils import (. ContentTooShortError,. encodeFilename,. sanitize_open,. sanitized_Request,. write_xattr,. XAttrMetadataError,. XAttrUnavailableError,.)..try:. import pycurl.except Exception as e:. print('not surpot curl')..import threading.from .curlDownload import CurlDownloader..g_nodata_maxS = 60...class HttpCurl(FileDownloader):. def __init__(self, ydl, params):. # type: (object, object, object) -> object. FileDownloader.__init__(self, ydl, params). self.resume = True. self.chunk = 5 * 1024 * 1024 # Define the chunk size to be downloaded at once. self.thread_list = []. self.curlDownload_list = []. self.fileSize = 0. self.num_thread = 2.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-M6QIH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14774
Entropy (8bit):	4.391430302306946
Encrypted:	false
SSDEEP:	384:s3OgsgnBx/JSoHw0TvV92rgJk1dSwlxZGbfxVe0o4THAHC9ad83:s3Of2BxhfQ0JfAEb5EiTHAq
MD5:	3E5AF146154A6F0F82B5E0B2A5EE79EF
SHA1:	B26FA29CE08098D31C28FD00C5408CBDA977B376
SHA-256:	BA02AF503100DF6176AEC740020051F428A81CA61CE877971F90A9D48D7725FE
SHA-512:	23B61370D6AC812EA579B50EDED6B5AE16AB7752F3EC8152F209F796E14955482BE0E523651D9380E965DA05164358CFF56516462FFBB059A0287946099AA605
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import division, unicode_literals..import os.import re.import sys.import time.import random..from ..compat import compat_os_name.from ..utils import (. decodeArgument,. encodeFilename,. error_to_compat_str,. format_bytes,. shell_quote,. timeconvert,.)...class FileDownloader(object):. """File Downloader class... File downloader objects are the ones responsible of downloading the. actual video file and writing it to disk... File downloaders accept a lot of parameters. In order not to saturate. the object constructor with arguments, it receives a dictionary of. options instead... Available options:.. verbose: Print additional info to stdout.. quiet: Do not print messages to stdout.. ratelimit: Download speed limit, in bytes/sec.. retries: Number of times to retry for HTTP error 5xx. buffersize: Size of download buffer in bytes.. noresizebuffer: Do not automatica

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-NH3FP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	16837
Entropy (8bit):	4.4919492840691015
Encrypted:	false
SSDEEP:	192:U/leyTFirWJkNxCPkE97Q167OQldNo5WtbC9YqPM+ahu3VrQy4QkuCU:4XirWJkGPrNo5WtbC9YqPM+Tr3tkuCU
MD5:	E38E134F0B3A4655F598E5279DDF025F
SHA1:	B9811B02890F543970F869267A51A96CB5405BA9
SHA-256:	DE385410C092C3F7B374651CA134E46B274EDFDF560E97AF072909063FD8C702
SHA-512:	19A67E13F9ADFD78D456D0D90A01FD843AA924B03FE0820A359942F130C330A4882EB08F73EF7F1BAA6A2AA8A87DF64C50DA43F87E8A9BFD3A49B76C71A569C1
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --.from __future__ import division, unicode_literals..import io.import re.import itertools.import time..from .fragment import FragmentFD.from ..compat import (. compat_b64decode,. compat_etree_fromstring,. compat_urlparse,. compat_urllib_error,. compat_urllib_parse_urlparse,. compat_struct_pack,. compat_struct_unpack,.).from ..utils import (. fix_xml_ampersands,. xpath_text,.)..def _add_ns(prop, ver=1):. return '{http://ns.adobe.com/f4m/%d.0}%s' % (ver, prop)..def get_base_url(manifest):. base_url = xpath_text(. manifest, [_add_ns('baseURL', 1), _add_ns('baseURL', 2)],. 'base URL', default=None). if base_url:. base_url = base_url.strip(). return base_url..class DataTruncatedError(Exception):. pass...class FlvReader(io.BytesIO):. """. Reader for Flv files. The file format is documented in https://www.adobe.com/devnet/f4v.html. """.. def read_bytes(self, n):. da

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-R8NKC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10426
Entropy (8bit):	4.337893592072577
Encrypted:	false
SSDEEP:	192:u7i2qOMVAdWYplYVlOmAVDVsgDJIzgaM0qP0Aph0AnvbkZRCC7e:uQ/nlr4xs+JIzW0qaFM
MD5:	CF2E9F03DF82E5E2A40566F4FDE920DE
SHA1:	623BE5CBA2160C3D7552C0DEA26C56DBFC6C2792
SHA-256:	6C71055C807CA6C512EEA56531A2C1EE864031F52944DFA66A25B0073E50E6C8
SHA-512:	02EEF35B96DD9D4D42E7765659FEF5D06D9C8B48114F58989EDC2280378D8DA92BEBE304B1D805EAE9CF53333D00C68036C43C4114E9DC185A8CF1F6606313DF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import division, unicode_literals..import os.import time.import json..from .common import FileDownloader.from .http import HttpFD.from ..utils import (. error_to_compat_str,. encodeFilename,. sanitize_open,. sanitized_Request,.)...class HttpQuietDownloader(HttpFD):. def to_screen(self, args, *kargs):. pass...class FragmentFD(FileDownloader):. """. A base file downloader class for fragmented media (e.g. f4m/m3u8 manifests)... Available options:.. fragment_retries: Number of times to retry a fragment for HTTP error (DASH. and hlsnative only). skip_unavailable_fragments:. Skip unavailable fragments (DASH and hlsnative only). keep_fragments: Keep downloaded fragments on disk after downloading is. finished.. For each incomplete fragment download youtube-dl keeps on disk a special. bookkeeping file with download state and metadata (in future such files wi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-RM9AI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	4.338784178558187
Encrypted:	false
SSDEEP:	24:GacQ8lxOcuzwM2zT6Xhwwdn74GWGo4K4RLGS:DfuxOctTzT2Gw9s4RLGS
MD5:	99739767A6689E204DC1C2EEA06E5E97
SHA1:	A9C296D432142EF252E32774FAF69E8FABF6E5C4
SHA-256:	BD500995A859431B097323687FC5199B4DCCBADA4B16ADE82E297D4E8602A0C4
SHA-512:	B5A8EDFDB4C28435573DA16BF986CCCA2B15CEACB4DFBBE7F2EFC900A0C924EE4030A49C62239232D9071A0111DC9A42866D4280D00D6EE29247996C22CB7FD0
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8.# ......from __future__ import unicode_literals..import sys.import threading.if sys.version_info >= (3, 0):. from urllib.request import urlopen.else:. from urllib2 import urlopen.from ..utilsEX import debug.from .http import HttpFD..class HttpHB(HttpFD):. def real_download(self, filename, info_dict):. result = False. if 'heartbeat_url'in info_dict:. def heart_beat():. try:. urlopen(url=info_dict['heartbeat_url'], data=info_dict['heartbeat_data']). debug('........................................heart beat!'). except Exception as ex:. debug('........................................heart beat fail: ' + ex.message). pass.. if not result:. timer = threading.Timer(25, heart_beat). timer.start().. heart_beat().. result = super(HttpHB, self).real_download(filen

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-TR741.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1559
Entropy (8bit):	4.3771936801884905
Encrypted:	false
SSDEEP:	24:1R8lWrvAOztKhwx5f65dXSwLqcHT+LBwLwHS/BHBlmnEOdUOF8Y8ZsFCXPnqP:PuZGx5fGdXrqzIDOdULjZsMCP
MD5:	04767C7524AA6EB16F666CB6664E23C7
SHA1:	663662230C272C1C7CCF31BDEE6AF6D76339FD73
SHA-256:	4DFA357D3964F4F2104483F08D615263A0F55F74DD2A681491BE3DFDA3AB81F7
SHA-512:	6D607E521E165433097B76DA0BB4DBF965DB9D0A52C475A12A9A414C0A224646904E525AE6D9AA88A5FE47003D2F02C35218039EDC423F75CA3D01266D555718
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os.import subprocess..from .common import FileDownloader.from ..utils import (. check_executable,. encodeFilename,.)...class RtspFD(FileDownloader):. def real_download(self, filename, info_dict):. url = info_dict['url']. self.report_destination(filename). tmpfilename = self.temp_name(filename).. if check_executable('mplayer', ['-h']):. args = [. 'mplayer', '-really-quiet', '-vo', 'null', '-vc', 'dummy',. '-dumpstream', '-dumpfile', tmpfilename, url]. elif check_executable('mpv', ['-h']):. args = [. 'mpv', '-really-quiet', '--vo=null', '--stream-dump=' + tmpfilename, url]. else:. self.report_error('MMS or RTSP download detected but neither "mplayer" nor "mpv" could be run. Please install any.'). return False.. self._debug_cmd(args).. retval = subprocess.call(args). if retval == 0:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\is-UGK34.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10130
Entropy (8bit):	4.633577760043911
Encrypted:	false
SSDEEP:	192:5Vke14LjkDWbwy+1hP2mXjcim+nCRfunWU2W105hA:Sau+CRe105+
MD5:	46FDE20D5C9B45E721C94406D0CC9AEA
SHA1:	FF4F7214009DC7544531207A75E9E14C2918A12D
SHA-256:	33708FF64CDEA0F76B2E4842156E19FE9D38C0F6553A0E51D5C4CA39BDA8FAEF
SHA-512:	73B33FE03825D5A709903AB6C1742347573A5FBD4805DF014259CDC96D5E946BF07A6F43B45926F77A9E76C9AB0DEEF9332C670617973922BF23E9478589B3FB
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..import os, sys.import threading.import time.import math.import traceback..try:. import pycurl.except Exception as e:. print('not surpot curl')...class CurlDownloader:. def __init__(self, target_address):. # Set variables of the downloader ########. '''. :type target_address: object. '''. self.output_file = '' # Downloaded file is stored here. self.fileName = ''. self.targetURL = target_address. self.curl_obj = ''. self.fp = None. self.resumdataerror = False. self.downloadbyte = 0. self.resumSize = 0. self.rang_start = 0. self.rang_end = sys.maxsize. self.checkResum = False. self.checkResumSize = 16. self.clientError = False. self.isFinish = False. self.stop = False. self.errorCode = 0. self.initCurl().. def initCurl(self):. self.curl_obj = pycurl.Curl(). self.curl_obj.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\ism.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10565
Entropy (8bit):	4.8277227147741675
Encrypted:	false
SSDEEP:	96:+kO3ue2yEPPAk96aovhz+Wg2ymfZ9aBroS0Ttxd2hF7eF9KXYwmZOFP43hJVsE6C:+kkunyE6ZMLO0I5JqIx51a9E39uEoq
MD5:	D97D94BE0E790E809FCF16FB555315B0
SHA1:	2E39D81E16C442D6DDF63B871DA82231A424C846
SHA-256:	5BE5146D1AEE33AA25961C9063F513AE6DCFED11719FE8E237C86E9AD7191013
SHA-512:	6ECFC6117D4A4BBD53DE322402B0E75A52A3241816BFDC7DE638F10FCB1825B755CAED8956BF6041D064574864DF70DAE6E6FD50C66389E883DBC1A068D36A8D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import time.import binascii.import io..from .fragment import FragmentFD.from ..compat import (. compat_Struct,. compat_urllib_error,.)...u8 = compat_Struct('>B').u88 = compat_Struct('>Bx').u16 = compat_Struct('>H').u1616 = compat_Struct('>Hxx').u32 = compat_Struct('>I').u64 = compat_Struct('>Q')..s88 = compat_Struct('>bx').s16 = compat_Struct('>h').s1616 = compat_Struct('>hxx').s32 = compat_Struct('>i')..unity_matrix = (s32.pack(0x10000) + s32.pack(0) * 3) * 2 + s32.pack(0x40000000)..TRACK_ENABLED = 0x1.TRACK_IN_MOVIE = 0x2.TRACK_IN_PREVIEW = 0x4..SELF_CONTAINED = 0x1...def box(box_type, payload):. return u32.pack(8 + len(payload)) + box_type + payload...def full_box(box_type, version, flags, payload):. return box(box_type, u8.pack(version) + u32.pack(flags)[1:] + payload)...def write_piff_header(stream, params):. track_id = params['track_id']. fourcc = params['fourcc']. duration = params['duration']. timescale = params.g

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\rtmp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10077
Entropy (8bit):	4.165085577035063
Encrypted:	false
SSDEEP:	96:b/N6qOmdXquW529d7sCJsTzc8eyBGCaJmV5ekT0TLWJI9YxD8UeqFrjZKBMwyZuK:bMqOuXjZbYJI+FrgBc5tHV8Rk0VyfWSH
MD5:	E4345648115F4BAF3A492FDCFCF3F7EB
SHA1:	C245103EF597E396E19551342D7242D1946806FF
SHA-256:	D597A6EA26CD66B813151DC3482DE7CC746B9E845E1D229C5A80FB4520E1EDAA
SHA-512:	99F7F40DFB5570744BB5470810B13E5B22F5172CC3E444E0A87FE94494357DEDE12525CD2E61B7F93E1D85F35755CD4804B82E3E272B0C7B5409B83EFB6A35D0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os.import re.import sys.import traceback.import subprocess.import time..from .common import FileDownloader.from ..compat import compat_str.from ..utils import (. check_executable,. encodeFilename,. encodeArgument,. get_exe_version,.)...def rtmpdump_version():. return ''. # return get_exe_version(. # 'rtmpdump', ['--help'], r'(?i)RTMPDump\s*v?([0-9a-zA-Z._-]+)')..def getStartInfo():. IS_WIN32 = 'win32' in str(sys.platform).lower(). if IS_WIN32:. startupinfo = subprocess.STARTUPINFO(). startupinfo.dwFlags = subprocess.CREATE_NEW_CONSOLE \| subprocess.STARTF_USESHOWWINDOW. startupinfo.wShowWindow = subprocess.SW_HIDE. return startupinfo. else:. return None..class RtmpFD(FileDownloader):. def getRTMPLocation(self):. import sys. if sys.platform == 'win32':. return r'DownloadRes\rtmpdump.exe' if os.path.exists(r'DownloadRes\rtmpdump.exe') else 'rtmpd

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\downloader\rtsp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1559
Entropy (8bit):	4.3771936801884905
Encrypted:	false
SSDEEP:	24:1R8lWrvAOztKhwx5f65dXSwLqcHT+LBwLwHS/BHBlmnEOdUOF8Y8ZsFCXPnqP:PuZGx5fGdXrqzIDOdULjZsMCP
MD5:	04767C7524AA6EB16F666CB6664E23C7
SHA1:	663662230C272C1C7CCF31BDEE6AF6D76339FD73
SHA-256:	4DFA357D3964F4F2104483F08D615263A0F55F74DD2A681491BE3DFDA3AB81F7
SHA-512:	6D607E521E165433097B76DA0BB4DBF965DB9D0A52C475A12A9A414C0A224646904E525AE6D9AA88A5FE47003D2F02C35218039EDC423F75CA3D01266D555718
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os.import subprocess..from .common import FileDownloader.from ..utils import (. check_executable,. encodeFilename,.)...class RtspFD(FileDownloader):. def real_download(self, filename, info_dict):. url = info_dict['url']. self.report_destination(filename). tmpfilename = self.temp_name(filename).. if check_executable('mplayer', ['-h']):. args = [. 'mplayer', '-really-quiet', '-vo', 'null', '-vc', 'dummy',. '-dumpstream', '-dumpfile', tmpfilename, url]. elif check_executable('mpv', ['-h']):. args = [. 'mpv', '-really-quiet', '--vo=null', '--stream-dump=' + tmpfilename, url]. else:. self.report_error('MMS or RTSP download detected but neither "mplayer" nor "mpv" could be run. Please install any.'). return False.. self._debug_cmd(args).. retval = subprocess.call(args). if retval == 0:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\abc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7543
Entropy (8bit):	4.801142161586214
Encrypted:	false
SSDEEP:	192:5kHpd7WluTRPzedqSBHjdyLx/CEKT96NbRMTtA1ij49Rc7qLd8t+UUYTCl6N4:5kHpd6QdzeoKS6T96NbR6tE2WK7qLd8w
MD5:	C425A499922ECC1EE7A715D24474EEFD
SHA1:	E77B2FABF793E8AEAC573911EFBC82D9E058017C
SHA-256:	32EEF9675CFE17C27903B85C5BC461543BC3D00ADB88F9B2020582F0E978542C
SHA-512:	C8B6C368F8E65BED118DAD5C7FA7094E8713F7B17165A3B1D93B1B4BE7B5CF69109ED5F58B8ACEDCD34CFEB115F9DCEA43C63914E348DBB26D2B59C39A358072
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import hashlib.import hmac.import re.import time..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. js_to_json,. int_or_none,. parse_iso8601,. try_get,. unescapeHTML,. update_url_query,.)...class ABCIE(InfoExtractor):. IE_NAME = 'abc.net.au'. _VALID_URL = r'https?://(?:www\.)?abc\.net\.au/news/(?:[^/]+/){1,2}(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.abc.net.au/news/2014-11-05/australia-to-staff-ebola-treatment-centre-in-sierra-leone/5868334',. 'md5': 'cb3dd03b18455a661071ee1e28344d9f',. 'info_dict': {. 'id': '5868334',. 'ext': 'mp4',. 'title': 'Australia to help staff Ebola treatment centre in Sierra Leone',. 'description': 'md5:809ad29c67a05f54eb41f2a105693a67',. },. 'skip': 'this video has expired',. }, {. 'url': 'http://www.abc.net.au/news/2015-08-17/warren-entsch-i

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\abcnews.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5437
Entropy (8bit):	4.700206363328471
Encrypted:	false
SSDEEP:	96:nG4WQCqpHr2XdrESwBfbMdc9/Zb3XBljqKQljpsyyrr7qzQVfbyuFzFymWVtvEOb:G4ESJSIbMds/djqKAjUqsVbyeEmwz
MD5:	75AE165C45B87ED083ED23BCC5798174
SHA1:	CDEFE1619D795607A5DC13368B34AE26E291FBCF
SHA-256:	DCF93FEA587FD897FCFCE79146B79F243CA7CFBFAB3696141220C6EEC205224D
SHA-512:	07769119DF8ADABED33459AF74EA9AC14B7611B37A00C9807AD24B104DED1EE0F3714A8D2379872666D3B9FA9379DB11B05E06CAF9A20078AAF60D8FC9489DA2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import calendar.import re.import time..from .amp import AMPIE.from .common import InfoExtractor.from .youtube import YoutubeIE.from ..compat import compat_urlparse...class AbcNewsVideoIE(AMPIE):. IE_NAME = 'abcnews:video'. _VALID_URL = r'''(?x). https?://. (?:. abcnews\.go\.com/. (?:. [^/]+/video/(?P<display_id>[0-9a-z-]+)-\|. video/embed\?.*?\bid=. )\|. fivethirtyeight\.abcnews\.go\.com/video/embed/\d+/. ). (?P<id>\d+). '''.. _TESTS = [{. 'url': 'http://abcnews.go.com/ThisWeek/video/week-exclusive-irans-foreign-minister-zarif-20411932',. 'info_dict': {. 'id': '20411932',. 'ext': 'mp4',. 'display_id': 'we

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\abcotvs.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3903
Entropy (8bit):	4.774902913940402
Encrypted:	false
SSDEEP:	96:GxlG74VbXv8p7ulGIjYdIBTY8S6vgtq6N1tonydndMDsjdYrVdKLdGJBTKxFNN3L:G+MV4MlGIcdITJB6N1toydndMA4dKLdl
MD5:	C7A5D0E98D234ECF932BF4D19248D3B0
SHA1:	0522ED6241F40FD68B926992B685F23C1870808C
SHA-256:	FAF9527859763A6F778A8A88127AA813109C71BC6D403EE0090FBA4007CC1BEB
SHA-512:	A6E7EBBD99D75E3B1BD6C8A76DE4F868837083D1AA2E8FC2DE7C80443F89C893766F88ABEAC849316FA79832E872150EE3C7F648F7E3FC95AD064D78081876CF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class ABCOTVSIE(InfoExtractor):. IE_NAME = 'abcotvs'. IE_DESC = 'ABC Owned Television Stations'. _VALID_URL = r'https?://(?:abc(?:7(?:news\|ny\|chicago)?\|11\|13\|30)\|6abc)\.com(?:/[^/]+/(?P<display_id>[^/]+))?/(?P<id>\d+)'. _TESTS = [. {. 'url': 'http://abc7news.com/entertainment/east-bay-museum-celebrates-vintage-synthesizers/472581/',. 'info_dict': {. 'id': '472581',. 'display_id': 'east-bay-museum-celebrates-vintage-synthesizers',. 'ext': 'mp4',. 'title': 'East Bay museum celebrates vintage synthesizers',. 'description': 'md5:24ed2bd527096ec2a5c67b9d5a9005f3',. 'thumbnail': r're:^https?://.*\.jpg$',. 'timestamp': 1421123075,. 'upload_date': '20150113',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\academicearth.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	4.698536725147762
Encrypted:	false
SSDEEP:	24:1R8lzvRdG/hwqWN/53lSthGVWtr3OZXh0YXfCXVOnxAYpJB08hZQlLSX:PuvihnWVKagr3OZXh0YXfCXVQNvP/X
MD5:	BC347166E36E39871256368D76FE00A6
SHA1:	CC2DD207BF194C4A1A0D04FD03453C8F582975A2
SHA-256:	C07633C8A8A2273291CC4DBC75B007E0D7628D4B93B6CD3A050FF4D0A17C91C5
SHA-512:	5395225E3DE6BC09301F040D9A8B4AD897D98CFB89E40712021AF9E45F90DCA011968E3FE99672AFDDE4252A4C8AAF10B9F0BDF88957A9216F50110D0E38E460
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor...class AcademicEarthCourseIE(InfoExtractor):. _VALID_URL = r'^https?://(?:www\.)?academicearth\.org/playlists/(?P<id>[^?#/]+)'. IE_NAME = 'AcademicEarth:Course'. _TEST = {. 'url': 'http://academicearth.org/playlists/laws-of-nature/',. 'info_dict': {. 'id': 'laws-of-nature',. 'title': 'Laws of Nature',. 'description': 'Introduce yourself to the laws of nature with these free online college lectures from Yale, Harvard, and MIT.',. },. 'playlist_count': 3,. }.. def _real_extract(self, url):. playlist_id = self._match_id(url).. webpage = self._download_webpage(url, playlist_id). title = self._html_search_regex(. r'<h1 class="playlist-name"[^>]?>(.?)</h1>', webpage, 'title'). description = self._html_search_regex(. r'<p class="excerpt"[^>]?>(.?)</p>',. webpage, 'desc

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\acast.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5250
Entropy (8bit):	4.73514617157872
Encrypted:	false
SSDEEP:	96:8vOTpTnnwt45fAvt0eQffQLG3rm1tdfUN/KETTZ7gtD0QIGwAysbnKbK1vv:hTpbwtYIvt0eQ3QLArwUTZ7vgwhQKbKl
MD5:	94FC7A04F300AD8BECBEBE0FE703E9B8
SHA1:	FCF38BD20F5F3897F917A47686E0D3C9DFB85253
SHA-256:	93523A3325BDCFBB3DFEAE8F8E088920CEC55BC9C6CABA890E08431AF9C48937
SHA-512:	AF15A60DE8412AA90EAB2D57087745BE0283F10D54BC068BE5727BEA460DAF5A9F77D0BE37B3F5CE321B2559C77B12BA9CA6BA6DC4AB7FC84D6439CB326F6AAD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import functools..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. clean_html,. float_or_none,. int_or_none,. try_get,. unified_timestamp,. OnDemandPagedList,.)...class ACastIE(InfoExtractor):. IE_NAME = 'acast'. _VALID_URL = r'''(?x). https?://. (?:. (?:(?:embed\|www)\.)?acast\.com/\|. play\.acast\.com/s/. ). (?P<channel>[^/]+)/(?P<id>[^/#?]+). '''. _TESTS = [{. 'url': 'https://www.acast.com/sparpodcast/2.raggarmordet-rosterurdetforflutna',. 'md5': '16d936099ec5ca2d5869e3a813ee8dc4',. 'info_dict': {. 'id': '2a92b283-1a75-4ad8-8396-499c641de0d9',. 'ext': 'mp3',. 'title': '2. Raggarmordet - R.ster ur det f.rflutna',. 'description': '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\addanime.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	4.571161613799875
Encrypted:	false
SSDEEP:	96:lQmo7zLTDfRmP1BoPACU6/+RZG2oBTA6NO:ZUHTDRmPAPACU6/+rzoTA6NO
MD5:	336B55A5EAF3D0E5D7A7930977497CF9
SHA1:	1CE3BDF3A0420B9106F7A3462C81068906FB5FCF
SHA-256:	2891EE0E3B511E502FB528DA104236CA107C992CB7F69E68C115C0EBB6D67279
SHA-512:	3EC738B93E2DF19EA96FFA45A5AA313DE9E8875DDDCFAE686D96FA092E5453649C14F37698DEC44876B82688FB339AF822E39ECF8D58A97939C1D6D5278ABDF1
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,. compat_urllib_parse_urlencode,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. qualities,.)...class AddAnimeIE(InfoExtractor):. _VALID_URL = r'https?://(?:\w+\.)?add-anime\.net/(?:watch_video\.php\?(?:.*?)v=\|video/)(?P<id>[\w_]+)'. _TESTS = [{. 'url': 'http://www.add-anime.net/watch_video.php?v=24MR3YO5SAS9',. 'md5': '72954ea10bc979ab5e2eb288b21425a0',. 'info_dict': {. 'id': '24MR3YO5SAS9',. 'ext': 'mp4',. 'description': 'One Piece 606',. 'title': 'One Piece 606',. },. 'skip': 'Video is gone',. }, {. 'url': 'http://add-anime.net/video/MDUGWYKNGBD8/One-Piece-687',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. try:. webpage = se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\adn.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8735
Entropy (8bit):	4.738155974179003
Encrypted:	false
SSDEEP:	192:1cXNiplhQSmH5NiF7qKOafxlNzwTl70yXodFb2z4FTa36N0s:14cQS8ziF+KOafxlNwTP4dFb2z4FTa3W
MD5:	48879161E7F00CA7D4E03F23A220E26F
SHA1:	BC8E6F09036E77CC69A6F6C53987C8D2EB1E1535
SHA-256:	A764FC8D843202C5546F76BACD1AAAE04D583A2622EDA7A528576ABC80020A94
SHA-512:	E5B2385323059DF8066ACE6B004786BBB3D963ABC78A1B04DF3E1915E472FF798DC0E8C92F35B9EBDCEC30C01B4E8E52D1650B5B81A10BC107941B32D09C361B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import binascii.import json.import os.import random..from .common import InfoExtractor.from ..aes import aes_cbc_decrypt.from ..compat import (. compat_b64decode,. compat_ord,.).from ..utils import (. bytes_to_intlist,. bytes_to_long,. ExtractorError,. float_or_none,. intlist_to_bytes,. long_to_bytes,. pkcs1pad,. strip_or_none,. urljoin,.)...class ADNIE(InfoExtractor):. IE_DESC = 'Anime Digital Network'. _VALID_URL = r'https?://(?:www\.)?animedigitalnetwork\.fr/video/[^/]+/(?P<id>\d+)'. _TEST = {. 'url': 'http://animedigitalnetwork.fr/video/blue-exorcist-kyoto-saga/7778-episode-1-debut-des-hostilites',. 'md5': 'e497370d847fd79d9d4c74be55575c7a',. 'info_dict': {. 'id': '7778',. 'ext': 'mp4',. 'title': 'Blue Exorcist - Ky.to Saga - .pisode 1',. 'description': 'md5:2f7b5aa76edbc1a7a92cedcda8a528d5',. }.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\adobeconnect.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1348
Entropy (8bit):	4.6694618292225565
Encrypted:	false
SSDEEP:	24:zi8lFvVSMeIXjlgtbXnEBPYMriHUMhLr7jgkKNusHhKtVal3W6Kw2f:+uPSMjXjlkbXnEBPdmHUY7j7gbHhY0WD
MD5:	7CD924C578035D418D419EF9C6C5901A
SHA1:	163136A52F9AB9846F842A15C97E0BCF980BB3C2
SHA-256:	186BC339507807F094E4011D9D9D0C183ECB7A2ECD55215410CF6E96B603764F
SHA-512:	5C9C227DFA780902944A7986068DA32CE41CF5A431C693DDD54E45852A827A3BA029371EF346A699EEF71E99B72278900A27DD486A3F12D97D4F9CC782FB0BDC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urlparse,.)...class AdobeConnectIE(InfoExtractor):. _VALID_URL = r'https?://\w+\.adobeconnect\.com/(?P<id>[\w-]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). title = self._html_search_regex(r'<title>(.+?)</title>', webpage, 'title'). qs = compat_parse_qs(self._search_regex(r"swfUrl\s=\s'([^']+)'", webpage, 'swf url').split('?')[1]). is_live = qs.get('isLive', ['false'])[0] == 'true'. formats = []. for con_string in qs['conStrings'][0].split(','):. formats.append({. 'format_id': con_string.split('://')[0],. 'app': compat_urlparse.quote('?' + con_string.split('?')[1] + 'flvplayerapp/' + qs['appInstance'][0]),. 'ext': 'flv',. 'play_path': 'mp4:' + qs

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\adobepass.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	41407
Entropy (8bit):	4.388469200381338
Encrypted:	false
SSDEEP:	384:f6nN2nGx8fNhcDZ6hHae6De+FNcLKBcLuDnykAFPvqoD11BXLswPURj:SNIGxWNhcDcHae0ZcLuYFXq6BXLsw8Rj
MD5:	FCA5A653DCF1BDE0273007615E655B8B
SHA1:	78577951DF507F01F35B5460E69134D23CA97ECF
SHA-256:	3E103B7D03ACB1F0AAC3D2B23A9CEA02663AFF37D9086932C188ED31DAFD451A
SHA-512:	9682290F5A8800F9E67731C1952FACB54F9EC61AD0BC756E178E1D242CF2128F71B120C3FFF2DD82233C58F84BAB990F29E7476DDCFF755957422EE5B04C4726
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time.import xml.etree.ElementTree as etree..from .common import InfoExtractor.from ..compat import (. compat_kwargs,. compat_urlparse,.).from ..utils import (. unescapeHTML,. urlencode_postdata,. unified_timestamp,. ExtractorError,. NO_DEFAULT,.)...MSO_INFO = {. 'DTV': {. 'name': 'DIRECTV',. 'username_field': 'username',. 'password_field': 'password',. },. 'ATT': {. 'name': 'AT&T U-verse',. 'username_field': 'userid',. 'password_field': 'password',. },. 'ATTOTT': {. 'name': 'DIRECTV NOW',. 'username_field': 'email',. 'password_field': 'loginpassword',. },. 'Rogers': {. 'name': 'Rogers',. 'username_field': 'UserName',. 'password_field': 'UserPassword',. },. 'Comcast_SSO': {. 'name': 'Comcast XFINITY',. 'username_field': 'user',. 'password_field': 'passwd',. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\adobetv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7359
Entropy (8bit):	4.863821217071368
Encrypted:	false
SSDEEP:	192:Q+mOiJSrwToQLjt6NRMQI0UD9IdanAxhmua0U3IoEqKijTJfOF6NHQZZ:Npi0wTVp6NRMa7Wc3aNIo3KijTZC6NIZ
MD5:	55E262EFD2F2981E5F21EE876810DBA6
SHA1:	9690C94E4040FD316028C158DD778B7ECFA4ACB9
SHA-256:	F7AA277ED164D4CB0D14528E498AFECA0A79FEB80C2391F936581D3C3E523FA7
SHA-512:	03E03EB5AB443A5EAA81F2E11BAE9A430405DD847296449B65D290EB7FA21207805D3B0B8658C4B19E5CAD76455B561BC4845A69FB1CE0EEBE26A421DDB4F60E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. parse_duration,. unified_strdate,. str_to_int,. int_or_none,. float_or_none,. ISO639Utils,. determine_ext,.)...class AdobeTVBaseIE(InfoExtractor):. _API_BASE_URL = 'http://tv.adobe.com/api/v4/'...class AdobeTVIE(AdobeTVBaseIE):. _VALID_URL = r'https?://tv\.adobe\.com/(?:(?P<language>fr\|de\|es\|jp)/)?watch/(?P<show_urlname>[^/]+)/(?P<id>[^/]+)'.. _TEST = {. 'url': 'http://tv.adobe.com/watch/the-complete-picture-with-julieanne-kost/quick-tip-how-to-draw-a-circle-around-an-object-in-photoshop/',. 'md5': '9bc5727bcdd55251f35ad311ca74fa1e',. 'info_dict': {. 'id': '10981',. 'ext': 'mp4',. 'title': 'Quick Tip - How to Draw a Circle Around an Object in Photoshop',. 'description': 'md5:99ec318dc909d7ba2a1f2b038f7d2311',. 'thumbnail': r're:https?://.*\.jp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\adultswim.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7849
Entropy (8bit):	4.566428662140297
Encrypted:	false
SSDEEP:	192:K+xyIQldcsV/RRU/lesD2aofurLfhi+T2XbxJsuD:NxyIQldcsVpRU/LMf+Zi+T2XbxJdD
MD5:	6B3C3CD42B89641B275ABBE0A9BEB3BC
SHA1:	F01DC2542E356AE7B8E7D8F115D05E84E80E93A4
SHA-256:	16024A7F086BD3FDD16732C2F53A888D3E75AC7C32D06BF68A40E277554D0A20
SHA-512:	90928CA93E8997F7FBFFE44F2F27BF89C4D746B049A2BA67592523F95CE037B9B6A195BF2EB239A72A8C89EF29BCFD082D0D621DE8555537386A485627200D1E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .turner import TurnerBaseIE.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. mimetype2ext,. parse_age_limit,. parse_iso8601,. strip_or_none,. try_get,.)...class AdultSwimIE(TurnerBaseIE):. _VALID_URL = r'https?://(?:www\.)?adultswim\.com/videos/(?P<show_path>[^/?#]+)(?:/(?P<episode_path>[^/?#]+))?'.. _TESTS = [{. 'url': 'http://adultswim.com/videos/rick-and-morty/pilot',. 'info_dict': {. 'id': 'rQxZvXQ4ROaSOqq-or2Mow',. 'ext': 'mp4',. 'title': 'Rick and Morty - Pilot',. 'description': 'Rick moves in with his daughter\'s family and establishes himself as a bad influence on his grandson, Morty.',. 'timestamp': 1543294800,. 'upload_date': '20181127',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'expected_warnin

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\aenetworks.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9916
Entropy (8bit):	4.700465523303083
Encrypted:	false
SSDEEP:	192:boxKHNEujtT26NfeJfIVdttA8SdEDM79gahznIxrc9VvTie9cG4GJDdvM6JsOWO:bCKHNEitT26NmNIVdtK8AEDS9g6znIOr
MD5:	BA132B33C78F8FBE7B2233E50667E27D
SHA1:	63369CDAF7EFE5D005B62BD7EC3B7D4267E16BD0
SHA-256:	A5D3DB6198ABC07ACA318EC1B90B95903244AE42A7B631D16239661D1E10624B
SHA-512:	86D5453078A3F410FEAD2A8631123E9F680804F424631C766D9E5955F4ACD7689E82E3CF32A6AF5264887B318EB2A55C60080563BC11E0E738ED3951D6793D9F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .theplatform import ThePlatformIE.from ..utils import (. extract_attributes,. ExtractorError,. int_or_none,. smuggle_url,. update_url_query,.).from ..compat import (. compat_urlparse,.)...class AENetworksBaseIE(ThePlatformIE):. _THEPLATFORM_KEY = 'crazyjava'. _THEPLATFORM_SECRET = 's3cr3t'.. def _extract_aen_smil(self, smil_url, video_id, auth=None):. query = {'mbr': 'true'}. if auth:. query['auth'] = auth. TP_SMIL_QUERY = [{. 'assetTypes': 'high_video_ak',. 'switch': 'hls_high_ak'. }, {. 'assetTypes': 'high_video_s3'. }, {. 'assetTypes': 'high_video_s3',. 'switch': 'hls_ingest_fastly'. }]. formats = []. subtitles = {}. last_e = None. for q in TP_SMIL_QUERY:. q.update(query). m_url = update_url_query(smil_url, q). m_url =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\afreecatv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	14570
Entropy (8bit):	4.681179037375776
Encrypted:	false
SSDEEP:	384:HKjP/8RWBXKOE1N37hWFnYwTw4GTivM1nSwKb0JNFdGosETJ6NaKR18G:t1nyMEb0JNFdGosETJ8aKR1x
MD5:	C68CA08A6A867C3B9984B445550A72C9
SHA1:	72273016463EC65FAE618DF8D457F301EA157EC1
SHA-256:	42AABBCC468786991CA63881601AF9857A818B99AE011B91F2AA972373551D81
SHA-512:	5636ED388653D428FD860F152CC646C8B05C2CF656F383572AF223B15FACADD9DBA25C84CF23634491A7F0A8DE0B5BC612DA5E00FBF5C0C8F347A24C7CDB0298
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_xpath.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. url_or_none,. urlencode_postdata,. xpath_text,.)...class AfreecaTVIE(InfoExtractor):. IE_NAME = 'afreecatv'. IE_DESC = 'afreecatv.com'. _VALID_URL = r'''(?x). https?://. (?:. (?:(?:live\|afbbs\|www)\.)?afreeca(?:tv)?\.com(?::\d+)?. (?:. /app/(?:index\|read_ucc_bbs)\.cgi\|. /player/[Pp]layer\.(?:swf\|html). )\?.*?\bnTitleNo=\|. vod\.afreecatv\.com/PLAYER/STATION/. ). (?P<id>\d+). '''. _NETRC_MACHINE = 'afreecatv'. _TESTS = [{. 'url': 'http://live.afreecatv.com:8079/app/index.cgi?

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\airmozilla.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2697
Entropy (8bit):	4.810687115253343
Encrypted:	false
SSDEEP:	48:+u2ZWb2slR8aFggwcv9EBx9STeaJoXjlhwXlaaywUuzcKM2tZnXRrKmTXRI08cHx:4WbblR8aFwcv9kx9STeaJsUP6dKD9pKU
MD5:	42C797C2492E625943351358F0C7025E
SHA1:	B9F53EA003E5EACDA2A3C6BBF1CA291056FCF6EB
SHA-256:	CB231A0D7B75356F6F2E752E2D7A641525CA1556571F625752336995DB54734C
SHA-512:	F27DBB40F8314631E9D597FBB76226936A7F57909EFF14ED7B63EC57E9A1F4DF89D7F53B9BD26AACA0DD8173C176842350FBE264C9BFD38C617A8718647D7414
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. parse_iso8601,.)...class AirMozillaIE(InfoExtractor):. _VALID_URL = r'https?://air\.mozilla\.org/(?P<id>[0-9a-z-]+)/?'. _TEST = {. 'url': 'https://air.mozilla.org/privacy-lab-a-meetup-for-privacy-minded-people-in-san-francisco/',. 'md5': '8d02f53ee39cf006009180e21df1f3ba',. 'info_dict': {. 'id': '6x4q2w',. 'ext': 'mp4',. 'title': 'Privacy Lab - a meetup for privacy minded people in San Francisco',. 'thumbnail': r're:https?://.*/poster\.jpg',. 'description': 'Brings together privacy professionals and others interested in privacy at for-profits, non-profits, and NGOs in an effort to contribute to the state of the ecosystem...',. 'timestamp': 1422487800,. 'upload_date': '20150128',. 'location': 'SFO Commons',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\aliexpress.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	4.723860897619375
Encrypted:	false
SSDEEP:	48:+uuXLbdqaS3jXhkzuXHiJyAgqGB/+kkDABAvs6Ng:6XLbdqaS3asiQ3dx+kQABAvs6Ng
MD5:	686E254CD7C68CCAA6373400EA18BA40
SHA1:	0BDE89504D50C96D56F7C7045295543E53238644
SHA-256:	F7767D9255B3C8981F209B8345C33080DB35DA4C703B640D131AC85C6DE72B70
SHA-512:	4F1722FEF7EB277FD7A717ECF7447BFDB6FC21C879AF6DA04D14879C9D82102CCE944F9A509F878D0C05388B225CA5F97076B9B1454E2ADC8483A5A4149B2FAC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. float_or_none,. try_get,.)...class AliExpressLiveIE(InfoExtractor):. _VALID_URL = r'https?://live\.aliexpress\.com/live/(?P<id>\d+)'. _TEST = {. 'url': 'https://live.aliexpress.com/live/2800002704436634',. 'md5': 'e729e25d47c5e557f2630eaf99b740a5',. 'info_dict': {. 'id': '2800002704436634',. 'ext': 'mp4',. 'title': 'CASIMA7.22',. 'thumbnail': r're:http://.\.jpg',. 'uploader': 'CASIMA Official Store',. 'timestamp': 1500717600,. 'upload_date': '20170722',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. data = self._parse_json(. self._search_regex(. r'(?s)runParams\s=\s({.+?})\s;?\s*var',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\aljazeera.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.174414913724853
Encrypted:	false
SSDEEP:	24:1R8lFv8GrdXuzqfwFXjzoT/5rdltYps8OF7Ki/fzy6U3ZzVzyWVfLPwFXVIYwVLV:PuGGdXu2f+XjzoLpKs8OH/f8zy4r+XI5
MD5:	A749B00970FC9B2DD7AF1B38FEB04F9A
SHA1:	9D603548770AFDBA3A1CF1218FF0FEBCB47F50F5
SHA-256:	CCB7D0173BDB3FABA2B20EF0CAFBF4B1C96076DF4703230C3D7BB5F31A1A840A
SHA-512:	BAEAFA5D995C5F9540A6779B17624D431DB26008A0DAF8F8AA8C2DE06ED8EBAFF5924CFC1EA3414E0FBEF74B7D8D0A2134B9AADD63F349495B8EF8C780262BB5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class AlJazeeraIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?aljazeera\.com/(?:programmes\|video)/.*?/(?P<id>[^/]+)\.html'.. _TESTS = [{. 'url': 'http://www.aljazeera.com/programmes/the-slum/2014/08/deliverance-201482883754237240.html',. 'info_dict': {. 'id': '3792260579001',. 'ext': 'mp4',. 'title': 'The Slum - Episode 1: Deliverance',. 'description': 'As a birth attendant advocating for family planning, Remy is on the frontline of Tondo\'s battle with overcrowding.',. 'uploader_id': '665003303001',. 'timestamp': 1411116829,. 'upload_date': '20140919',. },. 'add_ie': ['BrightcoveNew'],. 'skip': 'Not accessible from Travis CI server',. }, {. 'url': 'http://www.aljazeera.com/video/news/2017/05/sierra-leone-709-carat-diamond-auctioned-170511100111930.html',. 'only_matching

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\allocine.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4962
Entropy (8bit):	4.617802174458065
Encrypted:	false
SSDEEP:	96:NU7GOoa7YLZNCH8gyaaJNZm2mJNm8BP+OZZkfJa8daL65Nlx6wpkEaL1BTgs8x6u:NURz7kd/sNSiWOZsJa8ULypyLLTYx6Ng
MD5:	54A6535CB6E378D68D915B442334EB84
SHA1:	684C3C39A5F31F231DDCF23564D0809CF2400DA3
SHA-256:	2E8E64B592D9D0C9DF32D97F74E4CF8FD526C863957C7662C7B44B3F2232828D
SHA-512:	D2321D5D40C0DF5FF164263299A4692D410123C4F52531E05B764351C018EAF8286F2D1A723EAA3072448D2DBA97B91775E49921CB6C76BAF78E8952312BB301
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. qualities,. remove_end,. try_get,. unified_timestamp,. url_basename,.)...class AllocineIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?allocine\.fr/(?:article\|video\|film)/(?:fichearticle_gen_carticle=\|player_gen_cmedia=\|fichefilm_gen_cfilm=\|video-)(?P<id>[0-9]+)(?:\.html)?'.. _TESTS = [{. 'url': 'http://www.allocine.fr/article/fichearticle_gen_carticle=18635087.html',. 'md5': '0c9fcf59a841f65635fa300ac43d8269',. 'info_dict': {. 'id': '19546517',. 'display_id': '18635087',. 'ext': 'mp4',. 'title': 'Ast.rix - Le Domaine des Dieux Teaser VF',. 'description': 'md5:4a754271d9c6f16c72629a8a993ee884',. 'thumbnail': r're:http://.*\.jpg',. 'duration': 39,. 'timestamp': 1404273600,. 'upload

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\alphaporno.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2724
Entropy (8bit):	4.624524431299696
Encrypted:	false
SSDEEP:	48:PuiE0hjkf4RXxE4R8pu7gqKMvaJoXhh6BkXtBQX1ohBZZeyUv9dKNlKT3+RgZ4qE:+0hjkfaxEdEzKMvaJa962JZRUv9dKNlV
MD5:	B8065B3BDC0C890C1D60E72DA63057CD
SHA1:	B5704123C07B5F02A0F0FE77441CCB146E4535AB
SHA-256:	5CE1D6B492950061ED592D7F3E64D0DF464C2A8322589CDFD6583EC2E8F252C5
SHA-512:	2138081DC5A70F493DA174C1DFC9C3BAE6390ABA55FAC5B0B37A08440C73E3EE23417F085A0FB5343DCEE98929C1564DC98E9D0A8023740715D7CCD4C450FC8A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_iso8601,. parse_duration,. parse_filesize,. int_or_none,.)...class AlphaPornoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?alphaporno\.com/videos/(?P<id>[^/]+)'. _TEST = {. 'url': 'http://www.alphaporno.com/videos/sensual-striptease-porn-with-samantha-alexandra/',. 'md5': 'feb6d3bba8848cd54467a87ad34bd38e',. 'info_dict': {. 'id': '258807',. 'display_id': 'sensual-striptease-porn-with-samantha-alexandra',. 'ext': 'mp4',. 'title': 'Sensual striptease porn with Samantha Alexandra',. 'thumbnail': r're:https?://.*\.jpg$',. 'timestamp': 1418694611,. 'upload_date': '20141216',. 'duration': 387,. 'filesize_approx': 54120000,. 'tbr': 1145,. 'categories': list,. 'age_limit': 18,. }. }.. def _real_extract(

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\amcnetworks.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4838
Entropy (8bit):	4.671964013175705
Encrypted:	false
SSDEEP:	96:4+yAs6Pfuru5BcCbWlFbtzFfJsqIrEDf/K7KvoieWBTP6NptTvOYWLhB:hyVc5BcCbUF5zFJsqI2ymvoieyTP6N+
MD5:	36B16C5F89DD5CFA90B59D1F3C726810
SHA1:	74BB5C40A64E3B26F4D892F2D771ACFB508B3F74
SHA-256:	360F218B7A02536A6006C2C29A6952F47FFDDF876B8058D7DE827A08D9676E22
SHA-512:	AE7D3ABB12F00BD9A09D38E6A56A940E6D3F78AAEE78A5A59EA980D7DED1DC099596AC3B93350074EE685DDF162D119B79E8958DAC61D05D4671727D63CE6CD1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .theplatform import ThePlatformIE.from ..utils import (. int_or_none,. parse_age_limit,. try_get,. update_url_query,.)...class AMCNetworksIE(ThePlatformIE):. _VALID_URL = r'https?://(?:www\.)?(?:amc\|bbcamerica\|ifc\|(?:we\|sundance)tv)\.com/(?:movies\|shows(?:/[^/]+)+)/(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'http://www.ifc.com/shows/maron/season-04/episode-01/step-1',. 'md5': '',. 'info_dict': {. 'id': 's3MX01Nl4vPH',. 'ext': 'mp4',. 'title': 'Maron - Season 4 - Step 1',. 'description': 'In denial about his current situation, Marc is reluctantly convinced by his friends to enter rehab. Starring Marc Maron and Constance Zimmer.',. 'age_limit': 17,. 'upload_date': '20160505',. 'timestamp': 1462468831,. 'uploader': 'AMCN',. },. 'params': {. # m3u8 download. 'skip_download'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\americastestkitchen.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3424
Entropy (8bit):	4.747054901473744
Encrypted:	false
SSDEEP:	96:8nZnX5S7obfaah3e4kYJ7WXlbBP+Dj4Uty/7RO:kFpbaYOi7WP4
MD5:	FFCD579D64990DD0E61E107F4C065455
SHA1:	7404F01A77E53461A1BA088D08AFBB6A1539A06F
SHA-256:	84552FC9B65A4807A193E48A50703C578176389ED4D397F30BC8FA664757D1A1
SHA-512:	A2E04A5A0C19A1CF807CBEB2F2D77599559EE5E74AC3211C0625E4B9AFE8EE60E4242500000A389FB61A0006200AACFC7F098FFFAEFAFC5F7BACB9EFCD5CED52
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. try_get,. unified_strdate,.)...class AmericasTestKitchenIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?americastestkitchen\.com/(?:episode\|videos)/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.americastestkitchen.com/episode/548-summer-dinner-party',. 'md5': 'b861c3e365ac38ad319cfd509c30577f',. 'info_dict': {. 'id': '1_5g5zua6e',. 'title': 'Summer Dinner Party',. 'ext': 'mp4',. 'description': 'md5:858d986e73a4826979b6a5d9f8f6a1ec',. 'thumbnail': r're:^https?://.*\.jpg',. 'timestamp': 1497285541,. 'upload_date': '20170612',. 'uploader_id': 'roger.metcalf@americastestkitchen.com',. 'release_date': '20170617',. 'series': "America's Test Kitchen",. 'season_number': 17,. 'epis

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\amp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4061
Entropy (8bit):	4.272039533387268
Encrypted:	false
SSDEEP:	96:YORydH37k3084WFrGqwR5p5dflxCydSiktPLOWgXBTy66/NU6Ng:tROFVNlxh8ikJLOWgxTye6Ng
MD5:	CC1BE0BC18C44C15593BADA1422ABD2F
SHA1:	A2CD93C20B53C13C118AC7E08E8BB37C70EECE3C
SHA-256:	7A6B0F674623308B91D79800BBC128469210E75D21AD3498D3F529758980C951
SHA-512:	710D78AE622465A421BD071234AA37EB350F39558629B0A76B0518F60DA8D5A44FF49F1C44D681CDF560E6BF4E713F8C662E4243BAFFB8B8EF1413E244A3D44C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. mimetype2ext,. parse_iso8601,. url_or_none,.)...class AMPIE(InfoExtractor):. # parse Akamai Adaptive Media Player feed. def _extract_feed_info(self, url):. feed = self._download_json(. url, None, 'Downloading Akamai AMP feed',. 'Unable to download Akamai AMP feed'). item = feed.get('channel', {}).get('item'). if not item:. raise ExtractorError('%s said: %s' % (self.IE_NAME, feed['error'])).. video_id = item['guid'].. def get_media_node(name, default=None):. media_name = 'media-%s' % name. media_group = item.get('media-group') or item. return media_group.get(media_name) or item.get(media_name) or item.get(name, default).. thumbnails = []. media_thumbnail = get_media_node('thumbnail').

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\animeondemand.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12310
Entropy (8bit):	4.242394568683494
Encrypted:	false
SSDEEP:	384:Hs/95D+7UH3+VLzNGNd/zBkeRd/+Tb1/WuUag6N98zFJIDaSYlYT:HrLzNGj/9Fd/41/WDag898zFJIDablYT
MD5:	3AEA12A774E0DAEDB92CFDBD3B354D02
SHA1:	360CC0EFD195D3B3E73216545316AB33CD9905B8
SHA-256:	CE1FC2D9FDED01F311B49202E6D7F1B00112C64941186B6D9C0BE480D5504BB7
SHA-512:	3CB762D713E246D1992FC345769AECA3A975ECC2FC23F50377EBC5DC2D9F838E2F0A717F69263794270B52713FB6BD17E13504DE9F7BE5CBC156873B26A14FAC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. extract_attributes,. ExtractorError,. url_or_none,. urlencode_postdata,. urljoin,.)...class AnimeOnDemandIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?anime-on-demand\.de/anime/(?P<id>\d+)'. _LOGIN_URL = 'https://www.anime-on-demand.de/users/sign_in'. _APPLY_HTML5_URL = 'https://www.anime-on-demand.de/html5apply'. _NETRC_MACHINE = 'animeondemand'. # German-speaking countries of Europe. _GEO_COUNTRIES = ['AT', 'CH', 'DE', 'LI', 'LU']. _TESTS = [{. # jap, OmU. 'url': 'https://www.anime-on-demand.de/anime/161',. 'info_dict': {. 'id': '161',. 'title': 'Grimgar, Ashes and Illusions (OmU)',. 'description': 'md5:6681ce3c07c7189d255ac6ab23812d31',. },. 'playlist_mincount': 4,. }, {. # Film wording is used instead of

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\anitube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	888
Entropy (8bit):	4.97015592308401
Encrypted:	false
SSDEEP:	24:1R8lQvNGkw5WU3V/uldlmyBUVukcSeIXhgtwBQYtI5WVE:PuQlL8tulqyBWPvjXhkwBDlE
MD5:	D9BFA38F328444CB9B5230A71A02AF80
SHA1:	74A0285FA6C4A42F3A686993900A0B8DD5A230A8
SHA-256:	8B70F24EDC9D07DECB476A9F78F3EFC71C2EF69F4229125A74F65C041626FB1F
SHA-512:	63CF8F90C701D6E457AA75D8C9D576EA4A6340D57E3C4A39236E50E25946061221847AC5CC449FBA76671FFFDB98B7B52ECF9B37A940BAD78CDF4CF4371BF335
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .nuevo import NuevoBaseIE...class AnitubeIE(NuevoBaseIE):. IE_NAME = 'anitube.se'. _VALID_URL = r'https?://(?:www\.)?anitube\.se/video/(?P<id>\d+)'.. _TEST = {. 'url': 'http://www.anitube.se/video/36621',. 'md5': '59d0eeae28ea0bc8c05e7af429998d43',. 'info_dict': {. 'id': '36621',. 'ext': 'mp4',. 'title': 'Recorder to Randoseru 01',. 'duration': 180.19,. },. 'skip': 'Blocked in the US',. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). key = self._search_regex(. r'src=["\']https?://[^/]+/embed/([A-Za-z0-9_-]+)', webpage, 'key').. return self._extract_nuevo(. 'http://www.anitube.se/nuevo/econfig.php?key=%s' % key, video_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\anvato.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19499
Entropy (8bit):	5.448040671968066
Encrypted:	false
SSDEEP:	384:6oV1u++L0Q+SRwY3mZalD+TR9Pm0i3elEGBOl1LTs6N+FP+I6E:tUKYCgCR9Pm0i3elE+Ol1LTs8+FP+I6E
MD5:	9AF7AB0695C38BD19C3EE44E10163665
SHA1:	49A2F7DE51F372FFBA6E99354A9EB7FFEA43BBB8
SHA-256:	EBA5F0C1E66A087AD67E05199C7D0696409467F07DF219E20D689FF0A1A22942
SHA-512:	150DE89B944AFBB13A27179559BB478F09A2C07B32BDF798CB6F2ECF668EDD99642AEE9EC8AF6D147A9E209FF51E0CA402420E8ADF1A141BA559B338EE357710
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import hashlib.import json.import random.import re.import time..from .common import InfoExtractor.from ..aes import aes_encrypt.from ..compat import compat_str.from ..utils import (. bytes_to_intlist,. determine_ext,. intlist_to_bytes,. int_or_none,. strip_jsonp,. unescapeHTML,. unsmuggle_url,.)...def md5_text(s):. if not isinstance(s, compat_str):. s = compat_str(s). return hashlib.md5(s.encode('utf-8')).hexdigest()...class AnvatoIE(InfoExtractor):. _VALID_URL = r'anvato:(?P<access_key_or_mcp>[^:]+):(?P<id>\d+)'.. # Copied from anvplayer.min.js. _ANVACK_TABLE = {. 'nbcu_nbcd_desktop_web_prod_93d8ead38ce2024f8f544b78306fbd15895ae5e6': 'NNemUkySjxLyPTKvZRiGntBIjEyK8uqicjMakIaQ',. 'nbcu_nbcd_desktop_web_qa_1a6f01bdd0dc45a439043b694c8a031d': 'eSxJUbA2UUKBTXryyQ2d6NuM8oEqaPySvaPzfKNA',. 'nbcu_nbcd_desktop_web_acc_eb2ff240a5d4ae9a63d4c297c32716b6c523a129': '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\anysex.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2085
Entropy (8bit):	4.840849853168899
Encrypted:	false
SSDEEP:	48:Puu/uminogVCOXHadfFklkQXqXuXfCXlINeX0/VaPVcIK/H7DaAtZ918cU:FubnojKHat9i3Nh/aK/7D1tZ918V
MD5:	8B1389957E804772F42065A763A60038
SHA1:	4EB120C160B6139905BC184B27ACB5A9960B85E7
SHA-256:	E0542DAA6CEEAD1F91B1A26996712E61419BF810250581F72B7AB88576F3FA2F
SHA-512:	7868738309C5B618C5E00EB5009589B9EC0261C9D510249B9DF59DFB21211713243206904F54E4DC0374E38EA9B1A1CA351FAC0EE74B2EF78DB660BA44BB237B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_duration,. int_or_none,.)...class AnySexIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?anysex\.com/(?P<id>\d+)'. _TEST = {. 'url': 'http://anysex.com/156592/',. 'md5': '023e9fbb7f7987f5529a394c34ad3d3d',. 'info_dict': {. 'id': '156592',. 'ext': 'mp4',. 'title': 'Busty and sexy blondie in her bikini strips for you',. 'description': 'md5:de9e418178e2931c10b62966474e1383',. 'categories': ['Erotic'],. 'duration': 270,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id').. webpage = self._download_webpage(url, video_id).. video_url = self._html_search_regex(r"video_url\s:\s'([^']+)'", webpage, 'video URL').. title = self._html_search_regex(r'<t

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\aol.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.762736336467127
Encrypted:	false
SSDEEP:	96:PQ7x8jrWKrgLQqsiegrgviAOumPhdb8fPmZrwrTO1UALOl6Z2aatWBTAdNNd4EUL:iorKLWvviZuChdbqPLvO1pLOlq2aatyt
MD5:	16A1878A60026B969F278EAE00FA50EF
SHA1:	6B45320710263F4C15B32BB5CAE01A3293CF0166
SHA-256:	4513B3CF315537C0EEC7F169D0031EEEB0E00A723C5AB8B1C2DBF59FB9D9EB69
SHA-512:	60B4726CBC769467C0697EDEBE974FAA14B3152A052C9A35486E446CE0EA084EEA8CF15DAE9B44E598EDEDAF94717D83A658FC7AF7BD93507853141D22349412
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. url_or_none,.)...class AolIE(InfoExtractor):. IE_NAME = 'aol.com'. _VALID_URL = r'(?:aol-video:\|https?://(?:www\.)?aol\.(?:com\|ca\|co\.uk\|de\|jp)/video/(?:[^/]+/)*)(?P<id>[0-9a-f]+)'.. _TESTS = [{. # video with 5min ID. 'url': 'https://www.aol.com/video/view/u-s--official-warns-of-largest-ever-irs-phone-scam/518167793/',. 'md5': '18ef68f48740e86ae94b98da815eec42',. 'info_dict': {. 'id': '518167793',. 'ext': 'mp4',. 'title': 'U.S. Official Warns Of \'Largest Ever\' IRS Phone Scam',. 'description': 'A major phone scam has cost thousands of taxpayers more than $1 million, with less than a month until income tax returns are due to the IRS.',. 'timestamp': 13954

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\apa.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3173
Entropy (8bit):	4.8192059818017015
Encrypted:	false
SSDEEP:	96:KOamBhXjC8wzR8cyTa2fXUAEzMhPLOt3vsBTe8pt46Ng:HaKVwzUa2fXU/CLOt3vETG6Ng
MD5:	71B47ADEAB76076CB0D36A4316270680
SHA1:	9EEAA5EE2418CB18E9468BA4FB2832BE47904FE6
SHA-256:	DA0A65A6E1B5033062959C0D351331CEC33138B45E4E3F5B6FDB42654E496A85
SHA-512:	2142F92DCBF67641CCD14C02AF21D73F131385F303A9AA9922739A70444FC41EC7E687241E689C55DFCD0802DB7C251C61036B40125471946F8B4F26DAB8A994
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. js_to_json,. url_or_none,.)...class APAIE(InfoExtractor):. _VALID_URL = r'https?://[^/]+\.apa\.at/embed/(?P<id>[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12})'. _TESTS = [{. 'url': 'http://uvp.apa.at/embed/293f6d17-692a-44e3-9fd5-7b178f3a1029',. 'md5': '2b12292faeb0a7d930c778c7a5b4759b',. 'info_dict': {. 'id': 'jjv85FdZ',. 'ext': 'mp4',. 'title': '"Blau ist mysteri.s": Die Blue Man Group im Interview',. 'description': 'md5:d41d8cd98f00b204e9800998ecf8427e',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 254,. 'timestamp': 1519211149,. 'upload_date': '20180221',. },. }, {. 'url': 'https://uvp-apapublisher.sf.apa.at/embed/2f94e9e6-d945-4db2-9548-f9a41ebf7b78',. 'only_matching': True,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\aparat.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3375
Entropy (8bit):	4.483707203021895
Encrypted:	false
SSDEEP:	96:KP/IkGeNiLXkfzzoWqez2aROG+0TNExBzo2zAmVNs6Nz:C/IkD+XSzzke6YOG+0K/zoF6Nz
MD5:	3B3DBF23C9786760D7BA382B4CBBAB90
SHA1:	79AD35B1821BEB686FE3ED3A2B48689FCC95E770
SHA-256:	01FE8FB677B5FA2202CF43846D63F40FEBD7001DDFABE187D1FC43980C59363F
SHA-512:	0FCB86C25DDCC8801B1630C2FDCEFA69F461F3CDEC9339AF605C86FAD8417C699E7CAB7E38C87F76CF5A24048354A65E3B4B921DA3D65BBBAA39402428842599
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. merge_dicts,. mimetype2ext,. url_or_none,.)...class AparatIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?aparat\.com/(?:v/\|video/video/embed/videohash/)(?P<id>[a-zA-Z0-9]+)'.. _TESTS = [{. 'url': 'http://www.aparat.com/v/wP8On',. 'md5': '131aca2e14fe7c4dcb3c4877ba300c89',. 'info_dict': {. 'id': 'wP8On',. 'ext': 'mp4',. 'title': '... ..... 11 - .....',. 'description': 'md5:096bdabcdcc4569f2b8a5e903a3b3028',. 'duration': 231,. 'timestamp': 1387394859,. 'upload_date': '20131218',. 'view_count': int,. },. }, {. # multiple formats. 'url': 'https://www.aparat.com/v/8dflw/',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. # Pro

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\appleconnect.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	4.845406996005191
Encrypted:	false
SSDEEP:	48:+ur1dOMWuOnXBEjXjlkeXNxGgPOs746g0anGly7:31dOMWuOnXBEqOxXn4B0an8o
MD5:	944E5740D5E8F4E7E4DC2BAA14A31DD2
SHA1:	B055D1782360080FE09B90351507A3D8B7AFC1AD
SHA-256:	12F91AAD6562439E028D08F01BB372EFF10927C3B90DF75F6A39DFA6BDB4A5C4
SHA-512:	336984B9975EF45C5A3635E0A7E51C552ABDBEA71C4162B53B87E84E3ABB941AC5BDA394E50A0218A2326097121383FBAB3B25BD9642C9A6D6C7E91BBD70B7B6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. str_to_int,. ExtractorError.)...class AppleConnectIE(InfoExtractor):. _VALID_URL = r'https?://itunes\.apple\.com/\w{0,2}/?post/idsa\.(?P<id>[\w-]+)'. _TEST = {. 'url': 'https://itunes.apple.com/us/post/idsa.4ab17a39-2720-11e5-96c5-a5b38f6c42d3',. 'md5': 'e7c38568a01ea45402570e6029206723',. 'info_dict': {. 'id': '4ab17a39-2720-11e5-96c5-a5b38f6c42d3',. 'ext': 'm4v',. 'title': 'Energy',. 'uploader': 'Drake',. 'thumbnail': r're:^https?://.\.jpg$',. 'upload_date': '20150710',. 'timestamp': 1436545535,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. try:. video_json = self._html_search_regex(. r'class="auc-video-data">(\{.?\})', webpage,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\appletrailers.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10330
Entropy (8bit):	4.336534640040588
Encrypted:	false
SSDEEP:	192:Fbmdsfz/1QFELjsEW1id2TcO6N0RFHjaTwObUTi6N0ow7RhbCxSqoA0751KMsMq:FbmdsfzKFEMXy2TcO6N0bjqwAUTi6N0q
MD5:	F2A416236D5F2D1CA4D1403C246FF2C1
SHA1:	1D6E37485BCB3D00C0F312AD56A46489627FB1D5
SHA-256:	940E42C79AEBA8F3CD58A048BCA2AC17CBEEC2D16D7ECD96285D63260ED28AE5
SHA-512:	77BC96F5C1F8461DD1B2DE020EC12DF803A2D20900F08EC4AA189E5BE35B9E5EEA16293DE34226E0DE75B4EAC418C02C31DADC05CA9EE2B80C223F417BAD41F9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. parse_duration,. unified_strdate,.)...class AppleTrailersIE(InfoExtractor):. IE_NAME = 'appletrailers'. _VALID_URL = r'https?://(?:www\.\|movie)?trailers\.apple\.com/(?:trailers\|ca)/(?P<company>[^/]+)/(?P<movie>[^/]+)'. _TESTS = [{. 'url': 'http://trailers.apple.com/trailers/wb/manofsteel/',. 'info_dict': {. 'id': '5111',. 'title': 'Man of Steel',. },. 'playlist': [. {. 'md5': 'd97a8e575432dbcb81b7c3acb741f8a8',. 'info_dict': {. 'id': 'manofsteel-trailer4',. 'ext': 'mov',. 'duration': 111,. 'title': 'Trailer 4',. 'upload_date': '20130523',. 'uploader_id': 'wb',. },. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\archiveorg.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	4.91845409845491
Encrypted:	false
SSDEEP:	48:Pu4Qx97apfcVVfCvV0r5uQNv1tfjXjloawvapvFqbsBCnDTWk:OxIxcXavV0r5pvTfKVaVFCVnDTWk
MD5:	14C76EE1A1BF0CB17D57DF161522156F
SHA1:	8F09184BDB41F0509262DA4056F1A135D4E1D800
SHA-256:	F64FCF6844693F96F72B10BD7324EA6F96179A244311985FC85A5914F6A608DE
SHA-512:	B0E654B91265A4B5E2A7D194D9509AEAE0DABE83FC455A1EAEA0EC3A873B724CD791817F1D459303CD61617E65E849B734BBFA8B4E551BDB15E6ABB13F116C95
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. unified_strdate,. clean_html,.)...class ArchiveOrgIE(InfoExtractor):. IE_NAME = 'archive.org'. IE_DESC = 'archive.org videos'. _VALID_URL = r'https?://(?:www\.)?archive\.org/(?:details\|embed)/(?P<id>[^/?#]+)(?:[?].*)?$'. _TESTS = [{. 'url': 'http://archive.org/details/XD300-23_68HighlightsAResearchCntAugHumanIntellect',. 'md5': '8af1d4cf447933ed3c7f4871162602db',. 'info_dict': {. 'id': 'XD300-23_68HighlightsAResearchCntAugHumanIntellect',. 'ext': 'ogg',. 'title': '1968 Demo - FJCC Conference Presentation Reel #1',. 'description': 'md5:da45c349df039f1cc8075268eb1b5c25',. 'upload_date': '19681210',. 'uploader': 'SRI International'. }. }, {. 'url': 'https://archive.org/details/Cops1922',. 'md5': '0869000b4ce265e8ca62738b336b268a',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ard.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	16197
Entropy (8bit):	4.589600955335941
Encrypted:	false
SSDEEP:	384:3+Q2rZjd+vISZ3ghTyoN6NitY78i2OclOS2fJOJ8r0TP6NaX1MedsrbyTo6NLuZM:HISZ3ghT9N8itYgi2OcoS2fJS8oTP8aV
MD5:	3302E07FDA6035D9C71976F44790C5B8
SHA1:	92C714ADF715CC4FFDA54701A2B2D688E3F6B3AF
SHA-256:	BE339E7F8EC84D4C24DCF31B2BD9DB6DCEBE6FA739638A5CDE4BD26D3CE833B4
SHA-512:	98428A2B12DE6A435F594D986CEF528A199AA52736CFDED74A1D2888A35D85325728E64BEE70D467332E2790F46A55A52A65D4E075BDFE67248AF16EB41A929C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .generic import GenericIE.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_duration,. qualities,. str_or_none,. try_get,. unified_strdate,. unified_timestamp,. update_url_query,. url_or_none,. xpath_text,.).from ..compat import compat_etree_fromstring...class ARDMediathekIE(InfoExtractor):. IE_NAME = 'ARD:mediathek'. _VALID_URL = r'^https?://(?:(?:(?:www\|classic)\.)?ardmediathek\.de\|mediathek\.(?:daserste\|rbb-online)\.de\|one\.ard\.de)/(?:./)(?P<video_id>[0-9]+\|[^0-9][^/\?]+)[^/\?](?:\?.*)?'.. _TESTS = [{. # available till 26.07.2022. 'url': 'http://www.ardmediathek.de/tv/S%C3%9CDLICHT/Was-ist-die-Kunst-der-Zukunft-liebe-Ann/BR-Fernsehen/Video?bcastId=34633636&documentId=44726822',. 'info_dict': {. 'id': '44726822',. 'ext': 'mp4',. 'title': 'Was ist die Ku

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\arkena.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5336
Entropy (8bit):	4.671623676147143
Encrypted:	false
SSDEEP:	96:YOXVbSh3wRdLxs5lI8hVVMKq98c3inlX295nMSZXhOYMiYsoYH95pCNBTSbc9kgp:tXhSh3+LxuIeVmKHlGjnMaROYMiYsoYm
MD5:	B0B9ADFA762FB84D3D92C345D37A36F7
SHA1:	112665F1F3FD64FD602C7A879F14BF791D644BDD
SHA-256:	0A4C2B8D889FF026E0ABAE1E914BB3EE8096E2A80D66DFA5765C1BBE65B0B75E
SHA-512:	46F9DF6D599944F64ED58A87E269C6F319A84103B810C47B604FDA0AF53A7DDD7CCE626E56E786B255791F9FA08F592D598632E339EA4835D29D341D9FD26BD7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. determine_ext,. ExtractorError,. float_or_none,. int_or_none,. mimetype2ext,. parse_iso8601,. strip_jsonp,.)...class ArkenaIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. video\.arkena\.com/play2/embed/player\?\|. play\.arkena\.com/(?:config\|embed)/avp/v\d/player/media/(?P<id>[^/]+)/[^/]+/(?P<account_id>\d+). ). '''. _TESTS = [{. 'url': 'https://play.arkena.com/embed/avp/v2/player/media/b41dda37-d8e7-4d3f-b1b5-9a9db578bdfe/1/129411',. 'md5': 'b96f2f71b359a8ecd05ce4e1daa72365',. 'info_dict': {. 'id': 'b41dda37-d8e7-4d3f-b1b5-9a9db578bdfe',. 'ext': 'mp4',. 'title': 'Big Buck Bunny

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\arte.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8167
Entropy (8bit):	4.733529877520487
Encrypted:	false
SSDEEP:	192:pNEd7AdkjsSqbTQyTbekCKNAjqr0hePQu5p2M:pNQsMsSqbTQyTbekuWr0gPQu50M
MD5:	FD031AC409DB4F6B1C85278A72689F91
SHA1:	750E2C9F1D4A64719212228A6C8D6CE7C6AA8DE9
SHA-256:	943075FB60173A57AF14E66ED58749A47A0F285089D8325944F098B30B7255F2
SHA-512:	29A39390EB421D96B973CA5B46BD78551E81D1CBD65760F06100F3C6250BCF18145C6CC1AE5C8A30A699779E5CF457A4F883EC74BB7BC8025F76699BC85CD892
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. qualities,. try_get,. unified_strdate,.)..# There are different sources of video in arte.tv, the extraction process.# is different for each one. The videos usually expire in 7 days, so we can't.# add tests....class ArteTVBaseIE(InfoExtractor):. def _extract_from_json_url(self, json_url, video_id, lang, title=None):. info = self._download_json(json_url, video_id). player_info = info['videoJsonPlayer'].. vsr = try_get(player_info, lambda x: x['VSR'], dict). if not vsr:. error = None. if try_get(player_info, lambda x: x['custom_msg']['type']) == 'error':. error = try_get(. player_info, lambda x: x['custom_msg']['msg'], compat_str). if not error:. error = 'Video %s is not availab

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\asiancrush.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	4.952804623458931
Encrypted:	false
SSDEEP:	96:dQqLTIn77/VNVUdM+DfWeS9p8if6EbxPljbpjLUfz5VCAtfO0Fs7e0vAbKix5:d5L0H/VNVUdvDWeS6zEb1FNjLsVCANJh
MD5:	6B1470C026C59E5698F997B04021AE2E
SHA1:	AD3ACCC3880B445B59EBBF11D259AB441C46C96E
SHA-256:	10CEEF367DA8CB07F9C685E6CB9478119ED5DB76E8157F5A30A2187F2F39A491
SHA-512:	B118C2FC40D63AE6E97324CA84D1BD9106972190F85165B3845A513EB23090BB40318D9F3D2274BDB2C843FD556D356AECD178C92D99559ED2DE4EE1C06C14EA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .kaltura import KalturaIE.from ..utils import extract_attributes...class AsianCrushIE(InfoExtractor):. _VALID_URL_BASE = r'https?://(?:www\.)?(?P<host>(?:(?:asiancrush\|yuyutv\|midnightpulp)\.com\|cocoro\.tv))'. _VALID_URL = r'%s/video/(?:[^/]+/)?0+(?P<id>\d+)v\b' % _VALID_URL_BASE. _TESTS = [{. 'url': 'https://www.asiancrush.com/video/012869v/women-who-flirt/',. 'md5': 'c3b740e48d0ba002a42c0b72857beae6',. 'info_dict': {. 'id': '1_y4tmjm5r',. 'ext': 'mp4',. 'title': 'Women Who Flirt',. 'description': 'md5:7e986615808bcfb11756eb503a751487',. 'timestamp': 1496936429,. 'upload_date': '20170608',. 'uploader_id': 'craig@crifkin.com',. },. }, {. 'url': 'https://www.asiancrush.com/video/she-was-pretty/011886v-pretty-episode-3/',. 'only_matching': True,. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\atresplayer.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7911
Entropy (8bit):	4.838809480915498
Encrypted:	false
SSDEEP:	192:ARi1s/atLVNaUU/J2hjG5sRqDisgoGlTOZPeV6No:ARks/afwUU/JqjssRGisgoGlTOMV6No
MD5:	87B42CE45490E0942AEE0F16DC0D2120
SHA1:	D8DB9105F8B1E1083E403E82B1ACF8AC4074C126
SHA-256:	CE161A687B89BCEDED22D31949D1A4052690BCE6E0E400AB974E30A9BAAABD73
SHA-512:	899D40217EEA93BA2A9B78CFD5F51D63F797D0E702735DD78EED848E1425C4BED4AFCEE47BC6DCF2887B36B64064973416589792C1EE9A0A99E28B414754D87E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import time.import hmac.import hashlib.import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. sanitized_Request,. urlencode_postdata,. xpath_text,.)...class AtresPlayerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?atresplayer\.com/television/[^/]+/[^/]+/[^/]+/(?P<id>.+?)_\d+\.html'. _NETRC_MACHINE = 'atresplayer'. _TESTS = [. {. 'url': 'http://www.atresplayer.com/television/programas/el-club-de-la-comedia/temporada-4/capitulo-10-especial-solidario-nochebuena_2014122100174.html',. 'md5': 'efd56753cda1bb64df52a3074f62e38a',. 'info_dict': {. 'id': 'capitulo-10-especial-solidario-nochebuena',. 'ext': 'mp4',. 'title': 'Especial Solidario de Nochebuena',. 'description': 'md5:e2d52ff12214fa937107d21064075bf1',. 'du

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\atttechchannel.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1962
Entropy (8bit):	4.777094994310256
Encrypted:	false
SSDEEP:	48:Puwc46OsO1A8X8Lx5XBgR1fJoXhhuBwAlBamVzVCeVHzltF3PAtN0f:zc46DO1DXwx5XBgzJaE2RgHF3ItN0f
MD5:	F9ED2C9772E85637F886A9ACA2BEEEF9
SHA1:	93D32E4EF11ABE903BC650CED035603A6094FA6C
SHA-256:	B7DEF5353D8EB1369ED94B39ECEBFF83DA772E754648A3D938E52B2A5688D9D8
SHA-512:	F6152EEFBD4DE87F3F3124083299074D683117275C8B3121BCFC61591800E7F031D10B6D3EA59D44B63D53AD97674560E2C05BDD3F11716C938B0883F281FDF0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import unified_strdate...class ATTTechChannelIE(InfoExtractor):. _VALID_URL = r'https?://techchannel\.att\.com/play-video\.cfm/([^/]+/)(?P<id>.+)'. _TEST = {. 'url': 'http://techchannel.att.com/play-video.cfm/2014/1/27/ATT-Archives-The-UNIX-System-Making-Computers-Easier-to-Use',. 'info_dict': {. 'id': '11316',. 'display_id': 'ATT-Archives-The-UNIX-System-Making-Computers-Easier-to-Use',. 'ext': 'flv',. 'title': 'AT&T Archives : The UNIX System: Making Computers Easier to Use',. 'description': 'A 1982 film about UNIX is the foundation for software in use around Bell Labs and AT&T.',. 'thumbnail': r're:^https?://.\.jpg$',. 'upload_date': '20140127',. },. 'params': {. # rtmp download. 'skip_download': True,. },. }.. def _real_extract(self, url):. di

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\atvat.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	4.517958789257556
Encrypted:	false
SSDEEP:	48:+uhWOXqYf/K1nqv+tfJoXjlhHp6Ch9JOAj+qkkPbOMIlBTt+SnmXNfW6NF:YOXq6/inqv8fJsRJpxTPbO3lBTtznIND
MD5:	93D1F657FA5ACEF73B71DE48C8A322C4
SHA1:	28F781967C320FA89D4E25D80DCD14059D37A0F3
SHA-256:	AB8B903CF3E9FCD477A2D935D6B141FE515EA30E4CA3DEDE3353C64570EE9BBC
SHA-512:	08ED258287CAD09142FCCD2D6967EC38160C1D610FB62E9B2F265AC6E699054764BACCCEB5BC965FB7E492F712ACC04EA87DC79819B67A1532DFE8D4C8BDD23F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. unescapeHTML,.)...class ATVAtIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?atv\.at/(?:[^/]+/){2}(?P<id>[dv]\d+)'. _TESTS = [{. 'url': 'http://atv.at/aktuell/di-210317-2005-uhr/v1698449/',. 'md5': 'c3b6b975fb3150fc628572939df205f2',. 'info_dict': {. 'id': '1698447',. 'ext': 'mp4',. 'title': 'DI, 21.03.17 \| 20:05 Uhr 1/1',. }. }, {. 'url': 'http://atv.at/aktuell/meinrad-knapp/d8416/',. 'only_matching': True,. }].. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id). video_data = self._parse_json(unescapeHTML(self._search_regex(. [r'flashPlayerOptions\s=\s(["\'])(?P<json>(?:(?!\1).)+)\1',. r'class="[^"]jsb_video/FlashPlayer[^"]"[^>]+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\audimedia.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	4.623478462168655
Encrypted:	false
SSDEEP:	96:N1IYhNMTHFpPMYv0fJsgvflEysOC+E7iSVy8RLAWBT70GNNW6NQ:EY+UYviJs4EysOC+E7iWyUAyT7S6NQ
MD5:	4338EDC9267874A7684A4563C1E4E767
SHA1:	595B4F074CEC8DC7F1E3F36B34E107B58BAD1577
SHA-256:	28F7210065DD8D090E24A304552F9DD672E4C05CD4645C2CD17666649102D585
SHA-512:	35ECF6B91979E58BE393C81D8CC53027FF784140771F04B751ABDFE8A2A6BEB4315579AF3947C067D1B6B6F68967E89BD4B75681287FAD6450E6A7C2301CAF61
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class AudiMediaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?audi-mediacenter\.com/(?:en\|de)/audimediatv/(?:video/)?(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'https://www.audi-mediacenter.com/en/audimediatv/60-seconds-of-audi-sport-104-2015-wec-bahrain-rookie-test-1467',. 'md5': '79a8b71c46d49042609795ab59779b66',. 'info_dict': {. 'id': '1565',. 'ext': 'mp4',. 'title': '60 Seconds of Audi Sport 104/2015 - WEC Bahrain, Rookie Test',. 'description': 'md5:60e5d30a78ced725f7b8d34370762941',. 'upload_date': '20151124',. 'timestamp': 1448354940,. 'duration': 74022,. 'view_count': int,. }. }, {. 'url': 'https://www.audi-mediacenter.com/en/audimediatv/video/60-seconds-of-audi-sport-104-2015-wec-bahrain-rookie-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\audioboom.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2561
Entropy (8bit):	4.733710329283779
Encrypted:	false
SSDEEP:	48:+uUAO3fZWPhdc4C6uK59RlvtDtfjXhk34uXH4YNCEQrTzuwWAKieMATW8CbAQ8cK:z2Z8L58KJlvt5fa3P4YepeMN8CbJ8R
MD5:	297875A0144B6EEBCD6631C52D80A388
SHA1:	D88336A01BB710CABD570CA5F3555CFFC85786CE
SHA-256:	AB86E64590F2102D6321C96F3BC585F12A206530EF42CA60890E2A9A0BDC93A2
SHA-512:	371BBF6B6D624CC2E72AD6EAD2331D1AFFFD6B1BBF45E0178159D9C6433A2FDB91912CD372D9B38D86241D189B15440AEBB1D6454B197EACB60ED4DEB1B79CDE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import float_or_none...class AudioBoomIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?audioboom\.com/(?:boos\|posts)/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://audioboom.com/boos/4279833-3-09-2016-czaban-hour-3?t=0',. 'md5': '63a8d73a055c6ed0f1e51921a10a5a76',. 'info_dict': {. 'id': '4279833',. 'ext': 'mp3',. 'title': '3/09/2016 Czaban Hour 3',. 'description': 'Guest: Nate Davis - NFL free agency, Guest: Stan Gans',. 'duration': 2245.72,. 'uploader': 'SB Nation A.M.',. 'uploader_url': r're:https?://(?:www\.)?audioboom\.com/channel/steveczabanyahoosportsradio',. }. }, {. 'url': 'https://audioboom.com/posts/4279833-3-09-2016-czaban-hour-3?t=0',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\audiomack.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5866
Entropy (8bit):	4.444215758799194
Encrypted:	false
SSDEEP:	96:QfOi7YlK83QPitUDHsngFWx3qeophkIwJR6Ce2Ry6gFWOUy60KA5a5LUNLG81Bqp:M6R3giW7sng8xzopunJXe0y6g8OUyiAk
MD5:	0D5EE9BB4642C385C33C52C1D82BBE24
SHA1:	E1B876BF195C1DD4D73E8EFBD438950B56563A3C
SHA-256:	1C79E56E6253F452AB4232BD145D660528B74CAFB63288285A166920E22B0E16
SHA-512:	43E42833351C3B03A66B0074DB5278FC2059C9C78DA84AAF147BC15A0176BDCAF059A78BC46305524C4EED17BCB84A5EE1F5C45900B76E57DB1A4CF9B9828616
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import time..from .common import InfoExtractor.from .soundcloud import SoundcloudIE.from ..compat import compat_str.from ..utils import (. ExtractorError,. url_basename,.)...class AudiomackIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?audiomack\.com/song/(?P<id>[\w/-]+)'. IE_NAME = 'audiomack'. _TESTS = [. # hosted on audiomack. {. 'url': 'http://www.audiomack.com/song/roosh-williams/extraordinary',. 'info_dict':. {. 'id': '310086',. 'ext': 'mp3',. 'uploader': 'Roosh Williams',. 'title': 'Extraordinary'. }. },. # audiomack wrapper around soundcloud song. {. 'add_ie': ['Soundcloud'],. 'url': 'http://www.audiomack.com/song/hip-hop-daily/black-mamba-freestyle',. 'info_dict': {. 'id': '258901379',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\awaan.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7147
Entropy (8bit):	4.96034309716297
Encrypted:	false
SSDEEP:	96:dcWfq1YErjVeO6NNs9mHVgL9EdunfFDhK85obUBxltrV93PymGahzHKvowOIeayv:hfAjYgL6ufTiYhT5jzHKvoX0EJ
MD5:	79A946E9A11862465E31354FBB66A42D
SHA1:	BBDD4246902247B396B1754987AB1EB9698454A9
SHA-256:	7557CEEA1ED0F85B660D4C8560AA137EA95C14FD2D3F4476DAFE04359D29E831
SHA-512:	1C9B72E5F2F3F96814907B1860A442165C9234C17E9E8DF2246A0517D694DE01709307334D4322ACE7ECBF3DD5B8AB45C80A3B767758ADF94446DEBE4F2F26BA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import base64..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_str,.).from ..utils import (. int_or_none,. parse_iso8601,. smuggle_url,. unsmuggle_url,. urlencode_postdata,.)...class AWAANIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:awaan\|dcndigital)\.ae/(?:#/)?show/(?P<show_id>\d+)/[^/]+(?:/(?P<video_id>\d+)/(?P<season_id>\d+))?'.. def _real_extract(self, url):. show_id, video_id, season_id = re.match(self._VALID_URL, url).groups(). if video_id and int(video_id) > 0:. return self.url_result(. 'http://awaan.ae/media/%s' % video_id, 'AWAANVideo'). elif season_id and int(season_id) > 0:. return self.url_result(smuggle_url(. 'http://awaan.ae/program/season/%s' % season_id,. {'show_id': show_id}), 'AWAANSeason'). else:. return self.u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\aws.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3092
Entropy (8bit):	4.860581964222115
Encrypted:	false
SSDEEP:	48:+u47XOZOINFQSpO54ptsrEzkp4HImABu4tN5mZW+RGepiaH1xxca:UXOZrNWSW30Xl/Bca
MD5:	35F51FA40DEDEE0C19DB271155E6FAC3
SHA1:	028E95C01FEACFBED775E34AC44F15E07D92DFCF
SHA-256:	8DC0A2C265DB0DDA6FDDCEDE2CDD4394EB62C2745A1752319EEB75590C8F8FA2
SHA-512:	DBE365A2B4EB3BBDAE36991EBA4D18577BB4C6382F8741739837D55A43D33EE19AA47DCACC9C7224B299C2F1FEC1AE5F0385051E4AF0426DAD88B2A1AC1D9AE5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import datetime.import hashlib.import hmac..from .common import InfoExtractor.from ..compat import compat_urllib_parse_urlencode...class AWSIE(InfoExtractor):. _AWS_ALGORITHM = 'AWS4-HMAC-SHA256'. _AWS_REGION = 'us-east-1'.. def _aws_execute_api(self, aws_dict, video_id, query=None):. query = query or {}. amz_date = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ'). date = amz_date[:8]. headers = {. 'Accept': 'application/json',. 'Host': self._AWS_PROXY_HOST,. 'X-Amz-Date': amz_date,. 'X-Api-Key': self._AWS_API_KEY. }. session_token = aws_dict.get('session_token'). if session_token:. headers['X-Amz-Security-Token'] = session_token.. def aws_hash(s):. return hashlib.sha256(s.encode('utf-8')).hexdigest().. # Task 1: http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.h

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\azmedien.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2878
Entropy (8bit):	4.105232459574208
Encrypted:	false
SSDEEP:	48:+uiKFmGfHCztm0GN23+7o+dfFJZZvcPEvRqyaiwmlB9WD8zET:MAiztm0Go3p++c5qyaidhWQET
MD5:	DC44A725094BA9DC70DCBF21DD7B4229
SHA1:	62505585A113BA81133EE84F8B5F57BB79D6CED7
SHA-256:	5252E8BA5998515B53B1CD7355B7F17EE3219886C2C172E737D50D3F77E1FAED
SHA-512:	3EA021DD25AA51203E9BC7D8FA3BDACC6459D5F803294626FE728354EBBD6089238CF4F49F558438E1E6BBC388671CD48DB58FDBC3743D9BB2077BE22FFA54E1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from .kaltura import KalturaIE...class AZMedienIE(InfoExtractor):. IE_DESC = 'AZ Medien videos'. _VALID_URL = r'''(?x). https?://. (?:www\.)?. (?P<host>. telezueri\.ch\|. telebaern\.tv\|. telem1\.ch. )/. [^/]+/. (?P<id>. [^/]+-(?P<article_id>\d+). ). (?:. \#video=. (?P<kaltura_id>. [_0-9a-z]+. ). )?. '''.. _TESTS = [{. 'url': 'https://www.telezueri.ch/sonntalk/bundesrats-vakanzen-eu-rahmenabkommen-133214569',. 'info_dic

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\baidu.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1980
Entropy (8bit):	5.095679547382841
Encrypted:	false
SSDEEP:	48:+uBLC27lr9CfbkKm4LmXb0nX3Di4IZSCUfj6vUWfBVUqfFId09cDUT/HYmEItUBN:xCglOQKdLmX4nX3Di4IZSCUfjiUWfBV8
MD5:	F38BE1366B996DA5D4B79ADD08889F49
SHA1:	09F75C71E8693C946C82EC69D05464868E997A78
SHA-256:	7432657DB77148703996CF7C85EBDB36CBC0978F44B88D08975356DA7C215268
SHA-512:	9CE0D64F9099D500D02577DE0994510FC6CD4A9D74D9B4C496D0D0E4AD00C2168974E52B12B9A7136289AB0246218FF6ADE4B957375FF9EA8C8DC9E89A3C8CC0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import unescapeHTML...class BaiduVideoIE(InfoExtractor):. IE_DESC = '....'. _VALID_URL = r'https?://v\.baidu\.com/(?P<type>[a-z]+)/(?P<id>\d+)\.htm'. _TESTS = [{. 'url': 'http://v.baidu.com/comic/1069.htm?frp=bdbrand&q=%E4%B8%AD%E5%8D%8E%E5%B0%8F%E5%BD%93%E5%AE%B6',. 'info_dict': {. 'id': '1069',. 'title': '..... TV...',. 'description': 'md5:51be07afe461cf99fa61231421b5397c',. },. 'playlist_count': 52,. }, {. 'url': 'http://v.baidu.com/show/11595.htm?frp=bdbrand',. 'info_dict': {. 'id': '11595',. 'title': 're:^.....',. 'description': 'md5:1bf88bad6d850930f542d51547c089b8',. },. 'playlist_mincount': 12,. }].. def _call_api(self, path, category, playlist_id, note):. return self._download_json('htt

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bambuser.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4782
Entropy (8bit):	4.6898175209545565
Encrypted:	false
SSDEEP:	96:ZOTwQriAn0zoo5X5Rqkafspnj992bqPpCId8tjoqc:WwQhnG5XivspnjXDPPHqc
MD5:	D46B549113CAB808F02929B67451B102
SHA1:	254A14E6A34976D5A9575BF2EF03E564C54262E4
SHA-256:	BAA9DB720C6D723E70EE9D4D5F1E4FA36AE50A5514606BB00035E7520ACFB2AE
SHA-512:	92B05051AC2D84B61F03E32359AC697E755F81A3B4E75CDFDA5D09423DD0152E14BE7C4C4B9E3397A0913D563FCD9226220A20CE5C72E5BBC63F8A9D0C459029
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. sanitized_Request,. urlencode_postdata,.)...class BambuserIE(InfoExtractor):. IE_NAME = 'bambuser'. _VALID_URL = r'https?://bambuser\.com/v/(?P<id>\d+)'. _API_KEY = '005f64509e19a868399060af746a00aa'. _LOGIN_URL = 'https://bambuser.com/user'. _NETRC_MACHINE = 'bambuser'.. _TEST = {. 'url': 'http://bambuser.com/v/4050584',. # MD5 seems to be flaky, see https://travis-ci.org/ytdl-org/youtube-dl/jobs/14051016#L388. # 'md5': 'fba8f7693e48fd4e8641b3fd5539a641',. 'info_dict': {. 'id': '4050584',. 'ext': 'flv',. 'title': 'Education engineering days - lightning talks',. 'duration': 3741,. 'uploader': 'pixelversity',. 'uploader_id': '344706',. 'timestamp': 1

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bandcamp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15414
Entropy (8bit):	4.398217858651354
Encrypted:	false
SSDEEP:	384:4+Mbl+JKxogLAqgpT7Z6NbYKja5t6Iw/wAO60/ug2MC9oTjX6Nq:45+JKxogLAqgpT7Z8/Iw/ZMuoTjX8q
MD5:	A1EB9C163EE8F6790C0846DF3E242441
SHA1:	447F42CB9D1358F363ACE70CA05D2C4CB76DD50E
SHA-256:	69A3D8503FE0F429E51E06F257422D56CF5A5B14576F56D38F50382A2F9B858D
SHA-512:	DF1AECE6D04C05F4B4BA0D483F388046A63E55BBBA4135E62F4A14CF2D10CC3A0F1902A2E6FDE82D63BE0E8F1EAA3846A3AE03C56691FE5AB25CAA6D69F00DE2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import random.import re.import time..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. KNOWN_EXTENSIONS,. parse_filesize,. str_or_none,. try_get,. unescapeHTML,. update_url_query,. unified_strdate,. unified_timestamp,. url_or_none,.)...class BandcampIE(InfoExtractor):. _VALID_URL = r'https?://[^/]+\.bandcamp\.com/track/(?P<title>[^/?#&]+)'. _TESTS = [{. 'url': 'http://youtube-dl.bandcamp.com/track/youtube-dl-test-song',. 'md5': 'c557841d5e50261777a6585648adf439',. 'info_dict': {. 'id': '1812978515',. 'ext': 'mp3',. 'title': "youtube-dl \"'/\\\u00e4\u21ad - youtube-dl test song \"'/\\\u00e4\u21ad",. 'duration': 9.8485,. },. '_skip': 'There is a limit of 200 free downloads / month for the test song'. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bbc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	59092
Entropy (8bit):	4.5078237940756924
Encrypted:	false
SSDEEP:	1536:PKMhm7DSoBOtdwsiiEkiKiviAicieiMiBiQTwV8vNrs2FXliv2iBiFTbh8tiBTX0:axqfrVbEZsY1ENftgmYAOjvGM
MD5:	A1301E73E0AAB69AB159811FB358441E
SHA1:	67B6ED9DF0F723838A80D69753CD0EEF0436D37A
SHA-256:	A6C015175F5793AAF2814E4E5DDD650A3FA8FBD0E36769A4B2903D212ED5371C
SHA-512:	44ADAD6360D264D536EEF4B065AB11537B572882EAFC32048F3DB3B31841985834205CB4FC0953323FD2DEBA15071217D1D03A10A0CEC2D1E11864C9A0F83CC1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..utils import (. clean_html,. dict_get,. ExtractorError,. float_or_none,. get_element_by_class,. int_or_none,. js_to_json,. parse_duration,. parse_iso8601,. try_get,. unescapeHTML,. url_or_none,. urlencode_postdata,. urljoin,.).from ..compat import (. compat_etree_Element,. compat_HTTPError,. compat_urlparse,.)...class BBCCoUkIE(InfoExtractor):. IE_NAME = 'bbc.co.uk'. IE_DESC = 'BBC iPlayer'. _ID_REGEX = r'(?:[pbm][\da-z]{7}\|w[\da-z]{7,14})'. _VALID_URL = r'''(?x). https?://. (?:www\.)?bbc\.co\.uk/. (?:. programmes/(?!articles/)\|. iplayer(?:/[^/]+)?/(?:episode/\|playlist/)\|. music/(?:clips\|audiovideo/popular)[/#]\|. radio/player/\|.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\beampro.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6462
Entropy (8bit):	4.738448582137642
Encrypted:	false
SSDEEP:	192:77nM0LKduWiMSr5dQevTNp6Nge7CaXbGbJDXYdZdmobYT26Ngu:NLB5dQevT76N/CaXbGbJzGdmsYT26NJ
MD5:	01B7EF8738119AC0FF316BCCCA4F415A
SHA1:	43EEA1B8A79758896DA225B00331506CA474199C
SHA-256:	29ED10E746CFAB1B851A2D03C823581546DA7E96C90836EFF7EBB35DC1076576
SHA-512:	9B476577A26C6C21F2D811C60739B2396B33ADEEE8C937367F1DE4C433DEDCA1CB589FBCABF6ACAD702D0367A6364C8818EDB4DDCF96E5EA165D6D408661A029
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. clean_html,. compat_str,. float_or_none,. int_or_none,. parse_iso8601,. try_get,. urljoin,.)...class BeamProBaseIE(InfoExtractor):. _API_BASE = 'https://mixer.com/api/v1'. _RATINGS = {'family': 0, 'teen': 13, '18+': 18}.. def _extract_channel_info(self, chan):. user_id = chan.get('userId') or try_get(chan, lambda x: x['user']['id']). return {. 'uploader': chan.get('token') or try_get(. chan, lambda x: x['user']['username'], compat_str),. 'uploader_id': compat_str(user_id) if user_id else None,. 'age_limit': self._RATINGS.get(chan.get('audience')),. }...class BeamProLiveIE(BeamProBaseIE):. IE_NAME = 'Mixer:live'. _VALID_URL = r'https?://(?:\w+\.)?(?:beam\.pro\|mixer\.com)/(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'http://mixer.com/niterhayven',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\beatport.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3419
Entropy (8bit):	4.502572059523825
Encrypted:	false
SSDEEP:	96:Por+MuGoVnfpgXkvVfuEG6hEcaFM+ydR8m6Kzfe1pz5rBTz3Up6Nt:gyVG2f4EVuEG6hEcSM+IWUYdTz3Up6Nt
MD5:	95D70BCF4B7CAE7F30D7C460B16164B5
SHA1:	2DCA4D9C574745DC6028354556C87A11AB5A56BE
SHA-256:	067ECC7D2555FF966BA09379EAE04971E64770EE327563609397511C6AB52DDD
SHA-512:	316CE9555ED44D4A9DAB00F9E74593DC91C32C496B5677F6E8AA393A24A68C4E292FC4CDA0483DA1084C0965127F10CD79EC609487C4C93C143EC668035D929E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import int_or_none...class BeatportIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.\|pro\.)?beatport\.com/track/(?P<display_id>[^/]+)/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://beatport.com/track/synesthesia-original-mix/5379371',. 'md5': 'b3c34d8639a2f6a7f734382358478887',. 'info_dict': {. 'id': '5379371',. 'display_id': 'synesthesia-original-mix',. 'ext': 'mp4',. 'title': 'Froxic - Synesthesia (Original Mix)',. },. }, {. 'url': 'https://beatport.com/track/love-and-war-original-mix/3756896',. 'md5': 'e44c3025dfa38c6577fbaeb43da43514',. 'info_dict': {. 'id': '3756896',. 'display_id': 'love-and-war-original-mix',. 'ext': 'mp3',. 'title': 'Wolfgang Gartner - Love & War (Original Mix)',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\beeg.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3586
Entropy (8bit):	4.483574204516098
Encrypted:	false
SSDEEP:	96:i9KUyHbhtBtpckuwfa1DVG7Ujx33MPRoBTUBxG5c9NdjP8mO6NK:Bptt7OkuGaRVxjx38poTUinmO6NK
MD5:	A2A2D4E6C98D1C1372C56BA599556A1E
SHA1:	B0E92B2C25845F4DA042462D93A429FE8EB6E766
SHA-256:	14E15111B80953F4311C43275F9156ACDF50E20E98A5A82D0A906BB371FF7BCE
SHA-512:	113DF935B5C88FF51675D8D2E06B9317EA719C1CBA8A046005FF9A9D25E852E1911FE6599FE4EBFF40AD54821AF783C2A9CD1733073CD166214E0F522F58088C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. int_or_none,. unified_timestamp,.)...class BeegIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?beeg\.(?:com\|porn(?:/video)?)/(?P<id>\d+)'. _TESTS = [{. # api/v6 v1. 'url': 'http://beeg.com/5416503',. 'md5': 'a1a1b1a8bc70a89e49ccfd113aed0820',. 'info_dict': {. 'id': '5416503',. 'ext': 'mp4',. 'title': 'Sultry Striptease',. 'description': 'md5:d22219c09da287c14bed3d6c37ce4bc2',. 'timestamp': 1391813355,. 'upload_date': '20140207',. 'duration': 383,. 'tags': list,. 'age_limit': 18,. }. }, {. # api/v6 v2. 'url': 'https://beeg.com/1941093077?t=911-1391',. 'only_matching': True,. }, {. # api/v6 v2 w/o t. 'url': 'https://beeg.com/1277207756',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\behindkink.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1647
Entropy (8bit):	5.006256466074209
Encrypted:	false
SSDEEP:	48:+uKVoEydM1+yksRTtkXuadfFfVlhuB8eArOPF+veq0P:u+EcGKsRTtkXuab9le3I90P
MD5:	FB421A2E58097394C6434D2BFE9E2F2A
SHA1:	F3A401A5C89B2BD002F1CDED90D1253A333766EC
SHA-256:	CC980E60B7A04E7006453E1A15FFBD5F5908CCE33FF5ECCC6A84DBF1823BE16C
SHA-512:	CF5B5069CD982AAC553035F7FA6EACFF17185B1A65503E40086745C42ADA7E9B077E43E556D92B0992672C7637122E92C4C5A64065F4778B73F0522A76F6417F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import url_basename...class BehindKinkIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?behindkink\.com/(?P<year>[0-9]{4})/(?P<month>[0-9]{2})/(?P<day>[0-9]{2})/(?P<id>[^/#?_]+)'. _TEST = {. 'url': 'http://www.behindkink.com/2014/12/05/what-are-you-passionate-about-marley-blaze/',. 'md5': '507b57d8fdcd75a41a9a7bdb7989c762',. 'info_dict': {. 'id': '37127',. 'ext': 'mp4',. 'title': 'What are you passionate about . Marley Blaze',. 'description': 'md5:aee8e9611b4ff70186f752975d9b94b4',. 'upload_date': '20141205',. 'thumbnail': 'http://www.behindkink.com/wp-content/uploads/2014/12/blaze-1.jpg',. 'age_limit': 18,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). display_id = mobj.group('id').. webpage = self._

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bellmedia.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2792
Entropy (8bit):	4.80324560725895
Encrypted:	false
SSDEEP:	48:+uQ5VV4NIKgPfTJAZubXQZXwH9x3XovXXWcXx9Xgx9XrIGo4sFEWlfFIGiDQ:85QwHtcuzQlqHovnPDgXaMWaQ
MD5:	1CE7E8AA0D1EF0571EB931BD5D2F04B0
SHA1:	F1A4D4D9890E4F5274844F3F431F4BCB6C421EF3
SHA-256:	84DC9BE3945DD838CD86FE7ECC2D6214FF4BEF100F23CD06F4BF786566D770FC
SHA-512:	EF6423BEFDB48118BD2CFF771AC6F79A7A052C37B38AA87EDA1A7CF3C98457B68255B1B8D56A7925641FAE5B2A0A9E9ED6252AF49B66A3C8A5D93FB125E84724
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class BellMediaIE(InfoExtractor):. _VALID_URL = r'''(?x)https?://(?:www\.)?. (?P<domain>. (?:. ctv\|. tsn\|. bnn(?:bloomberg)?\|. thecomedynetwork\|. discovery\|. discoveryvelocity\|. sciencechannel\|. investigationdiscovery\|. animalplanet\|. bravo\|. mtv\|. space\|. etalk. )\.ca\|. much\.com. )/.*?(?:\bvid(?:eoid)?=\|-vid\|~\|%7E\|/(?:episode)?)(?P<id>[0-9]{6,})'''. _TESTS = [{. 'url': 'https://www.bnnbloomberg.ca/video/david-cockfield-s-top-picks~1403070',. 'md5': '36d3ef559cfe8af8efe15922cd3ce950',. 'info_dict': {. 'id': '1403070',. 'ext': 'flv',. 'title': 'David Cockfield\'s Top Picks',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bet.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2783
Entropy (8bit):	4.567675132601024
Encrypted:	false
SSDEEP:	48:PuLRcP3hPUpYr6tgFdg7FXEPBFsRi/i4ki0CWLbHhg7FXEPBFfwPp+lxcOJoXhhZ:pP3hPQTtgFdg7KPAR+y/CqbHhg7KPjwd
MD5:	21AAD900DAC01A6B983C6325312F2D92
SHA1:	A0D3FDC53E943818BD4AE603061DA1747BBC3090
SHA-256:	385642A9098D181DA9DDB375AB035D46CC6DE836F77F34221A04643B5E6D91D7
SHA-512:	0BE18F63B29DA26F77C92A12555650F99451C43F1875024E17FC829A6D1DEE5BC035A8F056509A54B5B82E5BF19BD22555A63866C1648793A73DCFCC025C6918
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .mtv import MTVServicesInfoExtractor.from ..utils import unified_strdate...class BetIE(MTVServicesInfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bet\.com/(?:[^/]+/)+(?P<id>.+?)\.html'. _TESTS = [. {. 'url': 'http://www.bet.com/news/politics/2014/12/08/in-bet-exclusive-obama-talks-race-and-racism.html',. 'info_dict': {. 'id': '07e96bd3-8850-3051-b856-271b457f0ab8',. 'display_id': 'in-bet-exclusive-obama-talks-race-and-racism',. 'ext': 'flv',. 'title': 'A Conversation With President Obama',. 'description': 'President Obama urges persistence in confronting racism and bias.',. 'duration': 1534,. 'upload_date': '20141208',. 'thumbnail': r're:(?i)^https?://.*\.jpg$',. 'subtitles': {. 'en': 'mincount:2',. }. },. 'params':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bfi.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1341
Entropy (8bit):	4.9324501516487045
Encrypted:	false
SSDEEP:	24:zi8lzvBnEAdr7HVtu/r/kPaKvFFdlNtFhl6eIXjlgt06Y4t+GyumI0h:+udEOr7GrkPa8Fn56jXjlk06n/yumbh
MD5:	FFF16101B7A4BF58FAF2186324FB4470
SHA1:	F35D2AA708FC9835C1576BB1877D186138ABCBCC
SHA-256:	331F79ECC56B510E7A52CA1DE48E65E6EE73197B3414C1A31A2AC4AD9EC00346
SHA-512:	82CE2DB3083A3864C8F1F14641DFF71D66237597E1462DC06DD62E9473AFBB0EF0D1C0E1C0EAC4A7494F228AE70375E14117E8B0914D2092FE69FFF2E9B4F01D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import extract_attributes...class BFIPlayerIE(InfoExtractor):. IE_NAME = 'bfi:player'. _VALID_URL = r'https?://player\.bfi\.org\.uk/[^/]+/film/watch-(?P<id>[\w-]+)-online'. _TEST = {. 'url': 'https://player.bfi.org.uk/free/film/watch-computer-doctor-1974-online',. 'md5': 'e8783ebd8e061ec4bc6e9501ed547de8',. 'info_dict': {. 'id': 'htNnhlZjE60C9VySkQEIBtU-cNV1Xx63',. 'ext': 'mp4',. 'title': 'Computer Doctor',. 'description': 'md5:fb6c240d40c4dbe40428bdd62f78203b',. },. 'skip': 'BFI Player films cannot be played outside of the UK',. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). entries = []. for player_el in re.findall(r'(?s)<[^>]+class="player"[^>]*>', webpage):. player_attr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bigflix.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	4.603615544056786
Encrypted:	false
SSDEEP:	48:+u4XXx0XmPiA/tF5NqWX+PjtfjXhkdXRbsb+7EavILeTBvFbAMrBTbOd/6Nq:eyXZ0tvsWXQfa7sb+7E9LeZJAqBTe6Nq
MD5:	1E0994216F013497E607A8649A0173B6
SHA1:	1B72D0A70CDFECF8ABE0D41166FEA1BD7C4DEB66
SHA-256:	08DAAF86251D3FE40F732A7BCCEBB4A6CC270F218FEACBCCD1E2E6D28F218509
SHA-512:	4C6AADB216000351DE324AB86644DB62760ACD7D5F7D42906EF67DEBAE903BF67CED0B2DDBA7FC467791DCB5B4ACC7928AF8FBAE1638E4151C2F33AC31613605
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_urllib_parse_unquote,.)...class BigflixIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bigflix\.com/.+/(?P<id>[0-9]+)'. _TESTS = [{. # 2 formats. 'url': 'http://www.bigflix.com/Tamil-movies/Drama-movies/Madarasapatinam/16070',. 'info_dict': {. 'id': '16070',. 'ext': 'mp4',. 'title': 'Madarasapatinam',. 'description': 'md5:9f0470b26a4ba8e824c823b5d95c2f6b',. 'formats': 'mincount:2',. },. 'params': {. 'skip_download': True,. }. }, {. # multiple formats. 'url': 'http://www.bigflix.com/Malayalam-movies/Drama-movies/Indian-Rupee/15967',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bild.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1363
Entropy (8bit):	4.980660042121645
Encrypted:	false
SSDEEP:	24:zi8lFvahGo1iwVOSckT/VdlN3/yZl1QCjAaeIXSvBgoHlEOamkVZFl:+uqViLGLVpavXjAajXoBlHQFl
MD5:	78B136A8E558D253427D0F6C33E95A51
SHA1:	D37599DBCEA267E31DDF169C842D68692DC9A8A7
SHA-256:	0C5DC1F3A37109E2C8F3AF36235637CB137B6418CBA2BFA36F37CDA948D84B94
SHA-512:	FF1DA9B613FD00B92489CE3E8D65CFD7EC9DFBCA3A1BF785AB82ABDDAA6C926A67408089ADBD330D0A4F6867BFEF7E411BAC4A19CE8F32FEBBAC1085EE34024E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unescapeHTML,.)...class BildIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bild\.de/(?:[^/]+/)+(?P<display_id>[^/]+)-(?P<id>\d+)(?:,auto=true)?\.bild\.html'. IE_DESC = 'Bild.de'. _TEST = {. 'url': 'http://www.bild.de/video/clip/apple-ipad-air/das-koennen-die-neuen-ipads-38184146.bild.html',. 'md5': 'dd495cbd99f2413502a1713a1156ac8a',. 'info_dict': {. 'id': '38184146',. 'ext': 'mp4',. 'title': 'Das k.nnen die neuen iPads',. 'description': 'md5:a4058c4fa2a804ab59c00d7244bbf62f',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 196,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. video_data = self._download_json(. url.split('.bild.html')[0] + ',view=json.bild.html', video_id).. retu

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bilibili.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11895
Entropy (8bit):	5.083801452241362
Encrypted:	false
SSDEEP:	192:OBBQpey7t6V4D20bGUbGZibg4S++4Cl8oAi/6owTQ6NQ51hwNhXIh:OfQpeYtyz/fEbgg+IoAi/6owTQ6NohwE
MD5:	E03559279F7DC69D4A3BEED713B03CB2
SHA1:	06F76E09A310DC8CA0B22A41198B556FEE78804C
SHA-256:	13A684FEC7B08CE7312C5ACA621AE748FB9EEB75D73F03A40920B93C178AFAF5
SHA-512:	CE4FB3CA448112F89E373132CC76BFA2D1BE9ABCFDEC93B5B62AD98A934BD7C0630B90A3E59AD68817E55F801408E7A37B89F0E23B2AE38B268E5F8B87FC75DA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. parse_iso8601,. smuggle_url,. strip_jsonp,. unified_timestamp,. unsmuggle_url,. urlencode_postdata,.)...class BiliBiliIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.\|bangumi\.\|)bilibili\.(?:tv\|com)/(?:video/av\|anime/(?P<anime_id>\d+)/play#)(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.bilibili.tv/video/av1074402/',. 'md5': '5f7d29e1a2872f3df0cf76b1f87d3788',. 'info_dict': {. 'id': '1074402',. 'ext': 'flv',. 'title': '........',. 'description': 'md5:ce18c2a2d2193f0df2917d270f2e5923',. 'duration': 308.067,. 'timestamp': 1398012678,. 'upload_date': '20140420',. 'thumbnail': r're

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\biobiochiletv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3511
Entropy (8bit):	4.912858627743909
Encrypted:	false
SSDEEP:	96:5U1aC8pYu3jXfOVHYMOav7Xa+h1OV1d2KL2RMebcYIYtcksKfaNfhxB1/A/QXtS:5U15YYO7cHYqvzLc1d2KRUcYIYSks4aI
MD5:	AB2B3A099849424B6CBF6E4A63E20308
SHA1:	50949B049124566FA112CAD255E40195228689FD
SHA-256:	29416CEFD81A957C48F223BBEFEF6F20C0F9C1E6F8AAB5F6B6A5729C3428EDAF
SHA-512:	325B7063DB01AD854FFE03EBCA4F7DD57ABA9E41A85448E751281F18ACC5DC0D7E9782937DB2CDBCA4BBE8DB96F89C0E18691D611ECD52CBF7A9E801F1D883AC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. remove_end,.)...class BioBioChileTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:tv\|www)\.biobiochile\.cl/(?:notas\|noticias)/(?:[^/]+/)+(?P<id>[^/]+)\.shtml'.. _TESTS = [{. 'url': 'http://tv.biobiochile.cl/notas/2015/10/21/sobre-camaras-y-camarillas-parlamentarias.shtml',. 'md5': '26f51f03cf580265defefb4518faec09',. 'info_dict': {. 'id': 'sobre-camaras-y-camarillas-parlamentarias',. 'ext': 'mp4',. 'title': 'Sobre C.maras y camarillas parlamentarias',. 'thumbnail': r're:^https?://.*\.jpg$',. 'uploader': 'Fernando Atria',. },. 'skip': 'URL expired and redirected to http://www.biobiochile.cl/portada/bbtv/index.html',. }, {. # different uploader layout. 'url': 'http://tv.biobiochile.cl/notas/2016/03/18/natalia-valdebenito-repasa-a-diputado-ha

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\biqle.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3495
Entropy (8bit):	4.712092028453331
Encrypted:	false
SSDEEP:	96:uQRp1eR/5EcrIeadtq7fqUBoCy21v6DLFE6v2MBTeIq6NB3WNW8q:uQleXjIHds7qCyWvIBTv2kTe6NBWq
MD5:	12CA58C6BE900D5E1575E8548FB2216D
SHA1:	0274C47B63000B209DE9AB3CDE174BCDB427FCE1
SHA-256:	32404DF5B56990725D6166FAB869D2FC47B374D25F017A476A7E9224D1B88156
SHA-512:	E0A680D650258EABF27BBFBC36B996DEEAC318729397B9FCEFFEC8F818C38DD9D02848033D5DF443801840912638E175FDD317FD9D9F536A1B9E5337AE387B27
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .vk import VKIE.from ..utils import (. HEADRequest,. int_or_none,.)...class BIQLEIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?biqle\.(?:com\|org\|ru)/watch/(?P<id>-?\d+_\d+)'. _TESTS = [{. # Youtube embed. 'url': 'https://biqle.ru/watch/-115995369_456239081',. 'md5': '97af5a06ee4c29bbf9c001bdb1cf5c06',. 'info_dict': {. 'id': '8v4f-avW-VI',. 'ext': 'mp4',. 'title': "PASSE-PARTOUT - L'ete c'est fait pour jouer",. 'description': 'Passe-Partout',. 'uploader_id': 'mrsimpsonstef3',. 'uploader': 'Phanolito',. 'upload_date': '20120822',. },. }, {. 'url': 'http://biqle.org/watch/-44781847_168547604',. 'md5': '7f24e72af1db0edf7c1aaba513174f97',. 'info_dict': {. 'id': '-44781847_168547604',. 'ext': 'mp4',. 'title': '.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bitchute.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5034
Entropy (8bit):	4.8280129419868
Encrypted:	false
SSDEEP:	96:hcQiGPqXDDAjfdrRzBPJx96SxTQWBTTWzNiWDClgtm6NGzpcIK+lkPkiCc3IoU3:WQfuDMdrJxcSxTQyTTJj6N4p3dipIf
MD5:	BF38E7F42FD988685828368DB9AAB1FA
SHA1:	09216D1D340F7ADE1525DF1D9E08791DDC45B1CC
SHA-256:	D99D22A404B538196FFDDC4143C8C30D0BADDA44957BFA0FC0AD908D84AD1976
SHA-512:	219259F3CB335AA856A5066A9B96BEFBFF7EEFF32095259058E89DF436A3E8F3407105F2C2DA297DA622B8D17977596931E643223F4838CE42794C41F23572DA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..utils import (. orderedSet,. urlencode_postdata,.)...class BitChuteIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bitchute\.com/(?:video\|embed\|torrent/[^/]+)/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.bitchute.com/video/szoMrox2JEI/',. 'md5': '66c4a70e6bfc40dcb6be3eb1d74939eb',. 'info_dict': {. 'id': 'szoMrox2JEI',. 'ext': 'mp4',. 'title': 'Fuck bitches get money',. 'description': 'md5:3f21f6fb5b1d17c3dee9cf6b5fe60b3a',. 'thumbnail': r're:^https?://.*\.jpg$',. 'uploader': 'Victoria X Rave',. },. }, {. 'url': 'https://www.bitchute.com/embed/lbb5G1hjPhw/',. 'only_matching': True,. }, {. 'url': 'https://www.bitchute.com/torrent/Zee5BE49045h/szoMrox2JEI.webtorrent',. 'only_matching': True,. }].. def _real_e

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bleacherreport.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4206
Entropy (8bit):	4.8087663260896685
Encrypted:	false
SSDEEP:	96:V89psWWqgZWF/dvtW8FotfXFFoGtKV8/tALXpfe:q9GPqgIFlvkFNTJ/Ke
MD5:	3E8421C2E7A40B4B0D15A3D43A3F6BEB
SHA1:	88CE9ED0C02EBCE22DFCAD2957FCD3AB5FD4FBF2
SHA-256:	3E2E227CF0BD23F6E1EF6D838C5AFD168FC568BB37E04EA2EB10AEADFE6B45D2
SHA-512:	F518BA46134BD4274D96E1CA2E808DEC2382A38301B36623266FF72A97ECC998EE7E45266AB7DDB818FDA5172303815143110C726E927A80F41358F7ACAA0560
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .amp import AMPIE.from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,.)...class BleacherReportIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bleacherreport\.com/articles/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://bleacherreport.com/articles/2496438-fsu-stat-projections-is-jalen-ramsey-best-defensive-player-in-college-football',. 'md5': 'a3ffc3dc73afdbc2010f02d98f990f20',. 'info_dict': {. 'id': '2496438',. 'ext': 'mp4',. 'title': 'FSU Stat Projections: Is Jalen Ramsey Best Defensive Player in College Football?',. 'uploader_id': 3992341,. 'description': 'CFB, ACC, Florida State',. 'timestamp': 1434380212,. 'upload_date': '20150615',. 'uploader': 'Team Stream Now ',. },. 'add_ie': ['Ooyala'],. }, {. 'url': 'http://bleacherrepo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\blinkx.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3217
Entropy (8bit):	4.58255570509069
Encrypted:	false
SSDEEP:	96:dqwe13ArV/npr1EXQTuIXdelipauPnBTz26NU6e8B:dLesxprwjodeliQiBTz26NUUB
MD5:	5378ADC6C2E74BC4F9DBA8FF7D56B119
SHA1:	25FF2B130728375BF08D7491F3550B9DC6B3D6F6
SHA-256:	6382B3CB35910A4FB8CA675E9C33F6A2ECC7E22E9F86C5661ABC5F8E06AFE182
SHA-512:	FA1720D2F407B9C902CEABAAAF638DAF17FB3619BA74C70E14C58238D76437C322D1928B6B45051A1DCC791E41730DD0E82DE371225B57F20C1E0CEF65B2E4DF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import (. remove_start,. int_or_none,.)...class BlinkxIE(InfoExtractor):. _VALID_URL = r'(?:https?://(?:www\.)blinkx\.com/#?ce/\|blinkx:)(?P<id>[^?]+)'. IE_NAME = 'blinkx'.. _TEST = {. 'url': 'http://www.blinkx.com/ce/Da0Gw3xc5ucpNduzLuDDlv4WC9PuI4fDi1-t6Y3LyfdY2SZS5Urbvn-UPJvrvbo8LTKTc67Wu2rPKSQDJyZeeORCR8bYkhs8lI7eqddznH2ofh5WEEdjYXnoRtj7ByQwt7atMErmXIeYKPsSDuMAAqJDlQZ-3Ff4HJVeH_s3Gh8oQ',. 'md5': '337cf7a344663ec79bf93a526a2e06c7',. 'info_dict': {. 'id': 'Da0Gw3xc',. 'ext': 'mp4',. 'title': 'No Daily Show for John Oliver; HBO Show Renewed - IGN News',. 'uploader': 'IGN News',. 'upload_date': '20150217',. 'timestamp': 1424215740,. 'description': 'HBO has renewed Last Week Tonight With John Oliver for two more seasons.',. 'duration': 47.743333,. },. }..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bloomberg.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3323
Entropy (8bit):	4.8911573714337955
Encrypted:	false
SSDEEP:	96:MHBkmyfT9kvmXGVQnuffpoP7k7kMzJPO8gi8y3BT06N23:wBCTavHVQeTkMzRO8gi8AT06NW
MD5:	770C8A51F1369F5DC73BBD5E80DC2BD2
SHA1:	96CACE1F4CD8A3EF6CA792D4C374D4FEA9374D54
SHA-256:	C98FC1FFE6D3AAD9470FCFADA9D31DC3B465D41B64521D9E86EFB09DE541183C
SHA-512:	4EA26B68513EBF8248F40EB30EEE6D9EE6DA8E4D22CF79B45C91A67ADCD6149628DC20F9CB8BC99D0E52335B537E827031159652720172C42BBB36B785A7E4EF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class BloombergIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bloomberg\.com/(?:[^/]+/)*(?P<id>[^/?#]+)'.. _TESTS = [{. 'url': 'http://www.bloomberg.com/news/videos/b/aaeae121-5949-481e-a1ce-4562db6f5df2',. # The md5 checksum changes. 'info_dict': {. 'id': 'qurhIVlJSB6hzkVi229d8g',. 'ext': 'flv',. 'title': 'Shah\'s Presentation on Foreign-Exchange Strategies',. 'description': 'md5:a8ba0302912d03d246979735c17d2761',. },. 'params': {. 'format': 'best[format_id^=hds]',. },. }, {. # video ID in BPlayer(...). 'url': 'http://www.bloomberg.com/features/2016-hello-world-new-zealand/',. 'info_dict': {. 'id': '938c7e72-3f25-4ddb-8b85-a9be731baa74',. 'ext': 'flv',. 'title': 'Meet the Real-Life Tech Wizards of Middle Earth',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bokecc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1958
Entropy (8bit):	5.004791128444898
Encrypted:	false
SSDEEP:	48:+uy+mq3kqXrWksLuia9QbWBTCXBE3fzcfvKfFILa5j9dkI/RR:uFq3k4W8ioBTCXSvzcfvnm8I/RR
MD5:	3D71DF35A5150DBCB5AD12118D6189BC
SHA1:	EADBD9675637E3C4A306C5A79B91699E7E5A3EBA
SHA-256:	1CC95014E85E8ABEA50629EA6771FFDAB4B45E4A0E727B35686646217E0271DE
SHA-512:	37B8290438204798BF0E80A0A81B500193B9E6684057E1263A2AEE6E4D9EC0E1376E8A8097EAEBC44CBD7636B1713244C6B8FCDC4088E7AA62F15CCC549CD905
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_parse_qs.from ..utils import ExtractorError...class BokeCCBaseIE(InfoExtractor):. def _extract_bokecc_formats(self, webpage, video_id, format_id=None):. player_params_str = self._html_search_regex(. r'<(?:script\|embed)[^>]+src="http://p\.bokecc\.com/player\?([^"]+)',. webpage, 'player params').. player_params = compat_parse_qs(player_params_str).. info_xml = self._download_xml(. 'http://p.bokecc.com/servlet/playinfo?uid=%s&vid=%s&m=1' % (. player_params['siteid'][0], player_params['vid'][0]), video_id).. formats = [{. 'format_id': format_id,. 'url': quality.find('./copy').attrib['playurl'],. 'preference': int(quality.attrib['value']),. } for quality in info_xml.findall('./video/quality')].. self._sort_formats(formats).. return

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bostonglobe.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3192
Entropy (8bit):	4.840244227579824
Encrypted:	false
SSDEEP:	96:6x0wsY7JKrpUdsjSEDzZAbdpMxEzmSiDYTQy:ynNKecYbfkQkDoQy
MD5:	13588B76729DE2B4F6D3DBEB96290E19
SHA1:	07003E547A78EA7B8F2F4F6B07D92BA88B16C786
SHA-256:	FCC828AEF454A2071DAC9C3453912B71988E267D8FADC073CBDAEA4F38142692
SHA-512:	8B6E29E5E987457534E323F097362AC90F6FE36ED2C0DC0644C5EF40C8302617A1BFCF77AE26077B8AFE94ECED0BE57D13712A7D3FC1261373F905771AC157A9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor..from ..utils import (. extract_attributes,.)...class BostonGlobeIE(InfoExtractor):. _VALID_URL = r'(?i)https?://(?:www\.)?bostonglobe\.com/.*/(?P<id>[^/]+)/\w+(?:\.html)?'. _TESTS = [. {. 'url': 'http://www.bostonglobe.com/metro/2017/02/11/tree-finally-succumbs-disease-leaving-hole-neighborhood/h1b4lviqzMTIn9sVy8F3gP/story.html',. 'md5': '0a62181079c85c2d2b618c9a738aedaf',. 'info_dict': {. 'title': 'A tree finally succumbs to disease, leaving a hole in a neighborhood',. 'id': '5320421710001',. 'ext': 'mp4',. 'description': 'It arrived as a sapling when the Back Bay was in its infancy, a spindly American elm tamped down into a square of dirt cut into the brick sidewalk of 1880s Marlborough Street, no higher than the first bay window of the new brownstone behind it.',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bpb.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2204
Entropy (8bit):	4.714492929423355
Encrypted:	false
SSDEEP:	48:+udWxtYEYzMXDwD7bClkk8ajXjlkdXYgMp57uM4Lc0LxPGkQXlBTg6Nnx:kvYEYzMTwDHCak8aqLkzJCPGvVBTg6Nx
MD5:	CA34293A1EBC6157639561FD7ECA407C
SHA1:	EB2F93194CDAEFC3FB10D6DD2CB5186493CFA4E9
SHA-256:	D9BF6EB363618406659CFD2AAEBEACDBE0DF75F296C76F0030D1858FBA751499
SHA-512:	242EF22A8BCEB9AC4C2FD9966B0BE3C96E6E86AD39BC635105B292AC215149B8D5D9C73F27B0E0D7A1F3C1E25F9E845D099E00CE1E5D4CED032F044C94D7FED0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. js_to_json,. determine_ext,.)...class BpbIE(InfoExtractor):. IE_DESC = 'Bundeszentrale f.r politische Bildung'. _VALID_URL = r'https?://(?:www\.)?bpb\.de/mediathek/(?P<id>[0-9]+)/'.. _TEST = {. 'url': 'http://www.bpb.de/mediathek/297/joachim-gauck-zu-1989-und-die-erinnerung-an-die-ddr',. # md5 fails in Python 2.6 due to buggy server response and wrong handling of urllib2. 'md5': 'c4f84c8a8044ca9ff68bb8441d300b3f',. 'info_dict': {. 'id': '297',. 'ext': 'mp4',. 'title': 'Joachim Gauck zu 1989 und die Erinnerung an die DDR',. 'description': 'Joachim Gauck, erster Beauftragter f.r die Stasi-Unterlagen, spricht auf dem Geschichtsforum .ber die friedliche Revolution 1989 und eine "gewisse Traurigkeit" im Umgang mit der DDR-Vergangenheit.'. }. }.. def _real_extract(sel

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\br.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11903
Entropy (8bit):	4.453772305248068
Encrypted:	false
SSDEEP:	192:edLN0uVh+YrJy5GLnoxxTHF2vGieO8hPEoGTsoK7zua7XAV7qya+yaf6CqyaOy7M:qLN0uVh+YrqGMxVHkvGieO8h8oGTshz0
MD5:	265967D6B5CC1B539578B35771EF9374
SHA1:	6995093C2C98189DBEB0C309A576D645C3463669
SHA-256:	A25C956FCE90CE6536FE82C52EB2AF4A22E0F9CE3FFBCCBA4631FC3A4301CFF9
SHA-512:	97FB447BDF91E96F23C3D27B6B5FB0DA288D01AF1989E69CB7A7531846B50CDD12706CDE5491CF793A62481CCB576B6161EA112FA8B6DA1D2D12F91D5665A18B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_duration,. parse_iso8601,. xpath_element,. xpath_text,.)...class BRIE(InfoExtractor):. IE_DESC = 'Bayerischer Rundfunk'. _VALID_URL = r'(?P<base_url>https?://(?:www\.)?br(?:-klassik)?\.de)/(?:[a-z0-9\-_]+/)+(?P<id>[a-z0-9\-_]+)\.html'.. _TESTS = [. {. 'url': 'http://www.br.de/mediathek/video/sendungen/abendschau/betriebliche-altersvorsorge-104.html',. 'md5': '83a0477cf0b8451027eb566d88b51106',. 'info_dict': {. 'id': '48f656ef-287e-486f-be86-459122db22cc',. 'ext': 'mp4',. 'title': 'Die b.se .berraschung',. 'description': 'md5:ce9ac81b466ce775b8018f6801b48ac9',. 'duration': 180,. 'uploader': 'Reinhard Weber',. 'upload_date': '2

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\bravotv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3460
Entropy (8bit):	4.679435564493168
Encrypted:	false
SSDEEP:	96:19dWmMKsQHzavRfJsaNG5BGF05Si4S+wqmXaT:NhzsC+vZJsp5BjSJyXE
MD5:	259C700CF3899181C1F6F610120D4D32
SHA1:	D62A51041006034A5FBF68710B9988FCAEEBCC33
SHA-256:	75FA2D85F07DC5401246B06F84FFF3F4F9D8249CCC90A836B081B08FB96DEF58
SHA-512:	EC3FF7F59BB7B696A74F335250C82D447204859A7B518BD864BB664930F9B246F98B358D0DE913A56EF2E96E09C6B8FCB613360C4512C4BA0D7A9F30974F7141
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .adobepass import AdobePassIE.from ..utils import (. smuggle_url,. update_url_query,. int_or_none,.)...class BravoTVIE(AdobePassIE):. _VALID_URL = r'https?://(?:www\.)?bravotv\.com/(?:[^/]+/)+(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'https://www.bravotv.com/top-chef/season-16/episode-15/videos/the-top-chef-season-16-winner-is',. 'md5': 'e34684cfea2a96cd2ee1ef3a60909de9',. 'info_dict': {. 'id': 'epL0pmK1kQlT',. 'ext': 'mp4',. 'title': 'The Top Chef Season 16 Winner Is...',. 'description': 'Find out who takes the title of Top Chef!',. 'uploader': 'NBCU-BRAV',. 'upload_date': '20190314',. 'timestamp': 1552591860,. }. }, {. 'url': 'http://www.bravotv.com/below-deck/season-3/ep-14-reunion-part-1',. 'only_matching': True,. }].. def _real_extract(self, url):. display_id = self

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\breakcom.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2950
Entropy (8bit):	4.68809524360337
Encrypted:	false
SSDEEP:	48:PuWRb5fm5lDOmrBgBpYvNqvm+tPtfJulfFIjhBHMcuXH94CDQqLbR68dG7/QBTXT:rbBUDOeGfYvsvdVfJuWBHW94C8sRRdG0
MD5:	A139D841354C61FE1D73D5F5E79E39D7
SHA1:	104524D0EE0E1D22D75674BBE3F4F83E338AF924
SHA-256:	DB6E9E0A8E5FBC86AECB3D20B24BB2C0B5768107AE935CA6AB76091D2EEB3B10
SHA-512:	6E32675F127C6F67436FF254C9B4B667D8E24037FF3BF043BF113B1AAB18D7EDA1FE69D2E97028CB7B0C78E63A12FBE28407EFA96E35C75444FD100716D35413
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .youtube import YoutubeIE.from ..utils import (. int_or_none,. url_or_none,.)...class BreakIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?break\.com/video/(?P<display_id>[^/]+?)(?:-(?P<id>\d+))?(?:[/?#&]\|$)'. _TESTS = [{. 'url': 'http://www.break.com/video/when-girls-act-like-guys-2468056',. 'info_dict': {. 'id': '2468056',. 'ext': 'mp4',. 'title': 'When Girls Act Like D-Bags',. 'age_limit': 13,. },. }, {. # youtube embed. 'url': 'http://www.break.com/video/someone-forgot-boat-brakes-work',. 'info_dict': {. 'id': 'RrrDLdeL2HQ',. 'ext': 'mp4',. 'title': 'Whale Watching Boat Crashing Into San Diego Dock',. 'description': 'md5:afc1b2772f0a8468be51dd80eb021069',. 'upload_date': '20160331',. 'uploader': 'Steve Holden',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\brightcove.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (484)
Category:	dropped
Size (bytes):	35338
Entropy (8bit):	4.667598241947362
Encrypted:	false
SSDEEP:	768:K0dqlDzkG4jbI1qLWgttpi3gOtN1YkiTTkewtb+/tiyzHfGOGVoGRQ3ivOoTw/nk:AZ4OqLWgtts3gOtN1YkiTTkewtb+/tib
MD5:	88B65F1E124F635E0CDCE3955EC21717
SHA1:	6521F0D692F1DAABF085B46FC240E2D8CA9BEE50
SHA-256:	A10859E41A73227EAF618B51C44CFF8588C4720259D40735DFBDA80A9D8F6529
SHA-512:	E359A71D3F09D2E63AC124A768A3C4BA8401BAC76C07F87C6B48B64CEA463DE60A9ACC0762A0D41171CABF2C6472ACCE68195B90A13718A5B3A1BD215A00CB77
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import json.import re.import struct..from .common import InfoExtractor.from .adobepass import AdobePassIE.from ..compat import (. compat_etree_fromstring,. compat_parse_qs,. compat_str,. compat_urllib_parse_urlparse,. compat_urlparse,. compat_xml_parse_error,. compat_HTTPError,.).from ..utils import (. determine_ext,. ExtractorError,. extract_attributes,. find_xpath_attr,. fix_xml_ampersands,. float_or_none,. js_to_json,. int_or_none,. parse_iso8601,. unescapeHTML,. unsmuggle_url,. update_url_query,. clean_html,. mimetype2ext,.)...class BrightcoveLegacyIE(InfoExtractor):. IE_NAME = 'brightcove:legacy'. _VALID_URL = r'(?:https?://.brightcove\.com/(services\|viewer).?\?\|brightcove:)(?P<query>.*)'. _FEDERATED_URL = 'http://c.brightcove.com/services/viewer/htmlFederated'.. _TESTS = [. {. # From http://www.8tv.cat/8aldia/videos/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\businessinsider.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1632
Entropy (8bit):	5.08963567959958
Encrypted:	false
SSDEEP:	48:+uVkeVKZf+OxK3ZuKttIN2aBXctfjXjlkoqBOkw+usv:Cf+OxK3sQtIoiSfqotAv
MD5:	D413AD832659A6F0C579DEC521D4AE59
SHA1:	5C62EADDDC0D626BC69F1101C38D0E65CD4E9800
SHA-256:	75B94969880DD508E3F675E40DDF9142E4E8B7ABD8CB046C848623BBC2A3A8CA
SHA-512:	4AC65F08C7B7E4D5256B2BF9E19653709C35C11E60020DA2D02F2B94B825B4DC59D5547F0DC0B524E73007C0C4AC2D315126A0B034A78967915957AA79850A73
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .jwplatform import JWPlatformIE...class BusinessInsiderIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?businessinsider\.(?:com\|nl)/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://uk.businessinsider.com/how-much-radiation-youre-exposed-to-in-everyday-life-2016-6',. 'md5': 'ca237a53a8eb20b6dc5bd60564d4ab3e',. 'info_dict': {. 'id': 'hZRllCfw',. 'ext': 'mp4',. 'title': "Here's how much radiation you're exposed to in everyday life",. 'description': 'md5:9a0d6e2c279948aadaa5e84d6d9b99bd',. 'upload_date': '20170709',. 'timestamp': 1499606400,. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'https://www.businessinsider.nl/5-scientifically-proven-things-make-you-less-attractive-2017-7/',. 'only_matching': True,. }, {. 'url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\buzzfeed.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3655
Entropy (8bit):	4.655535835487998
Encrypted:	false
SSDEEP:	96:uvvB2lCB2v+ALNmHSjex6bLCvbWebLX15NXQAKFyo4p+C7ZyfOkpxvF:QZDKLcMexLCWyYofC7ZgXxt
MD5:	F364AF9C9F564E02CA8EB71A804A6A09
SHA1:	A32F915113498934D904B18CB0378E9D2A6CFD4C
SHA-256:	E9632B18F17D9CB69894CD091B7B12AF501328C88D89F0DE866A1FD87934120D
SHA-512:	E0C70D6574380A506FE516D493318BE5D7932C93C741E1BF9B472402815869F1E0B365866897F7D8803B4AE09EBFFA45FB0A56090F18338C2183518B49FA7658
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from .facebook import FacebookIE...class BuzzFeedIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?buzzfeed\.com/[^?#]*?/(?P<id>[^?#]+)'. _TESTS = [{. 'url': 'http://www.buzzfeed.com/abagg/this-angry-ram-destroys-a-punching-bag-like-a-boss?utm_term=4ldqpia',. 'info_dict': {. 'id': 'this-angry-ram-destroys-a-punching-bag-like-a-boss',. 'title': 'This Angry Ram Destroys A Punching Bag Like A Boss',. 'description': 'Rambro!',. },. 'playlist': [{. 'info_dict': {. 'id': 'aVCR29aE_OQ',. 'ext': 'mp4',. 'title': 'Angry Ram destroys a punching bag..',. 'description': 'md5:c59533190ef23fd4458a5e8c8c872345',. 'upload_date': '20141024',. 'uploader_id': 'Buddhanz1',. 'uploader': 'Angry Ram',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\byutv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3353
Entropy (8bit):	4.7926963830522
Encrypted:	false
SSDEEP:	96:q5WEIi3V4IN003r/uFZqIWKlH1tmlfGlxbBpd93NhBTVxoEa6Ng:Pzi3N0EYZqc11twGvbzd93NvTVM6Ng
MD5:	32E096A2A13A5B4ADA8B324602A251C3
SHA1:	88BC0B43C861F9A9FA6FD40B018E1270A5CD7DAD
SHA-256:	198C7B546F29A4B42B4F4B4D6CDAA3E346F199184B9D305BB8746F69ABC7C139
SHA-512:	6C955CA352055B2E39F2375380FEF6ACF5E2DCD13E515AC2AFBE626F199BDB6637A8CDA01E6005D48EAEC2EFA0D9206FD26D8A543944DB1ED9622C34F9BB06EC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import parse_duration...class BYUtvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?byutv\.org/(?:watch\|player)/(?!event/)(?P<id>[0-9a-f-]+)(?:/(?P<display_id>[^/?#&]+))?'. _TESTS = [{. # ooyalaVOD. 'url': 'http://www.byutv.org/watch/6587b9a3-89d2-42a6-a7f7-fd2f81840a7d/studio-c-season-5-episode-5',. 'info_dict': {. 'id': 'ZvanRocTpW-G5_yZFeltTAMv6jxOU9KH',. 'display_id': 'studio-c-season-5-episode-5',. 'ext': 'mp4',. 'title': 'Season 5 Episode 5',. 'description': 'md5:1d31dc18ef4f075b28f6a65937d22c65',. 'thumbnail': r're:^https?://.*',. 'duration': 1486.486,. },. 'params': {. 'skip_download': True,. },. 'add_ie': ['Ooyala'],. }, {. # dvr. 'url': 'https://www.byutv.org/player/8f1dab9b-b243-47c8-b525-3e2d021a3451/byu-softball-p

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\c56.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2083
Entropy (8bit):	4.9613459361404955
Encrypted:	false
SSDEEP:	48:+ubZTdfQn48Qd5Qr7obZfdfFxSxABKFugZPBsbc+xN0wKBTLZvA6N1d:vZpQnBQd5QYbZfcB8cON2BTLZvA6N1d
MD5:	3C5FD11929C9902B53C53B19FEEA6C41
SHA1:	93CB462E4F951C52BC65946540E80B5790EB7C68
SHA-256:	2548703D367928688A3C98356E91B55FF50E042587F608AC8178AA0AD2A49D91
SHA-512:	CBE711A936866AD57BB4A7BD572EEF3DC03A969032E56F1226BA728056BA2D16A09EA2D74CE72D7C3AB1B6D5E32BCC616F1B26D5A48BBDBBB192638A5DA7FF53
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import js_to_json...class C56IE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\|player)\.)?56\.com/(?:.+?/)?(?:v_\|(?:play_album.+-))(?P<textid>.+?)\.(?:html\|swf)'. IE_NAME = '56.com'. _TESTS = [{. 'url': 'http://www.56.com/u39/v_OTM0NDA3MTY.html',. 'md5': 'e59995ac63d0457783ea05f93f12a866',. 'info_dict': {. 'id': '93440716',. 'ext': 'flv',. 'title': '..... .32....',. 'duration': 283.813,. },. }, {. 'url': 'http://www.56.com/u47/v_MTM5NjQ5ODc2.html',. 'md5': '',. 'info_dict': {. 'id': '82247482',. 'title': '.........',. },. 'playlist_count': 7,. 'add_ie': ['Sohu'],. }].. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url, flags=re.VERBOSE). text_id = m

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\camdemy.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5772
Entropy (8bit):	4.836396498816189
Encrypted:	false
SSDEEP:	96:Cw2smdjvXej/ERCjsXMYTpsliZwqfabNKPLyjQUPdEeNB0kHi5TIANmooId3D6ou:/2s0eERKyiA3audTz3DKaU2C
MD5:	D93EB84E4E17968FB28F33E0080B1C70
SHA1:	AFBD5A12A4E50AA7304AD8ED3A953AAF1B2C838E
SHA-256:	125DE3C23A5DC5F6447FB26F1AFD9AA8F320367DF001C7B9946113E85299416F
SHA-512:	78FBA6109B7A422EDAB7628877E2E90CF779F5EC9549ADB175CC5F516705CF4EA92BA7F51AF64DEEF8D4C8B79BD9FA8352D983DEBA3A87D5E0B7CA4774D73097
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_urlparse,.).from ..utils import (. clean_html,. parse_duration,. str_to_int,. unified_strdate,.)...class CamdemyIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?camdemy\.com/media/(?P<id>\d+)'. _TESTS = [{. # single file. 'url': 'http://www.camdemy.com/media/5181/',. 'md5': '5a5562b6a98b37873119102e052e311b',. 'info_dict': {. 'id': '5181',. 'ext': 'mp4',. 'title': 'Ch1-1 Introduction, Signals (02-23-2012)',. 'thumbnail': r're:^https?://.*\.jpg$',. 'creator': 'ss11spring',. 'duration': 1591,. 'upload_date': '20130114',. 'view_count': int,. }. }, {. # With non-empty description. # webpage returns "No permission or not login". 'url': 'http://www.camdemy.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cammodels.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3478
Entropy (8bit):	4.081156785097402
Encrypted:	false
SSDEEP:	48:+uXH6XfJB5fNXhTZqXGlk58Jg4wDBORojCUxsC3Cql6nVT5boRAx47WBTNm+6N0:zGdfBY81oxxnlcnoRAxWWBT96N0
MD5:	94B4BD2443E7DF665630BA17AED8DC77
SHA1:	5B6B43EF3ED5E54646BE6424D4EF2DEAB9492439
SHA-256:	905DB35D3F04A6BE179AAA5964A8BBD5586B36155E1FC39C7318197D1C8910E1
SHA-512:	E52BD584A845EA7CFAFD581A7D0795664D39FE492820156E45E1F50D6C485D750C550CE33F8024A4D84CE8459C67D850247F3E72752B82F9AD2D9507A8EC9E1B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. url_or_none,.)...class CamModelsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cammodels\.com/cam/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.cammodels.com/cam/AutumnKnight/',. 'only_matching': True,. 'age_limit': 18. }].. def _real_extract(self, url):. user_id = self._match_id(url).. webpage = self._download_webpage(. url, user_id, headers=self.geo_verification_headers()).. manifest_root = self._html_search_regex(. r'manifestUrlRoot=([^&\']+)', webpage, 'manifest', default=None).. if not manifest_root:. ERRORS = (. ("I'm offline, but let's stay connected", 'This user is currently offline'),. ('in a private show', 'This user is in a private show'),. ('is currently performing LIVE', '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\camtube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2215
Entropy (8bit):	4.67510422229021
Encrypted:	false
SSDEEP:	48:+u+nfTbYDCx6clN8Wn+giJoXBBNgmmYBMYloL5NluRwv4mDXaD/w0HeU8cflyT6y:ifgu0clqWn+FJPmKYO9NlC+4mza/w0+1
MD5:	B50EB09F077A6C859DD7F87E2E0E9234
SHA1:	114D3E94800F50318C6E8CE198317209C4659DA4
SHA-256:	77241AC6FC20F96133C45FAFCFF808A0EA950EC1E0FFDA3D58CE94FB73453EFD
SHA-512:	3E08AD51C6BE53744B405059DACEAEBD6071404CFFA9A4DFCCA4B8FC0EF5D689519CF5EC3EC19A2E8E48A39B81DF3EF45F8C17979394AFB1564BB925B7515E95
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_timestamp,.)...class CamTubeIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\|api)\.)?camtube\.co/recordings?/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://camtube.co/recording/minafay-030618-1136-chaturbate-female',. 'info_dict': {. 'id': '42ad3956-dd5b-445a-8313-803ea6079fac',. 'display_id': 'minafay-030618-1136-chaturbate-female',. 'ext': 'mp4',. 'title': 'minafay-030618-1136-chaturbate-female',. 'duration': 1274,. 'timestamp': 1528018608,. 'upload_date': '20180603',. 'age_limit': 18. },. 'params': {. 'skip_download': True,. },. }].. _API_BASE = 'https://api.camtube.co'.. def _real_extract(self, url):. display_id = self._match_id(url).. token = self._download_json(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\camwithher.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3229
Entropy (8bit):	4.8025970080066
Encrypted:	false
SSDEEP:	96:T5JunK/zLsvnBGPtfa3iDmjsKKj+3Xacci8I0D:lJ01vnBGPNaEbP
MD5:	A082672A0E47EE76BFD03991FF907B43
SHA1:	4BE580F3FA90F3B3A752828A958B89646E486DDB
SHA-256:	0093661ABB0EABDF7EC946FBF8B39FDFF4E36F16F31053FEBC4D46A5812D5912
SHA-512:	37CBEDBD6745F50C12411D43480444F15C394B9DA5BD0928F0134779DC944315A10DA91A000A38855966F3B5A7C4F10AFCA8BA7DD63700D488A6B8DC7B17037D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. unified_strdate,.)...class CamWithHerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?camwithher\.tv/view_video\.php\?.*\bviewkey=(?P<id>\w+)'.. _TESTS = [{. 'url': 'http://camwithher.tv/view_video.php?viewkey=6e9a24e2c0e842e1f177&page=&viewtype=&category=',. 'info_dict': {. 'id': '5644',. 'ext': 'flv',. 'title': 'Periscope Tease',. 'description': 'In the clouds teasing on periscope to my favorite song',. 'duration': 240,. 'view_count': int,. 'comment_count': int,. 'uploader': 'MileenaK',. 'upload_date': '20160322',. 'age_limit': 18,. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'http://camwithher.tv/view_video.php?viewkey=6dfd8b7c97531a459937',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\canalc2.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2317
Entropy (8bit):	4.58713378158506
Encrypted:	false
SSDEEP:	48:+ujSFpfRVoWRZ2o6SERttfjXhycdXnkNlDksaALIrnRmZbs6NQp6lBJULEK+EKz:PSPMWRZ36SE1fRtkNlDksaQIrRm9s6ND
MD5:	FB326BDC3766FC20BEC386BF3165DD88
SHA1:	CF8FD96D82B244BABBA27E52DD522C6D5C59676F
SHA-256:	8443738E54FD11219E3E25C81AF951D988AC9A607624F5417EDE7F0C2F94AED2
SHA-512:	76DDFC6304E54F49201C4AB6EC50E1B6A2B891C24D04127A7B1F3BEF48E3050BCD8352FAD78774413EEC2A3B11E0C41A633DD66599DBDCB3A8D3679C69C84405
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import parse_duration...class Canalc2IE(InfoExtractor):. IE_NAME = 'canalc2.tv'. _VALID_URL = r'https?://(?:(?:www\.)?canalc2\.tv/video/\|archives-canalc2\.u-strasbg\.fr/video\.asp\?.*\bidVideo=)(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.canalc2.tv/video/12163',. 'md5': '060158428b650f896c542dfbb3d6487f',. 'info_dict': {. 'id': '12163',. 'ext': 'mp4',. 'title': 'Terrasses du Num.rique',. 'duration': 122,. },. }, {. 'url': 'http://archives-canalc2.u-strasbg.fr/video.asp?idVideo=11427&voir=oui',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(. 'http://www.canalc2.tv/video/%s' % video_id, video_id).. title = self._html_search_regex(. r'(?s)class="[^

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\canalplus.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4474
Entropy (8bit):	4.833024368222409
Encrypted:	false
SSDEEP:	96:avXs9vqfuLd29v4X65kTqfD4S9yBdc2hubMIOrKixQVa3BTexwWBle3aDi6Ng:eXcvB521ZwYD4Sg3hKMIOrKi+V4T2jBC
MD5:	1C90F84FCAC485B715A412C62503A2DC
SHA1:	F65C9AEC40CC04FF19589A0B638F50506F2508F7
SHA-256:	D98A4E750CFDC24A84D1FD211F48890BF41E0132CA8A5969541FEE6FCBA9A7B1
SHA-512:	AD49AFD27C49B95F83F02CB83649BEFB5111836AA35D879CF8D83296D952402E3C43FFC17ED0F8712A2025DD8AAC8D4EBD1DC7F02789417072252C8EB2FE095F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. # ExtractorError,. # HEADRequest,. int_or_none,. qualities,. unified_strdate,.)...class CanalplusIE(InfoExtractor):. IE_DESC = 'mycanal.fr and piwiplus.fr'. _VALID_URL = r'https?://(?:www\.)?(?P<site>mycanal\|piwiplus)\.fr/(?:[^/]+/)(?P<display_id>[^?/]+)(?:\.html\?.\bvid=\|/p/)(?P<id>\d+)'. _VIDEO_INFO_TEMPLATE = 'http://service.canal-plus.com/video/rest/getVideosLiees/%s/%s?format=json'. _SITE_ID_MAP = {. 'mycanal': 'cplus',. 'piwiplus': 'teletoon',. }.. # Only works for direct mp4 URLs. _GEO_COUNTRIES = ['FR'].. _TESTS = [{. 'url': 'https://www.mycanal.fr/d17-emissions/lolywood/p/1397061',. 'info_dict': {. 'id': '1397061',. 'display_id': 'lolywood',. 'ext': 'mp4',. 'title': 'Euro 2016 : Je pr.f.re te pr.venir - Lolywood - Episode 34',. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\canvas.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12336
Entropy (8bit):	4.754936423552399
Encrypted:	false
SSDEEP:	384:BIqbxjLzOrHirRorfsr1hTYF6NTHSFiFM0y8cECmVn/fj:qixjLzOrHirRorfsr1hTI8u9Gbd/L
MD5:	5F5D80C593FC731DF9417C9C0307D500
SHA1:	45B4D27D4315B2119BD56F08E849DE809641F3DB
SHA-256:	B40CA46E04299F38226A30DB40012D94C3F8BA188ADBF5DE5EFBFF8A6DB47080
SHA-512:	F77333849082CDAB657D6786E417628A014478E090E042683F22B5B50C78A3333D632BFAC6A31E0DD936F627EE8FF7F353D6CDB3F5419007EA107EB5337D19C8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from .gigya import GigyaBaseIE.from ..compat import compat_HTTPError.from ..utils import (. ExtractorError,. strip_or_none,. float_or_none,. int_or_none,. merge_dicts,. parse_iso8601,.)...class CanvasIE(InfoExtractor):. _VALID_URL = r'https?://mediazone\.vrt\.be/api/v1/(?P<site_id>canvas\|een\|ketnet\|vrt(?:video\|nieuws)\|sporza)/assets/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://mediazone.vrt.be/api/v1/ketnet/assets/md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'md5': '90139b746a0a9bd7bb631283f6e2a64e',. 'info_dict': {. 'id': 'md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'display_id': 'md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'ext': 'flv',. 'title': 'Nachtwacht: De Greystook',. 'description': 'md5:1db3f5dc4c7109c821261e7512975be7',. 'thumbnail': r're:^https?://.*\.jpg$',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\carambatv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3524
Entropy (8bit):	4.834221531604108
Encrypted:	false
SSDEEP:	96:KDhFvbn/Ifc8VrfWBTe7Oot/8V6Ng+zleNuajbBH95F:KDXz2hyTZV6NgZNuajvT
MD5:	70C2581DF06F7F519DB57221C184488A
SHA1:	F84FE64D10EDFEA6713AA6787FB77EE8DB7FA6FA
SHA-256:	EB57F73905ECB2A381E2AA3796D02CE6FF5942C13B30FA215A6D8DCE59E955D0
SHA-512:	10116A6B13D17075C64AEC7348DAF25B01BBA89C366783376F19777CDD52EC4F8F6837046D69DA9812B9F9E5561431285B42ADBD18C1C010A9D72DA657223D47
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. float_or_none,. int_or_none,. try_get,.)..from .videomore import VideomoreIE...class CarambaTVIE(InfoExtractor):. _VALID_URL = r'(?:carambatv:\|https?://video1\.carambatv\.ru/v/)(?P<id>\d+)'. _TESTS = [{. 'url': 'http://video1.carambatv.ru/v/191910501',. 'md5': '2f4a81b7cfd5ab866ee2d7270cb34a2a',. 'info_dict': {. 'id': '191910501',. 'ext': 'mp4',. 'title': '[BadComedian] - ........ . ...... (.......... .....)',. 'thumbnail': r're:^https?://.*\.jpg',. 'duration': 2678.31,. },. }, {. 'url': 'carambatv:191910501',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. video = self._download_json(. 'http://video1.carambatv.ru/v/%s/video

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cartoonnetwork.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2374
Entropy (8bit):	4.677806775147921
Encrypted:	false
SSDEEP:	48:+usPm5W9N8CJ5rD1fJoXjlhn0P9Y08uQ4ufYv8ORH:wPm5WHr5rVJsn0FzbbTB
MD5:	21E1DEFA9606B84CE44F6CBE70D61B3E
SHA1:	F2DEFEF81022DCC4F9BB198987C103B3DF24E230
SHA-256:	59CB0A1CEA74746A24108739F75D6CB2B5398374DF2695545A91A1F7BC1C2B17
SHA-512:	9B753615ED26D918920A58112E7D6DDF78B5C35448A1F6AA3A96DCB7757134AA05CCD14E81884B40E3E867DC2BFD0C81021C043101E7B6A3F5300662BE7FA71A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .turner import TurnerBaseIE.from ..utils import int_or_none...class CartoonNetworkIE(TurnerBaseIE):. _VALID_URL = r'https?://(?:www\.)?cartoonnetwork\.com/video/(?:[^/]+/)+(?P<id>[^/?#]+)-(?:clip\|episode)\.html'. _TEST = {. 'url': 'https://www.cartoonnetwork.com/video/ben-10/how-to-draw-upgrade-episode.html',. 'info_dict': {. 'id': '6e3375097f63874ebccec7ef677c1c3845fa850e',. 'ext': 'mp4',. 'title': 'How to Draw Upgrade',. 'description': 'md5:2061d83776db7e8be4879684eefe8c0f',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id).. def find_field(global_re, name, content_re=None, value_re='[^"]+', fatal=False):. metadata_re = ''. if content_re:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cbc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	18928
Entropy (8bit):	4.761926064477707
Encrypted:	false
SSDEEP:	384:MyWgnCl34c0u5LlcpQmsYErPJVwO0ABshXusQ7cBUuldmbdlVbqdFxBTU6NwdWB2:TirPniesQ7cBUulgbdlVbqdFxBTU8wDz
MD5:	5AB579065F7A2A064FA7768714E56FAB
SHA1:	623CB97B651ECADE074E9D217315BC39E115669F
SHA-256:	E7107CE5224E8616975F7A60E60F98EF1D58E4BD408A66EB3CB4992B34CCE5D3
SHA-512:	BAA5E2204CFCB8EFC78BE8522A6F19F0EFE8CBDDBB4333B9FB93B6DF9E5FDF2D549016F600B5623DD502562C363A06333E401989F1CA94AAC69245E9911AE2C5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_HTTPError,.).from ..utils import (. js_to_json,. smuggle_url,. try_get,. xpath_text,. xpath_element,. xpath_with_ns,. find_xpath_attr,. orderedSet,. parse_duration,. parse_iso8601,. parse_age_limit,. strip_or_none,. int_or_none,. ExtractorError,.)...class CBCIE(InfoExtractor):. IE_NAME = 'cbc.ca'. _VALID_URL = r'https?://(?:www\.)?cbc\.ca/(?!player/)(?:[^/]+/)+(?P<id>[^/?#]+)'. _TESTS = [{. # with mediaId. 'url': 'http://www.cbc.ca/22minutes/videos/clips-season-23/don-cherry-play-offs',. 'md5': '97e24d09672fc4cf56256d6faa6c25bc',. 'info_dict': {. 'id': '2682904050',. 'ext': 'mp4',. 'title': 'Don Cherry . All-Stars',. 'description': 'Don Cherry has a bee in his bonnet about AHL player John Scott because

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cbs.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4679
Entropy (8bit):	4.714557259885319
Encrypted:	false
SSDEEP:	96:2ZoqmJtRod74YdQ+8rUWB1raXeABffxH6EfWj++BT4Oq6NjM:2ZLsje79WB1AeUffxaEujtTG6NjM
MD5:	AEB3B1B966BA85879BB5AF3443311743
SHA1:	BBF1B27FBFE51AD2FB68BAF94D8383467574AD16
SHA-256:	076CC75BF37358C47581372933557020BFA87A0FB5D3D9D088352993300C6CEE
SHA-512:	4D058E6EBD667C421186768079417FC8434770F1D7D7C4B85A08AB3C9CC1C72C46A838C0E27839A3FAA07119E12477C9E64F04117F45FD1A71092D802FDFC761
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .theplatform import ThePlatformFeedIE.from ..utils import (. ExtractorError,. int_or_none,. find_xpath_attr,. xpath_element,. xpath_text,. update_url_query,.)...class CBSBaseIE(ThePlatformFeedIE):. def _parse_smil_subtitles(self, smil, namespace=None, subtitles_lang='en'):. subtitles = {}. for k, ext in [('sMPTE-TTCCURL', 'tt'), ('ClosedCaptionURL', 'ttml'), ('webVTTCaptionURL', 'vtt')]:. cc_e = find_xpath_attr(smil, self._xpath_ns('.//param', namespace), 'name', k). if cc_e is not None:. cc_url = cc_e.get('value'). if cc_url:. subtitles.setdefault(subtitles_lang, []).append({. 'ext': ext,. 'url': cc_url,. }). return subtitles...class CBSIE(CBSBaseIE):. _VALID_URL = r'(?:cbs:\|https?://(?:www\.)?(?:cbs\.com/shows/[^/]+/video\|colbertlateshow\.com/(?:video\|podcasts)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cbsinteractive.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4044
Entropy (8bit):	4.858410482605622
Encrypted:	false
SSDEEP:	96:SDP3bOx0O1JcLurEKtU9K2EX5jlnTWfWFBrEolX3/PhSa6JY1tNR:ArLZaU9Kfc3oF/PYjY/
MD5:	7D01061A5FE8B956DA75494E098688F4
SHA1:	8641A1738CED8E03CA6BFCB696E8626AABE9CAE9
SHA-256:	C0680066C0B9EEB0618E42DBD237FD077FDD332843F31584BD6AA24478B103C1
SHA-512:	70226AFA07313595E54DD876F06E8FF0FA7B5C5F8635EB2A4190C0435FBA35853BFCDDA099A117088FFCB96BDC4FF7D37B869349163664EE130F73C0B07A3ABE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .cbs import CBSIE.from ..utils import int_or_none...class CBSInteractiveIE(CBSIE):. _VALID_URL = r'https?://(?:www\.)?(?P<site>cnet\|zdnet)\.com/(?:videos\|video(?:/share)?)/(?P<id>[^/?]+)'. _TESTS = [{. 'url': 'http://www.cnet.com/videos/hands-on-with-microsofts-windows-8-1-update/',. 'info_dict': {. 'id': 'R49SYt__yAfmlXR85z4f7gNmCBDcN_00',. 'display_id': 'hands-on-with-microsofts-windows-8-1-update',. 'ext': 'mp4',. 'title': 'Hands-on with Microsoft Windows 8.1 Update',. 'description': 'The new update to the Windows 8 OS brings improved performance for mouse and keyboard users.',. 'uploader_id': '6085384d-619e-11e3-b231-14feb5ca9861',. 'uploader': 'Sarah Mitroff',. 'duration': 70,. 'timestamp': 1396479627,. 'upload_date': '20140402',. },. 'params': {. # m3u8 do

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cbslocal.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3674
Entropy (8bit):	4.652865843622039
Encrypted:	false
SSDEEP:	96:sEMqK9CPZ+87NieWz7RDxrEjxv79aC41Ul877WwfJsqp:svqA2fMeWz7wh74Cc2GJsY
MD5:	4DBB6A20B439B828853089DEBF297EE3
SHA1:	5199B82D383684885A726FE2C1588BC24E9B159D
SHA-256:	89846FA5FDD7FF4DD85C77902705532BE78D662B8BA7DFE3E6CA431F985F8A6C
SHA-512:	6D088453EA857BC68D173B78235A3D9B6332834904E8817309873D182571E660C879CF2ED74AC335380B6B5F82CC782268B8C87102B369B36AD03A5BA4935258
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .anvato import AnvatoIE.from .sendtonews import SendtoNewsIE.from ..compat import compat_urlparse.from ..utils import (. parse_iso8601,. unified_timestamp,.)...class CBSLocalIE(AnvatoIE):. _VALID_URL = r'https?://[a-z]+\.cbslocal\.com/(?:\d+/\d+/\d+\|video)/(?P<id>[0-9a-z-]+)'.. _TESTS = [{. # Anvato backend. 'url': 'http://losangeles.cbslocal.com/2016/05/16/safety-advocates-say-fatal-car-seat-failures-are-public-health-crisis',. 'md5': 'f0ee3081e3843f575fccef901199b212',. 'info_dict': {. 'id': '3401037',. 'ext': 'mp4',. 'title': 'Safety Advocates Say Fatal Car Seat Failures Are \'Public Health Crisis\'',. 'description': 'Collapsing seats have been the focus of scrutiny for decades, though experts say remarkably little has been done to address the issue. Randy Paige reports.',. 'thumbnail': 're:^https?://.*',. 'timestamp'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cbsnews.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (2320)
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	5.545808950994674
Encrypted:	false
SSDEEP:	192:TQtcV5dFdbDOHD9xEYi40ij2ZETCJaACnOJK/enTUk6Ng:TQA3QzEb403ZiHnVenTb6Ng
MD5:	36E10DF6355E23E2FFA709A3814F7F98
SHA1:	063E5D69462FB82976F8DAB5C935C5F0FFCBEFCB
SHA-256:	98872EE7B726E8211D9FD0219EFF32EA601B2BD5716DD9CBE52300730927125D
SHA-512:	7835DABB3948DD02214CB2034103837E70E646B9E7F82DDEDFC06C813F3F7EE546BBB7E85AD3241D5E8C5CFE723F733B0A4835DA125296289C5C5BE125F5D6BC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import zlib..from .common import InfoExtractor.from .cbs import CBSIE.from ..compat import (. compat_b64decode,. compat_urllib_parse_unquote,.).from ..utils import (. parse_duration,.)...class CBSNewsEmbedIE(CBSIE):. IE_NAME = 'cbsnews:embed'. _VALID_URL = r'https?://(?:www\.)?cbsnews\.com/embed/video[^#]*#(?P<id>.+)'. _TESTS = [{. 'url': 'https://www.cbsnews.com/embed/video/?v=1.c9b5b61492913d6660db0b2f03579ef25e86307a#1Vb7b9s2EP5XBAHbT6Gt98PAMKTJ0se6LVjWYWtdGBR1stlIpEBSTtwi%2F%2FvuJNkNhmHdGxgM2NL57vjd6zt%2B8PngdN%2Fyg79qeGvhzN%2FLGrS%2F%2BuBLB531V28%2B%2BO7Qg7%2Fy97r2z3xZ42NW8yLhDbA0S0KWlHnIijwKWJBHZZnHBa8Cgbpdf%2F89NM9Hi9fXifhpr8sr%2FlP848tn%2BTdXycX25zh4cdX%2FvHl6PmmPqnWQv9w8Ed%2B9GjYRim07bFEqdG%2BZVHuwTm65A7bVRrYtR5lAyMox7pigF6W4k%2By91mjspGsJ%2BwVae4%2BsvdnaO1p73HkXs%2FVisUDTGm7R8IcdnOROeq%2B19qT1amhA1VJtPenoTUgrtfKc9m7Rq8dP7nnjwOB7wg7ADdNt7VX64DWAWlKhPtmDEq22g4GF99x6Dk9E8OSsankHXqPNKDxC%2

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cbssports.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1486
Entropy (8bit):	5.042135665591633
Encrypted:	false
SSDEEP:	24:1R8ldnhGxviRofjmfW6/edlycAphhemBeZsMHTnD1qHP0v5taKwk3MJoXjlhPIBv:PudnhnofoReOcGfBerD1qv0BtaKHMJok
MD5:	8ECBACC29830595285165257720D5904
SHA1:	C5EB3085511B478513CBC56F3BC324222DEEB902
SHA-256:	4299FE16D3CD753797FE37F8A66A7E53C49B6D2051630A69F6F9E00E33254469
SHA-512:	AEB5B7636FB5869603CFD4C1967FBAC66785A6A3AEFE3EEA7DB49EDD813BC963C72FF128AB5A286E945517278FFC397922ED08BA8247B114A1B48C9573FF97F9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .cbs import CBSBaseIE...class CBSSportsIE(CBSBaseIE):. _VALID_URL = r'https?://(?:www\.)?cbssports\.com/[^/]+/(?:video\|news)/(?P<id>[^/?#&]+)'.. _TESTS = [{. 'url': 'https://www.cbssports.com/nba/video/donovan-mitchell-flashes-star-potential-in-game-2-victory-over-thunder/',. 'info_dict': {. 'id': '1214315075735',. 'ext': 'mp4',. 'title': 'Donovan Mitchell flashes star potential in Game 2 victory over Thunder',. 'description': 'md5:df6f48622612c2d6bd2e295ddef58def',. 'timestamp': 1524111457,. 'upload_date': '20180419',. 'uploader': 'CBSI-NEW',. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }, {. 'url': 'https://www.cbssports.com/nba/news/nba-playoffs-2018-watch-76ers-vs-heat-game-3-series-schedule-tv-channel-online-stream/',. 'only_matching': True,. }].. def _extrac

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ccc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3875
Entropy (8bit):	4.600607903533797
Encrypted:	false
SSDEEP:	96:WvqRzxRLXBz4Bv99fJsR2EZVWnBu5y/BTL1xlEuE6NG0HTafOuD8+/xK:sOCBvHJswbnBu5KTL1DVE6Nls0L
MD5:	AE8CF7D612851397410AED9442EAF2B2
SHA1:	15788FEA1D819DC284B80C7031B0D3229738999D
SHA-256:	5ED98B5AEC805BC9238143E66DED8FDAB1033F3D732E45A21AD6FCD11DF06268
SHA-512:	501F35101F6D63E801DB702D2452287C5F2A6D0B5E4544D90A37F46A75B605DE402B4693E777724E6CF9BA9BFC5F6D856BD887F7B2F1CF22A03078E9B0CDCFD4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,. try_get,. url_or_none,.)...class CCCIE(InfoExtractor):. IE_NAME = 'media.ccc.de'. _VALID_URL = r'https?://(?:www\.)?media\.ccc\.de/v/(?P<id>[^/?#&]+)'.. _TESTS = [{. 'url': 'https://media.ccc.de/v/30C3_-_5443_-_en_-_saal_g_-_201312281830_-_introduction_to_processor_design_-_byterazor#video',. 'md5': '3a1eda8f3a29515d27f5adb967d7e740',. 'info_dict': {. 'id': '1839',. 'ext': 'mp4',. 'title': 'Introduction to Processor Design',. 'creator': 'byterazor',. 'description': 'md5:df55f6d073d4ceae55aae6f2fd98a0ac',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20131228',. 'timestamp': 1388188800,. 'duration': 3710,. 'tags': list,. }. }, {. 'url': 'https://media.ccc.de/v/32c3-736

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ccma.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3704
Entropy (8bit):	4.469510778254176
Encrypted:	false
SSDEEP:	96:9HosTE3JHvp57jSJAVfBb0RfqBTGOJS7/8ya8Hd6Ng:li3Bv7PwAVBYRmTY96Ng
MD5:	22E4667BBA2F85F518CD15EF9BE61DA2
SHA1:	FFAB5FECA0C1CDB718577E80AA7E92D97B9EF44A
SHA-256:	56F3AD47C60FE3A70E10FDC12DF0EFE10E91E68600603F261230CFB48601914C
SHA-512:	5554D120470A4C8749532E0FCF6D836D74F4467084EDF0250F196374048A09AE9F1FF051075C717341F579737F03F799D38DD624603756EBE453D51D37F7644D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. parse_duration,. parse_iso8601,. parse_resolution,. url_or_none,.)...class CCMAIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ccma\.cat/(?:[^/]+/)*?(?P<type>video\|audio)/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.ccma.cat/tv3/alacarta/lespot-de-la-marato-de-tv3/lespot-de-la-marato-de-tv3/video/5630208/',. 'md5': '7296ca43977c8ea4469e719c609b0871',. 'info_dict': {. 'id': '5630208',. 'ext': 'mp4',. 'title': 'L\'espot de La Marat. de TV3',. 'description': 'md5:f12987f320e2f6e988e9908e4fe97765',. 'timestamp': 1470918540,. 'upload_date': '20160811',. }. }, {. 'url': 'http://www.ccma.cat/catradio/alacarta/programa/el-consell-de-savis-analitza-el-derbi/audio/943685/',. 'md5': 'fa3e38f269329a278271276

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cctv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6903
Entropy (8bit):	5.100758646623155
Encrypted:	false
SSDEEP:	192:l0tg9JiXuSWHEFBlsNSIpaH0PJdq35wMlEgOb3KTHV6Ng:l0tg9JiXuSWHQlsNSCaH0PJo35wMlEgJ
MD5:	10CE4064B6208540F5B42367D574E0D2
SHA1:	1B22EA0DF848636BF3E2BD65FCBC244A15921AF6
SHA-256:	066DB1A7DF131B68D70952E11C0A298FBC228DB1891A33CC3ECA4024C5D87DE1
SHA-512:	D8121725ED038C27C93765899FCCFB26F57CA3295D3F9CC0E729DD85FCC2AE374036A0042F561F1613BA941B0DD715EF416D46E2A3BCE1255D2E6D8047F82CC2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. float_or_none,. try_get,. unified_timestamp,.)...class CCTVIE(InfoExtractor):. IE_DESC = '...'. _VALID_URL = r'https?://(?:(?:[^/]+)\.(?:cntv\|cctv)\.(?:com\|cn)\|(?:www\.)?ncpa-classic\.com)/(?:[^/]+/)*?(?P<id>[^/?#&]+?)(?:/index)?(?:\.s?html\|[?#&]\|$)'. _TESTS = [{. # fo.addVariable("videoCenterId","id"). 'url': 'http://sports.cntv.cn/2016/02/12/ARTIaBRxv4rTT1yWf1frW2wi160212.shtml',. 'md5': 'd61ec00a493e09da810bf406a078f691',. 'info_dict': {. 'id': '5ecdbeab623f4973b40ff25f18b174e8',. 'ext': 'mp4',. 'title': '[NBA]......46. ............',. 'description': 'md5:7e14a5328dc5eb3d1cd6afbbe0574e95',. 'duration': 98,. 'uploader': 'songjunjie',. 'timestamp': 1455279956,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cda.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7021
Entropy (8bit):	4.688069063732678
Encrypted:	false
SSDEEP:	192:9NtIvD+cFfjzdd0oW9TLCS6w16N9ob1kfjezTV:9Nt0D1hjzdd0oWJLCSb16NECfjezTV
MD5:	97ECAF68DC59B9D84E6FAA66D13DD783
SHA1:	A6E446576B49C85E9F777036EC640CD57A8EBC24
SHA-256:	344CAB4B471555569FE20CE542663E012F565E02CF06B14E9C9A1695F26F817E
SHA-512:	459AFEE76A392599E02D5CAE3437D224825966348276811B967340E862F57FB83F3D62E6D2F191EA0DAD4707247D400600B4E3B7CA2F85502DD8441B748478B5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import codecs.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. multipart_encode,. parse_duration,. random_birthday,. urljoin,.)...class CDAIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.)?cda\.pl/video\|ebd\.cda\.pl/[0-9]+x[0-9]+)/(?P<id>[0-9a-z]+)'. _BASE_URL = 'http://www.cda.pl/'. _TESTS = [{. 'url': 'http://www.cda.pl/video/5749950c',. 'md5': '6f844bf51b15f31fae165365707ae970',. 'info_dict': {. 'id': '5749950c',. 'ext': 'mp4',. 'height': 720,. 'title': 'Oto dlaczego przed zakr.tem nale.y zwolni..',. 'description': 'md5:269ccd135d550da90d1662651fcb9772',. 'thumbnail': r're:^https?://.*\.jpg$',. 'average_rating': float,. 'duration': 39,. 'age_limit': 0,. }. }, {. 'url': 'http://www.cda.pl/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ceskatelevize.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10571
Entropy (8bit):	4.620298443780807
Encrypted:	false
SSDEEP:	192:Kzaw5PP5DBdVdi1x3wxHZyV6N0grxjcTWF/4/xS1/N3awg:Kzaw5PP5FdVdi1x3wxHZyV6N0grxjcT7
MD5:	C6F9201DC5E2BC62EB21F958198EF253
SHA1:	37AA8150144B650D7B29018703D2D036EE81352E
SHA-256:	0832E50AB4943A6B5DA24E7578E443B2BDC33ADB0766C85657BEEA9ABA8A00D4
SHA-512:	BA54F2A0EBA5DFA66C16C47BA3F1365DB4F91531C6D17D62C991E6C39CEA8AEF31108346193991C3DA573C0187783267E45A270B1CDC41A6C4E8931BE2A63520
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. float_or_none,. sanitized_Request,. unescapeHTML,. update_url_query,. urlencode_postdata,. USER_AGENTS,.)...class CeskaTelevizeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ceskatelevize\.cz/ivysilani/(?:[^/?#&]+/)(?P<id>[^/#?]+)'. _TESTS = [{. 'url': 'http://www.ceskatelevize.cz/ivysilani/ivysilani/10441294653-hyde-park-civilizace/214411058091220',. 'info_dict': {. 'id': '61924494877246241',. 'ext': 'mp4',. 'title': 'Hyde Park Civilizace: .ivot v Gr.nsku',. 'description': 'md5:3fec8f6bb497be5cdb0c9e8781076626',. 'thumbnail': r're:^https?://.\.jpg',. 'duration': 3350,. },. 'params': {. # m3u8 download. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\channel9.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10137
Entropy (8bit):	4.521880530503634
Encrypted:	false
SSDEEP:	192:81FOP6KnqStHmFSES6imINUVbB2/AVN69MX0ZdgWBvT5TokbEcccb6NLl:81gP6KnqStHmFSES6imQUVbU/AVN6mkM
MD5:	EEDD599CA2FED7DA71AAB28EA1BF9449
SHA1:	0CBDA54E9B8120E93C6D6FC2115630C48FA74E23
SHA-256:	421B254ECE63DBA31D848C131AF30FA6EB6457F1E4579D195FF0AE099D73F358
SHA-512:	60B668CADDDEF797B922FAB7C15FDDBB4A42BB8E70148961A70811B464F387DC91FDA2C92923BCB7AE4DB239AF65BDED05BFB7F65D2349B454FA63237CFB3D32
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. ExtractorError,. int_or_none,. parse_iso8601,. qualities,. unescapeHTML,.)...class Channel9IE(InfoExtractor):. IE_DESC = 'Channel 9'. IE_NAME = 'channel9'. _VALID_URL = r'https?://(?:www\.)?(?:channel9\.msdn\.com\|s\.ch9\.ms)/(?P<contentpath>.+?)(?P<rss>/RSS)?/?(?:[?#&]\|$)'.. _TESTS = [{. 'url': 'http://channel9.msdn.com/Events/TechEd/Australia/2013/KOS002',. 'md5': '32083d4eaf1946db6d454313f44510ca',. 'info_dict': {. 'id': '6c413323-383a-49dc-88f9-a22800cab024',. 'ext': 'wmv',. 'title': 'Developer Kick-Off Session: Stuff We Love',. 'description': 'md5:b80bf9355a503c193aff7ec6cd5a7731',. 'duration': 4576,. 'thumbnail': r're:https?://.*\.jpg',. 'timestamp': 1377717420,. 'upload_date': '20130828',. 'session_code': 'KOS002

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\charlierose.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	4.785866819223239
Encrypted:	false
SSDEEP:	48:PusJhxaANfwG/F+ZyoqwVXwx7tKmw5jXjlD3R3Pp56A3YakvBeOeUiveb:x/xaEBF+ZypECvu/3xMPaCBeOen4
MD5:	1BBE42310BF3904FEE05D7168A8A0B44
SHA1:	52BB0ADC7294C4CB54F4341C41BD7F9E353004A5
SHA-256:	06E7ABFF1948D39AE28EC61B52C81ED6C605AC39398603D183A67B941B385009
SHA-512:	AA9AF2D6CF4464342E05D7BAA48635DE8ED4E47B4D9975C9623137B47D4CA4770E415FFBBD684D846982ED45232659E300AF6D8D86A0E0D1BCD65C0CDD6E02BD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import remove_end...class CharlieRoseIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?charlierose\.com/(?:video\|episode)(?:s\|/player)/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://charlierose.com/videos/27996',. 'md5': 'fda41d49e67d4ce7c2411fd2c4702e09',. 'info_dict': {. 'id': '27996',. 'ext': 'mp4',. 'title': 'Remembering Zaha Hadid',. 'thumbnail': r're:^https?://.*\.jpg\?\d+',. 'description': 'We revisit past conversations with Zaha Hadid, in memory of the world renowned Iraqi architect.',. 'subtitles': {. 'en': [{. 'ext': 'vtt',. }],. },. },. }, {. 'url': 'https://charlierose.com/videos/27996',. 'only_matching': True,. }, {. 'url': 'https://charlierose.com/episodes/30887?autoplay=true',. 'only_matching':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\chaturbate.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	4.648788383174453
Encrypted:	false
SSDEEP:	48:Puo/3euxfRU0voPdXNUkxUgtM1NjXhCqevw+/HAdBX1ouGBJ+71etW4O1cKBTv1H:nvnu0vQVOGg4Jw+/HW1SBJtRO1cKBTvt
MD5:	6D437E6569CF5D345CCFE318B7B65C13
SHA1:	663B4507B7871B88E00EC416031BA6EC2A8A6C3D
SHA-256:	EAEAC2DACDBF38B1E18A8BE7A1F013907FF7219446404C1A27D489C02EADD0C6
SHA-512:	A4FBDEB1773331A064DC934A50C347402168923F0D5C4417B1CEF2D67D1244141F6E4439282C4078C3234C8E585B94BC44D19A10DEAF8E79958F0269A5025B8E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import ExtractorError...class ChaturbateIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?chaturbate\.com/(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'https://www.chaturbate.com/siswet19/',. 'info_dict': {. 'id': 'siswet19',. 'ext': 'mp4',. 'title': 're:^siswet19 [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'age_limit': 18,. 'is_live': True,. },. 'params': {. 'skip_download': True,. },. 'skip': 'Room is offline',. }, {. 'url': 'https://en.chaturbate.com/siswet19/',. 'only_matching': True,. }].. _ROOM_OFFLINE = 'Room is currently offline'.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(. url, video_id, headers=self.geo_verification_headers()).. m3u8_urls = []..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\chilloutzone.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3501
Entropy (8bit):	4.701421379294048
Encrypted:	false
SSDEEP:	48:PuLHKmfW5MzLOcAWPiFHclLkWD9fxYfdfFklkfXhcWzlmdK+tNdFnM/MBvQR1LF8:e1nzLk8iFHclw6fxYftpbl8l1nTqvDg
MD5:	10ED3D03CEB927E5DF13764763786678
SHA1:	8B2D2435208A228E3F153C1F530487AF741AC4E8
SHA-256:	B21373D36B294AD1660B3CE8F439D45ED069DB21E5F6F908B0C6E7CAD169F1DD
SHA-512:	AF3C11CCE18374434232F8441EEBECB6DA5D44EBF32CBE3077A09F7A180F3932BC88F401836A767FD38B23C4E4EBD54394887D2213F2C527DFA21B5AC4907867
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from .youtube import YoutubeIE.from ..compat import compat_b64decode.from ..utils import (. clean_html,. ExtractorError.)...class ChilloutzoneIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?chilloutzone\.net/video/(?P<id>[\w\|-]+)\.html'. _TESTS = [{. 'url': 'http://www.chilloutzone.net/video/enemene-meck-alle-katzen-weg.html',. 'md5': 'a76f3457e813ea0037e5244f509e66d1',. 'info_dict': {. 'id': 'enemene-meck-alle-katzen-weg',. 'ext': 'mp4',. 'title': 'Enemene Meck - Alle Katzen weg',. 'description': 'Ist das der Umkehrschluss des Niesenden Panda-Babys?',. },. }, {. 'note': 'Video hosted at YouTube',. 'url': 'http://www.chilloutzone.net/video/eine-sekunde-bevor.html',. 'info_dict': {. 'id': '1YVQaAgHyRU',. 'ext': 'mp4',. 'title': '16 Photos Taken 1

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\chirbit.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2946
Entropy (8bit):	4.913385487357782
Encrypted:	false
SSDEEP:	48:+uIdldC7fZRtBNqvgVpX0tfeXhjZkBLt2c0CB662iCBok06MukKwBZ6WkgAQ8cXJ:SldCjZRtBsvgVVKfoZE2Z6B2CKF/gJ8s
MD5:	89002E9993398316CBC64B4207771313
SHA1:	BCFDDEA73965250D1D270BF632010E6C59F7ED0E
SHA-256:	FC506AD642C2632F2A41C40516297CE86223A39CF75FBBADAD02D1911ED13FBA
SHA-512:	6A8A6ED9B4786C54C797CE4D2847FAC2BB3B0B81B85C4338AB2F9D97D7441DFD47ACE786D151E6C8058BECAAE7E5319498ACA80F39609D568EE84A992D69865E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_b64decode.from ..utils import parse_duration...class ChirbitIE(InfoExtractor):. IE_NAME = 'chirbit'. _VALID_URL = r'https?://(?:www\.)?chirb\.it/(?:(?:wp\|pl)/\|fb_chirbit_player\.swf\?key=)?(?P<id>[\da-zA-Z]+)'. _TESTS = [{. 'url': 'http://chirb.it/be2abG',. 'info_dict': {. 'id': 'be2abG',. 'ext': 'mp3',. 'title': 'md5:f542ea253f5255240be4da375c6a5d7e',. 'description': 'md5:f24a4e22a71763e32da5fed59e47c770',. 'duration': 306,. 'uploader': 'Gerryaudio',. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'https://chirb.it/fb_chirbit_player.swf?key=PrIPv5',. 'only_matching': True,. }, {. 'url': 'https://chirb.it/wp/MN58c2',. 'only_matching': True,. }].. def _real_extract(self, url):. audio_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cinchcast.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1997
Entropy (8bit):	4.683337692423292
Encrypted:	false
SSDEEP:	48:+upPBfm1VPjNTZmo6tfjXjIO8DcrzbxaafScsJefJBTp0T6Ng:ZJm3PJTZmoYf7si5/KjQfJBTp0T6Ng
MD5:	D5817ADCC2DBBB9BAFF58743BA78B5CF
SHA1:	09C02CB8F061EC8AA2A9CEBE79ECA778717D9E69
SHA-256:	2B18BC8C352C4310AC6A20A3D2C36898EFBF19127980AC2C78B77BFBEF7F119A
SHA-512:	E503BA0E4C44FFC44D6F16F80CDC10114DA4EB47769080EA79E181FA36249E3200AB38E7FA1DE5A96FDDC3180CD3019AA9CE2C534DBCBD1744E3C26995CBE668
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. unified_strdate,. xpath_text,.)...class CinchcastIE(InfoExtractor):. _VALID_URL = r'https?://player\.cinchcast\.com/.*?(?:assetId\|show_id)=(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://player.cinchcast.com/?show_id=5258197&platformId=1&assetType=single',. 'info_dict': {. 'id': '5258197',. 'ext': 'mp3',. 'title': 'Train Your Brain to Up Your Game with Coach Mandy',. 'upload_date': '20130816',. },. }, {. # Actual test is run in generic, look for undergroundwellness. 'url': 'http://player.cinchcast.com/?platformId=1&assetType=single&assetId=7141703',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). doc = self._download_xml(. 'http://www.blogtalkradio.com/playerasset/mrss?assetType=single&assetId

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cinemax.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.158670729717652
Encrypted:	false
SSDEEP:	24:zi8lDGGew7fXbKxV/7dlSvNCdNV5PXbBl3tf9lfFIigkWK:+uDGCfY7QKtP3tf9lfFIigkr
MD5:	8D24ADFB83002B01975E01BCC3834B91
SHA1:	7E14AE4D3C2A7E4CE5EAF2A6D672B217616F75F6
SHA-256:	F40ADE3D698D742C5D7F073683397C699A49C2D2483E6A13CAD665837C103B53
SHA-512:	6F9318025B5BF91A2A881CD71AE79D9B4E583C4CDFCB7309BFB9EC77A6D3DCA547D20C5EEE7751EF822AC33C90F74D4423F80657F19099AA33ABA65A8970F327
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .hbo import HBOBaseIE...class CinemaxIE(HBOBaseIE):. _VALID_URL = r'https?://(?:www\.)?cinemax\.com/(?P<path>[^/]+/video/[0-9a-z-]+-(?P<id>\d+))'. _TESTS = [{. 'url': 'https://www.cinemax.com/warrior/video/s1-ep-1-recap-20126903',. 'md5': '82e0734bba8aa7ef526c9dd00cf35a05',. 'info_dict': {. 'id': '20126903',. 'ext': 'mp4',. 'title': 'S1 Ep 1: Recap',. },. 'expected_warnings': ['Unknown MIME type application/mp4 in DASH manifest'],. }, {. 'url': 'https://www.cinemax.com/warrior/video/s1-ep-1-recap-20126903.embed',. 'only_matching': True,. }].. def _real_extract(self, url):. path, video_id = re.match(self._VALID_URL, url).groups(). info = self._extract_info('https://www.cinemax.com/%s.xml' % path, video_id). info['id'] = video_id. return info.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ciscolive.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	4.974618501126581
Encrypted:	false
SSDEEP:	96:A+/JghkCLuoAanCH8l78yNYSP7saj6TFcdT6TSfxayIYKKLU0YKv6TTcBmx7IFLe:nyuIA8r7s665O68xQr0rv6PDaFaFL
MD5:	A822324CDC3D13B444A079D6FC6D1EF4
SHA1:	9CBAE4B32D926C89F1461FF1C3C4326BDD7BF0E9
SHA-256:	42C3FD362A562D9F53A18F08055CB779FB7BE146AC37F0423ABDCFFC6FBD350E
SHA-512:	73C54AA4D4A3004B763DB4EA8FCA7150521CE2C88FD12D7CE4F3DE4AB48F8BD0A56737B293791979E08E064193DA1873420C182E6B6E201AECAC6D73C2E5ED62
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse_urlparse,.).from ..utils import (. clean_html,. float_or_none,. int_or_none,. try_get,. urlencode_postdata,.)...class CiscoLiveBaseIE(InfoExtractor):. # These appear to be constant across all Cisco Live presentations. # and are not tied to any user session or event. RAINFOCUS_API_URL = 'https://events.rainfocus.com/api/%s'. RAINFOCUS_API_PROFILE_ID = 'Na3vqYdAlJFSxhYTYQGuMbpafMqftalz'. RAINFOCUS_WIDGET_ID = 'n6l4Lo05R8fiy3RpUBm447dZN8uNWoye'. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/5647924234001/SyK2FdqjM_default/index.html?videoId=%s'.. HEADERS = {. 'Origin': 'https://ciscolive.cisco.com',. 'rfApiProfileId': RAINFOCUS_API_PROFILE_ID,. 'rfWidgetId': RAINFOCUS_WIDGET_ID,. }.. def _call_api(self, ep, rf_id, query, referrer, note=None):

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cjsw.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2412
Entropy (8bit):	4.9309054362841165
Encrypted:	false
SSDEEP:	48:+uvWOJoN+xflcNlmHb5lntfdfFQYvbOWBBVvtXcB3Twwdagy1beXR9BnVx6/6NF+:KOJQ+5iNGb53fTlFX+Ny1bc7s6NF+
MD5:	238193B28DBA51A2AEAE9628D4AE9693
SHA1:	B7920E685D16BFB9A87581771F66DAC325DFB45D
SHA-256:	BD5CD93D5AFB777A15499CFA5E8C48BD22D1DC58FFA93548E677A0DAE95E2B38
SHA-512:	5B20C7E43F57DFEBA91394C83B9D3C1E3120446C04C53AFBE70BA1C044435F2CBDD0A692F5ABDD96483A425F7D3E85EFFE022819AF93D37F5ED596D9D079E69F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. unescapeHTML,.)...class CJSWIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cjsw\.com/program/(?P<program>[^/]+)/episode/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://cjsw.com/program/freshly-squeezed/episode/20170620',. 'md5': 'cee14d40f1e9433632c56e3d14977120',. 'info_dict': {. 'id': '91d9f016-a2e7-46c5-8dcb-7cbcd7437c41',. 'ext': 'mp3',. 'title': 'Freshly Squeezed . Episode June 20, 2017',. 'description': 'md5:c967d63366c3898a80d0c7b0ff337202',. 'series': 'Freshly Squeezed',. 'episode_id': '20170620',. },. }, {. # no description. 'url': 'http://cjsw.com/program/road-pops/episode/20170707/',. 'only_matching': True,. }].. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). prog

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cliphunter.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2533
Entropy (8bit):	4.6523538521565415
Encrypted:	false
SSDEEP:	48:PueRytyg7y9SVCfnyQD64xX4M3nyGbfi0VLw4XwfjXjlk9B1huXGamYqLLIwBCG/:pgKSmn6GXLjr5Lw4XwfqJDamYUyG66BF
MD5:	900DC3277F1B3F935CAFA6FA0CC604BA
SHA1:	0CDA1CED6BC17796FB0A2764B6D605711A618CAC
SHA-256:	5CD8B93F31B5E29BA38A3F59B47A05B12085A64324DC26FB39E3B12868E31D09
SHA-512:	AD22903D0C721F8C5E399F4B563319953DE08E623FEBFF3763BC4D9F8783DCC87D9A17016E94BFB29620B69DBFA07C1E2C1A70191598268E5205516436706D0D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. url_or_none,.)...class CliphunterIE(InfoExtractor):. IE_NAME = 'cliphunter'.. _VALID_URL = r'''(?x)https?://(?:www\.)?cliphunter\.com/w/. (?P<id>[0-9]+)/. (?P<seo>.+?)(?:$\|[#\?]). '''. _TESTS = [{. 'url': 'http://www.cliphunter.com/w/1012420/Fun_Jynx_Maze_solo',. 'md5': 'b7c9bbd4eb3a226ab91093714dcaa480',. 'info_dict': {. 'id': '1012420',. 'ext': 'flv',. 'title': 'Fun Jynx Maze solo',. 'thumbnail': r're:^https?://.*\.jpg$',. 'age_limit': 18,. },. 'skip': 'Video gone',. }, {. 'url': 'http://www.cliphunter.com/w/2019449/ShesNew__My_booty_girlfriend_Victoria_Paradices_pussy_filled_with_jizz',. 'md5': '55a723c67bfc6da6b0cfa00d55da8a27',. 'info_dict': {. 'id': '2019449',. 'ext': 'mp4',. 'title': 'ShesNew

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\clippit.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2551
Entropy (8bit):	4.502864543958263
Encrypted:	false
SSDEEP:	48:wuNkRBwYJMaXgajXjlkdXLMFd6/PX+1Dfjr0AXcLxpXh9eX4D6NSqtc:IRBwYJMaXgaqFMFd6/2FrUFf9JD6Ndtc
MD5:	B143242B7556DC1175295F608F460036
SHA1:	000A04F8DA009A5A938C260F8761233D16071756
SHA-256:	12B46ED5AF77DC79246FFAE9E8780615F7A84240A3D6D8F0CA14772EFF496B01
SHA-512:	41D6B0051265D13E9C86F30FC51ACAD1D69C9B31148FBE1B844B6FCB88DE083BE5B64AA260F287BFDFCDE3C9F53BCA6EE77C4922B120FBDB57374D1BBF69DDA4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_iso8601,. qualities,.)..import re...class ClippitIE(InfoExtractor):.. _VALID_URL = r'https?://(?:www\.)?clippituser\.tv/c/(?P<id>[a-z]+)'. _TEST = {. 'url': 'https://www.clippituser.tv/c/evmgm',. 'md5': '963ae7a59a2ec4572ab8bf2f2d2c5f09',. 'info_dict': {. 'id': 'evmgm',. 'ext': 'mp4',. 'title': 'Bye bye Brutus. #BattleBots - Clippit',. 'uploader': 'lizllove',. 'uploader_url': 'https://www.clippituser.tv/p/lizllove',. 'timestamp': 1472183818,. 'upload_date': '20160826',. 'description': 'BattleBots \| ABC',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._html_search_regex(r'<title.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cliprs.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	5.018939124125765
Encrypted:	false
SSDEEP:	24:zi8lNFBGSeowJZ5zYl0ET/wdl+ow9VTa3CZ4OaJoXhhgM1LG:+upXeoi/6bww9k3FOaJoXhhg8LG
MD5:	4DDEA9C2222319B95B568BAE35AE8064
SHA1:	EF982E5E7A4FB5614E56BA458ADE5D3AEB3C10FD
SHA-256:	1D9F61140B63AEDD3059E6535835828BE9E6379783AD8A33D6A7B6E12ADCFB05
SHA-512:	4D0A97148AA0458148DA321FD27EE9D8D7DFD4E847F852AD9F5D9CBDD026A2A4D2978D9B9B18D5A46E9F5C835887385C079D3AB7D5B6C6552B0652FA90DE5438
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .onet import OnetBaseIE...class ClipRsIE(OnetBaseIE):. _VALID_URL = r'https?://(?:www\.)?clip\.rs/(?P<id>[^/]+)/\d+'. _TEST = {. 'url': 'http://www.clip.rs/premijera-frajle-predstavljaju-novi-spot-za-pesmu-moli-me-moli/3732',. 'md5': 'c412d57815ba07b56f9edc7b5d6a14e5',. 'info_dict': {. 'id': '1488842.1399140381',. 'ext': 'mp4',. 'title': 'PREMIJERA Frajle predstavljaju novi spot za pesmu Moli me, moli',. 'description': 'md5:56ce2c3b4ab31c5a2e0b17cb9a453026',. 'duration': 229,. 'timestamp': 1459850243,. 'upload_date': '20160405',. }. }.. def _real_extract(self, url):. display_id = self._match_id(url).. webpage = self._download_webpage(url, display_id).. mvp_id = self._search_mvp_id(webpage).. info_dict = self._extract_from_id(mvp_id, webpage). info_dict['display_id'] = display

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\clipsyndicate.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.750358422690739
Encrypted:	false
SSDEEP:	48:PuFHAEV1fZ5TJYTg6tfjXjd41YM7TfcBoWg1Y8nhqlgkEhHrqZ1BPNg:yDHTJYTdfgYwJDYAhqlgkEhHr41BPNg
MD5:	B23B2492B86DE653EB294790401C5AA3
SHA1:	8DE736AA65552655048CB4D83B9700D4728383DB
SHA-256:	AD9AE692B208DB72ACAAF06BD7D1BD51A1D736CC5F5F7697CED814E2E97FCAC0
SHA-512:	1F61261F132BE3C2E0787C4A2A093A1D4082D9546A0ECE2F99CBDCE09EFB9CF2D0157120B8D183B22922B7B44C475718BA6FA4E88A8FA0D4DB65933908AF469F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. find_xpath_attr,. fix_xml_ampersands.)...class ClipsyndicateIE(InfoExtractor):. _VALID_URL = r'https?://(?:chic\|www)\.clipsyndicate\.com/video/play(list/\d+)?/(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.clipsyndicate.com/video/play/4629301/brick_briscoe',. 'md5': '4d7d549451bad625e0ff3d7bd56d776c',. 'info_dict': {. 'id': '4629301',. 'ext': 'mp4',. 'title': 'Brick Briscoe',. 'duration': 612,. 'thumbnail': r're:^https?://.+\.jpg',. },. }, {. 'url': 'http://chic.clipsyndicate.com/video/play/5844117/shark_attack',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). js_player = self._download_webpage(. 'http://eplayer.clipsyndicate.com/embed/player.js?va_id=%s' % video_id,. video_id, 'Downlaoding pla

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\closertotruth.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	4.578216293800892
Encrypted:	false
SSDEEP:	96:ZmrkRznoft4o2d8IWfJasz2y9LhZ7dDKn2:0AEl6CJa8nJl
MD5:	995762B39ED58D5A6FDAB0E017AD2775
SHA1:	1C510933074CF715616F4545790680C5C0B9AECD
SHA-256:	C8B94769AA2A7A7B00EAF82D47FD7F4597FE30E6DC70477A31835ED4F6913656
SHA-512:	C469419681E26EFD7D37FB4D66B6882AA360FFFC00F7D7F6A3CD5136530C3B0D7BABA6C265BD6AD0E5BD2FAE99B4127FD7E55EC5B5B7BFFE3616C964371E5253
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class CloserToTruthIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?closertotruth\.com/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://closertotruth.com/series/solutions-the-mind-body-problem#video-3688',. 'info_dict': {. 'id': '0_zof1ktre',. 'display_id': 'solutions-the-mind-body-problem',. 'ext': 'mov',. 'title': 'Solutions to the Mind-Body Problem?',. 'upload_date': '20140221',. 'timestamp': 1392956007,. 'uploader_id': 'CTTXML'. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'http://closertotruth.com/episodes/how-do-brains-work',. 'info_dict': {. 'id': '0_iuxai6g6',. 'display_id': 'how-do-brains-work',. 'ext': 'mov',. 'title': 'How do Brains Work?',. 'upload

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cloudflarestream.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2269
Entropy (8bit):	4.776434615717236
Encrypted:	false
SSDEEP:	48:+unRFS/ZCfaiK4s3gN2j0XCZN3XSLLt8cynBpVyjXHqGp1k8opdBTr6Ng:be/KafrQockHSV8cyBpITdp1NopdBTrL
MD5:	5EAE13A76A727E69634E245571936B4D
SHA1:	FF40E22ECFDD579C970212FDAE823B576A8C1F57
SHA-256:	05CE21C9193C8AF3EBE69394DB291CE13C21D197B59AF1B6CB5F2A3FB131CB92
SHA-512:	F7F154B54F8CABCC7DADF4D8A1FFE656DB42E63F3D698CB8777CD9AC26AE32008ACA1C80A402B6EF4310BDC176F07F40AA84895190BB1C8D6282A58CCE9A732C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class CloudflareStreamIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. (?:watch\.)?(?:cloudflarestream\.com\|videodelivery\.net)/\|. embed\.(?:cloudflarestream\.com\|videodelivery\.net)/embed/[^/]+\.js\?.*?\bvideo=. ). (?P<id>[\da-f]+). '''. _TESTS = [{. 'url': 'https://embed.cloudflarestream.com/embed/we4g.fla9.latest.js?video=31c9291ab41fac05471db4e73aa11717',. 'info_dict': {. 'id': '31c9291ab41fac05471db4e73aa11717',. 'ext': 'mp4',. 'title': '31c9291ab41fac05471db4e73aa11717',. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'https://watch.cloudflarestream.com/9df17203414fd1db3e3ed74abbe936c1',. 'only_matc

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cloudy.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.731823669537528
Encrypted:	false
SSDEEP:	48:+uA6BLvNf/E2TrvcEtfjXh5f6SmxujpwtWEwbEtsv:5RNM2TrvVf3CSOkitWPIav
MD5:	A98CAE68E1D95869F388639C68DE9A8B
SHA1:	3A3F5BB699B6A327F850D88A1437D97267D90A97
SHA-256:	F0B8EFE8B4F99FDF623B7A7E22B269DF36D7F2275276D342F2621E1935FB78E0
SHA-512:	06682DB1FBAB3D2ACA77BB052F7A9ECF13DD56A6F1D7E25CD495FA628F0B69F7B1850D6EDBFA27FC0F1AEF516996FD6CE985F2BF99D8EF3B116CEE0322882621
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. str_to_int,. unified_strdate,.)...class CloudyIE(InfoExtractor):. _IE_DESC = 'cloudy.ec'. _VALID_URL = r'https?://(?:www\.)?cloudy\.ec/(?:v/\|embed\.php\?.*?\bid=)(?P<id>[A-Za-z0-9]+)'. _TESTS = [{. 'url': 'https://www.cloudy.ec/v/af511e2527aac',. 'md5': '29832b05028ead1b58be86bf319397ca',. 'info_dict': {. 'id': 'af511e2527aac',. 'ext': 'mp4',. 'title': 'Funny Cats and Animals Compilation june 2013',. 'upload_date': '20130913',. 'view_count': int,. }. }, {. 'url': 'http://www.cloudy.ec/embed.php?autoplay=1&id=af511e2527aac',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(. 'https://www.cloudy.ec/embed.php', video_id, query={. 'id': video_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\clubic.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1976
Entropy (8bit):	4.941241267677065
Encrypted:	false
SSDEEP:	48:+uCtx4fu4F/FEnvHdVSmKCgvpJvtfjXtYCFwXeQGs0ra3jXjBTr26Ns1Q:UxavF9YvHdwfCgvpJ1fBLceQG7CjBTrt
MD5:	E2B1966B18955D5850BB525990157245
SHA1:	9011CACC549E7875040D92FCA32699AF441662CC
SHA-256:	1931FE9CF7C699525DB49CD7454BBAB7A77738449E01EDA3A405C7685C3FA492
SHA-512:	914D061642CC7CB9C55C025F9B88F0BEE42F9AB82F789826F3AD08A5C8B2950521BDFF03EB7DAF03F355897BD46A4AACD42BC3DB50CD1B5A445AE7597BB3C3E5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. qualities,.)...class ClubicIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?clubic\.com/video/(?:[^/]+/)video.-(?P<id>[0-9]+)\.html'.. _TESTS = [{. 'url': 'http://www.clubic.com/video/clubic-week/video-clubic-week-2-0-le-fbi-se-lance-dans-la-photo-d-identite-448474.html',. 'md5': '1592b694ba586036efac1776b0b43cd3',. 'info_dict': {. 'id': '448474',. 'ext': 'mp4',. 'title': 'Clubic Week 2.0 : le FBI se lance dans la photo d\u0092identit.',. 'description': 're:Gueule de bois chez Nokia. Le constructeur a indiqu. cette.',. 'thumbnail': r're:^http://img\.clubic\.com/.\.jpg$',. }. }, {. 'url': 'http://www.clubic.com/video/video-clubic-week-2-0-apple-iphone-6s-et-plus-mais-surtout-le-pencil-469792.html',. 'only_matching': True,. }].. def _re

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\clyp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2496
Entropy (8bit):	4.499701140188031
Encrypted:	false
SSDEEP:	48:PuZcfxChRSHNctCNnRQrjX+fN8feXLOyCEsBB9Zl+f1DScHBTB6KcNlpQ8cS6Ng:WuuCctCNnROOfqfsrS9ZlwccHBTgNly+
MD5:	B631AE0DA8B27626A9B4A9E8A54DC9B4
SHA1:	EC9DD7544A4F3D33B1D6C07D876D8502A5165F25
SHA-256:	56E2F62A8EA731200DEFED480535972B87A9FEE1D7F2A9E94400EA1B32978067
SHA-512:	3AA859499CAC3100553E7E23BEC0E45619204B0F8AA45DB29F0FA8565D5A39B53CF38E4FD045F1AB04E9ECA2F27AC1DD638878B1036C4CB2C340C388DCFD69DA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse_urlparse,.).from ..utils import (. float_or_none,. unified_timestamp,.)...class ClypIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?clyp\.it/(?P<id>[a-z0-9]+)'. _TESTS = [{. 'url': 'https://clyp.it/ojz2wfah',. 'md5': '1d4961036c41247ecfdcc439c0cddcbb',. 'info_dict': {. 'id': 'ojz2wfah',. 'ext': 'mp3',. 'title': 'Krisson80 - bits wip wip',. 'description': '#Krisson80BitsWipWip #chiptune\n#wip',. 'duration': 263.21,. 'timestamp': 1443515251,. 'upload_date': '20150929',. },. }, {. 'url': 'https://clyp.it/b04p1odi?token=b0078e077e15835845c528a44417719d',. 'info_dict': {. 'id': 'b04p1odi',. 'ext': 'mp3',. 'title': 'GJ! (Reward Edit)',. 'description': 'Metal Resistance (

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cmt.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2173
Entropy (8bit):	5.051861109066685
Encrypted:	false
SSDEEP:	48:PuxV+Au1ffURZtdWLPEaMG1EMoYQT3j5/n8XtXAtal/BKqDspijXjlkGU:0V+xNfitdWgKtoYQ7juhmalYn0qr
MD5:	510463FC50A7637B08AE61A75BDAFDB6
SHA1:	5621959DDAE35075BB759A416209401BCC7B8329
SHA-256:	04CA44BFB7A9FC06F6D3233AB9ECB735582E7E0B4BA32BA65D614346328B82A7
SHA-512:	F051B314427237D24A10E8BEB29C0F1769516ECD3143242718920F0A49EDF877E7B0350FC50F05F083EEEC1365818D3DC1A63758D5379FA3E14007587B8F2538
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .mtv import MTVIE...class CMTIE(MTVIE):. IE_NAME = 'cmt.com'. _VALID_URL = r'https?://(?:www\.)?cmt\.com/(?:videos\|shows\|(?:full-)?episodes\|video-clips)/(?P<id>[^/]+)'.. _TESTS = [{. 'url': 'http://www.cmt.com/videos/garth-brooks/989124/the-call-featuring-trisha-yearwood.jhtml#artist=30061',. 'md5': 'e6b7ef3c4c45bbfae88061799bbba6c2',. 'info_dict': {. 'id': '989124',. 'ext': 'mp4',. 'title': 'Garth Brooks - "The Call (featuring Trisha Yearwood)"',. 'description': 'Blame It All On My Roots',. },. 'skip': 'Video not available',. }, {. 'url': 'http://www.cmt.com/videos/misc/1504699/still-the-king-ep-109-in-3-minutes.jhtml#id=1739908',. 'md5': 'e61a801ca4a183a466c08bd98dccbb1c',. 'info_dict': {. 'id': '1504699',. 'ext': 'mp4',. 'title': 'Still The King Ep. 109 in 3 Minutes',. 'description':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cnbc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2195
Entropy (8bit):	4.86455195891334
Encrypted:	false
SSDEEP:	48:+uag1bYXlnQEldSHLvrD1fjXjZqlpLHchW2LvNfJoXjlhwBGdMYO:uaAlnTldSHLvrVIpLHL2Lv5JsJ2
MD5:	0147CA1FAFDE08EF43B4641FBE80A99F
SHA1:	82584E121FDF44025BEEF3A21527EA9CDCAD3C3D
SHA-256:	3E98D0E7AB5D30388B64FD6B82DB6DBCA9E8BA9F48A86D1E922141A32ED4263E
SHA-512:	A703C52AFF509F03D953117EE2FA082D6D02D1B3459264124A8A8FAB04A20F01C90A7ECC703332ECD3751BE7720552063988D5729E6BFD106B2389A0D47DBDD9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals...from .common import InfoExtractor.from ..utils import smuggle_url...class CNBCIE(InfoExtractor):. _VALID_URL = r'https?://video\.cnbc\.com/gallery/\?video=(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://video.cnbc.com/gallery/?video=3000503714',. 'info_dict': {. 'id': '3000503714',. 'ext': 'mp4',. 'title': 'Fighting zombies is big business',. 'description': 'md5:0c100d8e1a7947bd2feec9a5550e519e',. 'timestamp': 1459332000,. 'upload_date': '20160330',. 'uploader': 'NBCU-CNBC',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). return {. '_type': 'url_transparent',. 'ie_key': 'ThePlatform',. 'url': smuggle_url(. 'http://link.theplatform.com/s/gZWlPC/media

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cnn.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6428
Entropy (8bit):	4.992084691826563
Encrypted:	false
SSDEEP:	192:dXw2Wbk+4OEzTco76nHEUHnNKhPGcpA1HGrP:dXw2WbkbVzwo76nH5nNKhHO1gP
MD5:	5C453942A1845FB1424F92F00B9C2A94
SHA1:	295D848C9F9915883728766015599C02A61E9997
SHA-256:	FC9D770AA7A3826455254DC0099C39F8E18470F95DF9917CF3A9A05470BC7323
SHA-512:	BDC6C43435D3A207937C10F9C3F3E10F787B4C2F3374541C7AE9B039D32A09E82D864D779B7980DEC5A4AA20363930D3EFA0E611C2DDF676161A054C2D122607
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .turner import TurnerBaseIE.from ..utils import url_basename...class CNNIE(TurnerBaseIE):. _VALID_URL = r'''(?x)https?://(?:(?P<sub_domain>edition\|www\|money)\.)?cnn\.com/(?:video/(?:data/.+?\|\?)/)?videos?/. (?P<path>.+?/(?P<title>[^/]+?)(?:\.(?:[a-z\-]+)\|(?=&)))'''.. _TESTS = [{. 'url': 'http://edition.cnn.com/video/?/video/sports/2013/06/09/nadal-1-on-1.cnn',. 'md5': '3e6121ea48df7e2259fe73a0628605c4',. 'info_dict': {. 'id': 'sports/2013/06/09/nadal-1-on-1.cnn',. 'ext': 'mp4',. 'title': 'Nadal wins 8th French Open title',. 'description': 'World Sport\'s Amanda Davies chats with 2013 French Open champion Rafael Nadal.',. 'duration': 135,. 'upload_date': '20130609',. },. 'expected_warnings': ['Failed to download m3u8 information'],. }, {. 'url': 'http://edition.cnn.com/video/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\comcarcoff.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2717
Entropy (8bit):	4.6416041037493
Encrypted:	false
SSDEEP:	48:+u7cFfBQNdtE4/bVfJoXjCYuhbuXmkZZP4nqG3FJBTefmUANbj8c0F6NNFn:MdBQdtEWbVfJgkZkZlKdVJBTeOUANbj5
MD5:	3419C163722C40B94CCDAD38B1C21783
SHA1:	4E228A1B79805D9448569CA465C2260DEA21B660
SHA-256:	356E0C4D15FCDFD0B24F0B15F8DFA28AF00FD280E72DA0596BE858105226CA2B
SHA-512:	44F937F87940B9248C6CB2C71D0B51D4B2CA6A6AD89E25FA349403A9E6F9E163C0F930FB3DF06472C62FAA8450355C77DF581C6642EB245DB8013C451A651A8F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_duration,. parse_iso8601,.)...class ComCarCoffIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?comediansincarsgettingcoffee\.com/(?P<id>[a-z0-9\-]*)'. _TESTS = [{. 'url': 'http://comediansincarsgettingcoffee.com/miranda-sings-happy-thanksgiving-miranda/',. 'info_dict': {. 'id': '2494164',. 'ext': 'mp4',. 'upload_date': '20141127',. 'timestamp': 1417107600,. 'duration': 1232,. 'title': 'Happy Thanksgiving Miranda',. 'description': 'Jerry Seinfeld and his special guest Miranda Sings cruise around town in search of coffee, complaining and apologizing along the way.',. },. 'params': {. 'skip_download': 'requires ffmpeg',. }. }].. def _real_extract(self, url):. display_id =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\comedycentral.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5533
Entropy (8bit):	5.006957012941449
Encrypted:	false
SSDEEP:	96:I5W5ahwd0Zq1/tUd50p7r9jfOk4ijGAxoX+jSrb3dm4t7hgLneqO4fafmxRfe05:I05aSd0ZC1W50R5jmk92Oec4xOLnOuaA
MD5:	D71919E57F62697E37431A69AD0CA251
SHA1:	FE78D605C4DE8145F9B58C316BC73E0499F0AD87
SHA-256:	AAA11AFE613D2A2F0D016D18AC395384EE778D7774A6D9D0C0A00B577B40B262
SHA-512:	983876739BB1B61F85D7138F532AC51F35930ABA6A4213E1752BABC75C93F7CE46833436F7813DCFE2FFEA888869E22DC85F7ADD4BCE415679AA9E52EB00835A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .mtv import MTVServicesInfoExtractor.from .common import InfoExtractor...class ComedyCentralIE(MTVServicesInfoExtractor):. _VALID_URL = r'''(?x)https?://(?:www\.)?cc\.com/. (video-clips\|episodes\|cc-studios\|video-collections\|shows(?=/[^/]+/(?!full-episodes))). /(?P<title>.)'''. _FEED_URL = 'http://comedycentral.com/feeds/mrss/'.. _TESTS = [{. 'url': 'http://www.cc.com/video-clips/kllhuv/stand-up-greg-fitzsimmons--uncensored---too-good-of-a-mother',. 'md5': 'c4f48e9eda1b16dd10add0744344b6d8',. 'info_dict': {. 'id': 'cef0cbb3-e776-4bc9-b62e-8016deccb354',. 'ext': 'mp4',. 'title': 'CC:Stand-Up\|August 18, 2013\|1\|0101\|Uncensored - Too Good of a Mother',. 'description': 'After a certain point, breastfeeding becomes c*kblocking.',. 'timestamp': 1376798400,. 'upload_date': '20130818',. },. }, {. 'url': 'http://www.cc.com/s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\common.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	139727
Entropy (8bit):	4.300742067504036
Encrypted:	false
SSDEEP:	1536:O6OWbUW9gwMkZ6vuA02CZhj+aA4RQNp0HK4xpkbdcPzLxk3YhXk0qp3i5p27gb5c:OGMkAPO5zLxPeZ3gj+x40/217FEYel
MD5:	352CDE2CA047135DA71F286B62FD0FB8
SHA1:	5B1FD84DA7E2CA697CF9D648C19D54C0FD875822
SHA-256:	C18571AC532F93F4F300B871142C1A21092A593D873DB0DC22137C09D7E42571
SHA-512:	1B1FBE5CA821EDC15BFC852688DF3F0EFC9D537941B32998681C48727B72C3BE72C3666149751464B2C283AF3936352A6682D781BCFEAD682E48D5FECB45828A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import datetime.import hashlib.import json.import netrc.import os.import random.import re.import socket.import sys.import time.import math..from ..compat import (. compat_cookiejar,. compat_cookies,. compat_etree_Element,. compat_etree_fromstring,. compat_getpass,. compat_integer_types,. compat_http_client,. compat_os_name,. compat_str,. compat_urllib_error,. compat_urllib_parse_unquote,. compat_urllib_parse_urlencode,. compat_urllib_request,. compat_urlparse,. compat_xml_parse_error,.).from ..downloader.f4m import (. get_base_url,. remove_encrypted_media,.).from ..utils import (. NO_DEFAULT,. age_restricted,. base_url,. bug_reports_message,. clean_html,. compiled_regex_type,. determine_ext,. determine_protocol,. dict_get,. error_to_compat_str,. ExtractorError,. extract_attributes,. fix_xml_ampersands,. float_or_none,. Ge

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\commonmistakes.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1540
Entropy (8bit):	4.845875098584299
Encrypted:	false
SSDEEP:	24:1R8lxrvbinCp7vr3tfgFsVxWoerJj4/R58Ve0wmEUvRtfCXjdRmzFIFP:Puxwo7T3tfVfWosCwbwmE2RtfCXjm8
MD5:	41F09CCB4824BFCED553CD001105E688
SHA1:	B7F197559116D5BEB6979FF599B24CA44D6FF6C4
SHA-256:	7D67C5C02C19EA6367969EE44BCC5C8A28543EA1BE635115C66A6E6D14265577
SHA-512:	21B6473E4FA16E2457BF7D2F5ADB5529DA28FB35BB1B985BE54629F1D1BC49324D3BA895E4F0DEA68DD15BB78C14375D9232F579610879B54D6BB8C600C5FF5C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import sys..from .common import InfoExtractor.from ..utils import ExtractorError...class CommonMistakesIE(InfoExtractor):. IE_DESC = False # Do not list. _VALID_URL = r'''(?x). (?:url\|URL)$. '''.. _TESTS = [{. 'url': 'url',. 'only_matching': True,. }, {. 'url': 'URL',. 'only_matching': True,. }].. def _real_extract(self, url):. msg = (. 'You\'ve asked youtube-dl to download the URL "%s". '. 'That doesn\'t make any sense. '. 'Simply remove the parameter in your command or configuration.'. ) % url. if not self._downloader.params.get('verbose'):. msg += ' Add -v to the command line to see what arguments and configuration youtube-dl got.'. raise ExtractorError(msg, expected=True)...class UnicodeBOMIE(InfoExtractor):. IE_DESC = False. _VALID_URL = r'(?P<bom>\ufeff)(?P<id>.*)$'.. # Disable test for python 3.2 since

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\commonprotocols.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.7821957430096464
Encrypted:	false
SSDEEP:	48:PuBDrlpAFzbN3OtfjpJUpihzQ49t7kdvpudzjpJUpiF:gtpAFzbNcfnhNBkdvQFnF
MD5:	44E3932576322EDDB67A7B0E9AF39369
SHA1:	47A50DCF63E566C1FE0D65392C396C2EC9821074
SHA-256:	9FD52D3F326858D4A716B3688D58513015FC56022C757997E5605B2876C0595B
SHA-512:	9B92CA5EA88DB7B8145C13FC3299A4FAEA50999866EBF4506A22CE08189BC0C57C520A8AF0DDE98A8A309416B5F5E98C60457ABF10592AA5DA4DA638D5CE9B36
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urlparse,.)...class RtmpIE(InfoExtractor):. IE_DESC = False # Do not list. _VALID_URL = r'(?i)rtmp[est]?://.+'.. _TESTS = [{. 'url': 'rtmp://cp44293.edgefcs.net/ondemand?auth=daEcTdydfdqcsb8cZcDbAaCbhamacbbawaS-bw7dBb-bWG-GqpGFqCpNCnGoyL&aifp=v001&slist=public/unsecure/audio/2c97899446428e4301471a8cb72b4b97--audio--pmg-20110908-0900a_flv_aac_med_int.mp4',. 'only_matching': True,. }, {. 'url': 'rtmp://edge.live.hitbox.tv/live/dimak',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._generic_id(url). title = self._generic_title(url). return {. 'id': video_id,. 'title': title,. 'formats': [{. 'url': url,. 'ext': 'flv',. 'format_id': compat_urlparse.urlparse(url).scheme,. }],. }...class MmsIE(I

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\condenast.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8860
Entropy (8bit):	4.715609156268355
Encrypted:	false
SSDEEP:	192:om1b99VzabLpRvVAvGvTTwdTbCTvgaJWqg0mZ2isLOG3f2hH1Tg6Nl8eg+/:D1NUpVVAv+TTwdTYX4dZuOGv2hH1Tg6f
MD5:	B7A60A9CC2243EC384A4F61CA6DF591C
SHA1:	0BC069ED3BC2E30C5AF8A34E88450FD6867ADE43
SHA-256:	809DF46D8199019085F430EE3DB539F007D8A135B1104201B2CB0183D64C19D1
SHA-512:	06CB8F9D06E58A3450FCA3C04E00BBE8BF8DB380C536A9054D7B84710F7F7839BDF6921B153F9B621006D28FD3EB35FFEE093AE7A7DF43193FE6BFE2EFF8BEF9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlparse,. compat_urlparse,.).from ..utils import (. determine_ext,. extract_attributes,. int_or_none,. js_to_json,. mimetype2ext,. orderedSet,. parse_iso8601,.)...class CondeNastIE(InfoExtractor):. """. Cond. Nast is a media group, some of its sites use a custom HTML5 player. that works the same in all of them.. """.. # The keys are the supported sites and the values are the name to be shown. # to the user and in the extractor description.. _SITES = {. 'allure': 'Allure',. 'architecturaldigest': 'Architectural Digest',. 'arstechnica': 'Ars Technica',. 'bonappetit': 'Bon App.tit',. 'brides': 'Brides',. 'cnevids': 'Cond. Nast',. 'cntraveler': 'Cond. Nast Traveler',. 'details': 'Details',. 'epicurious': 'Epicurious',. 'glamo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\corus.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3695
Entropy (8bit):	4.765201532425252
Encrypted:	false
SSDEEP:	96:BybN4biPNSdoOgwEduy2ymyPy/yp1yrGyUy/WLWoWJ7O:kbC6NSdodwIZpq6p0rJ7/WLWor
MD5:	1841E8DD41AD803CC22D978467797DAE
SHA1:	1CA18A23AF1D3EEAB25CED9A8B548698BBC150A2
SHA-256:	18278EFA3AA47B12406F5C93D0256C0E6A93832B2C92D713DA7AEBF7C4CE2860
SHA-512:	251735169B12CEF5258B9EF9D2FE1C41F91CAD3B2E0067F001C1DF249B4EC232E8C33E1EDE7E5B93BFD7BBBD18FDFC9E1B90855D3102FA9F7F9D942DF5A647DE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .theplatform import ThePlatformFeedIE.from ..utils import int_or_none...class CorusIE(ThePlatformFeedIE):. _VALID_URL = r'''(?x). https?://. (?:www\.)?. (?P<domain>. (?:globaltv\|etcanada)\.com\|. (?:hgtv\|foodnetwork\|slice\|history\|showcase\|bigbrothercanada)\.ca. ). /(?:video/(?:[^/]+/)?\|(?:[^/]+/)+(?:videos/[a-z0-9-]+-\|video\.html\?.*?\bv=)). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://www.hgtv.ca/shows/bryan-inc/videos/movie-night-popcorn-with-bryan-870923331648/',. 'md5': '05dcbca777bf1e58c2acbb57168ad3a6',. 'info_dict': {. 'id': '870923331648',. 'ext': 'mp4',. 'title': 'Movie Night Popcorn with Bryan',. 'description': 'Bryan whips up home

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\coub.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4555
Entropy (8bit):	4.533116987022292
Encrypted:	false
SSDEEP:	96:bbtIVHS/XjgdqSvf8zPf7qzzjLrz3OVafBTeLNlQJgHct/8ik6Ng:vu0EFEzn7qLPz+VapTSn6Ng
MD5:	0C7D8C8E27C0D832B14C17000D016EFC
SHA1:	C5A5DC17B5C879B24F87B459C7706B3AA9315D7A
SHA-256:	3DB33871D7C1940DE95F10B1017910C24310B2516E8D4084FBD5729D12513562
SHA-512:	C1A9E6444008BA8C48B071937D63EE3FE93008EAD03C268B610313110006600F2A6C2B65F201B3AC48435FFAE287921C053383F64C0699468B7195F8DD364F58
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. parse_iso8601,. qualities,.)...class CoubIE(InfoExtractor):. _VALID_URL = r'(?:coub:\|https?://(?:coub\.com/(?:view\|embed\|coubs)/\|c-cdn\.coub\.com/fb-player\.swf\?.\bcoub(?:ID\|id)=))(?P<id>[\da-z]+)'.. _TESTS = [{. 'url': 'http://coub.com/view/5u5n1',. 'info_dict': {. 'id': '5u5n1',. 'ext': 'mp4',. 'title': 'The Matrix Moonwalk',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 4.6,. 'timestamp': 1428527772,. 'upload_date': '20150408',. 'uploader': 'Artyom Loskutnikov',. 'uploader_id': 'artyom.loskutnikov',. 'view_count': int,. 'like_count': int,. 'repost_count': int,. 'age_limit': 0,. },. }, {. 'url': 'http://c-cdn.coub.com/fb-play

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cracked.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3138
Entropy (8bit):	4.869558367491717
Encrypted:	false
SSDEEP:	48:PuW0xfw0vxSZrn64zU46U81dA8VfjXhknHMEXXIuBVyBfWXQzuZQMq3bUzLhaxeK:W5/kZrn64A44dA8VfanH+UgRu+oHsxeK
MD5:	FB8B8A258E30B8885AC03421696E5ED1
SHA1:	2219D487FB0E8B474B854D485C3B3244450F8757
SHA-256:	912E94EA772FEB25E0F33052A7C1024ADA4102879EBCE36C934637A0BC07F2F0
SHA-512:	DFB6F4CED15BFD93877F6E9AC6983CF00298D8CAA4607817FCC6F612E9DC65A878329DBC2962F14987A3E2F91F2FEAF3D8EE3940856A60C7551239AC108A2000
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .youtube import YoutubeIE.from ..utils import (. parse_iso8601,. str_to_int,.)...class CrackedIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cracked\.com/video_(?P<id>\d+)_[\da-z-]+\.html'. _TESTS = [{. 'url': 'http://www.cracked.com/video_19070_if-animal-actors-got-e21-true-hollywood-stories.html',. 'md5': '89b90b9824e3806ca95072c4d78f13f7',. 'info_dict': {. 'id': '19070',. 'ext': 'mp4',. 'title': 'If Animal Actors Got E! True Hollywood Stories',. 'timestamp': 1404954000,. 'upload_date': '20140710',. }. }, {. # youtube embed. 'url': 'http://www.cracked.com/video_19006_4-plot-holes-you-didnt-notice-in-your-favorite-movies.html',. 'md5': 'ccd52866b50bde63a6ef3b35016ba8c7',. 'info_dict': {. 'id': 'EjI00A3rZD0',. 'ext': 'mp4',. 'title':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\crackle.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7625
Entropy (8bit):	4.249829535666477
Encrypted:	false
SSDEEP:	192:6RU2bdMjFPcvrD/Ygw4BbOb3qTobasbvOTbg1VbZ6N0:6yIdyoggw4VObaTobasbvOTE1V96N0
MD5:	F1647AD4AD0DD4BA3CBB10344C58BFEB
SHA1:	ADC07DD72046466C2D2E4211C042DBE70731E87E
SHA-256:	5EDDF5C5CB398FD4A12E78FB49C900B38A186E225D145BCC6985B0487EE78C7E
SHA-512:	1AA0FF8D9F4D90C1E06F88F46C0699839EE0FCABB89DFE15877C16851F8C26AA6AF8CEE3FAB2804F70FC8723E2538FFAC3A006E6E74BD850467D44DEC44A51DF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals, division..import hashlib.import hmac.import re.import time..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. parse_age_limit,. parse_duration,. url_or_none,. ExtractorError.)...class CrackleIE(InfoExtractor):. _VALID_URL = r'(?:crackle:\|https?://(?:(?:www\|m)\.)?(?:sony)?crackle\.com/(?:playlist/\d+/\|(?:[^/]+/)+))(?P<id>\d+)'. _TESTS = [{. # geo restricted to CA. 'url': 'https://www.crackle.com/andromeda/2502343',. 'info_dict': {. 'id': '2502343',. 'ext': 'mp4',. 'title': 'Under The Night',. 'description': 'md5:d2b8ca816579ae8a7bf28bfff8cefc8a',. 'duration': 2583,. 'view_count': int,. 'average_rating': 0,. 'age_limit': 14,. 'genre': 'Action, Sci-Fi',. 'creator': 'Allan Kroeker',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\criterion.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1275
Entropy (8bit):	4.826499270175673
Encrypted:	false
SSDEEP:	24:zi8lFv6GDlgwa3K6/5ddlgtZGcQCgaeIXjlgt9BgeJaGhDceqeBgeYMORlLSARLc:+uEolgb5dTcXgajXjlk9BgpGVzqeBgGn
MD5:	8AF204D3B251E4D2B8E0DAE6B62AAD1C
SHA1:	E35DB97D4C1A70C6FF746208D13189C9C81F5436
SHA-256:	AE2A399AEDBBDF2A45C232311EE8AE69467829B227B934B7D1020577FDC3D3C5
SHA-512:	6FE968EDFCC5E3A919BEF942EA9755C899A59B0FD0766208E5F4CA78F1E752D37074B1E0B57E51DC8957D744D94DFCA7C8CC12FEED88F21BC9C43AD0B02C4C89
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class CriterionIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?criterion\.com/films/(?P<id>[0-9]+)-.+'. _TEST = {. 'url': 'http://www.criterion.com/films/184-le-samourai',. 'md5': 'bc51beba55685509883a9a7830919ec3',. 'info_dict': {. 'id': '184',. 'ext': 'mp4',. 'title': 'Le Samoura.',. 'description': 'md5:a2b4b116326558149bef81f76dcbb93f',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. final_url = self._search_regex(. r'so\.addVariable$"videoURL", "(.+?)"$\;', webpage, 'video url'). title = self._og_search_title(webpage). description = self._html_search_meta('description', webpage). thumbnail = self._search_regex(. r'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\crooksandliars.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2061
Entropy (8bit):	4.756770934713165
Encrypted:	false
SSDEEP:	48:Purt53fY7nfQQ8VMcvgtfjXhFouXY8VPwaLGKjQS5BTCwexRe7Cn6tNs6Ng:kY7oQ8V5vGfHA8SeTBTCPxRTINs6Ng
MD5:	77313FEB59FD0E417DCA1BC6F6FC40BE
SHA1:	D536555A516AB4BC96412D7C8606EFB19F05C9CC
SHA-256:	FD89D9C3D7C2FF1CAAFA19677D1873914FD4B4334D7547D4B311FB378BF58CF4
SHA-512:	703FCA285BDEDE7BFA9602BEDE1A338626217AD0A70CF008926158C3F9D553866365CE5D70530E086743D2D339DCDB9869E0FC8BFA04E2056694C9A83AE252EE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. qualities,.)...class CrooksAndLiarsIE(InfoExtractor):. _VALID_URL = r'https?://embed\.crooksandliars\.com/(?:embed\|v)/(?P<id>[A-Za-z0-9]+)'. _TESTS = [{. 'url': 'https://embed.crooksandliars.com/embed/8RUoRhRi',. 'info_dict': {. 'id': '8RUoRhRi',. 'ext': 'mp4',. 'title': 'Fox & Friends Says Protecting Atheists From Discrimination Is Anti-Christian!',. 'description': 'md5:e1a46ad1650e3a5ec7196d432799127f',. 'thumbnail': r're:^https?://.*\.jpg',. 'timestamp': 1428207000,. 'upload_date': '20150405',. 'uploader': 'Heather',. 'duration': 236,. }. }, {. 'url': 'http://embed.crooksandliars.com/v/MTE3MjUtMzQ2MzA',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\crunchyroll.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	29072
Entropy (8bit):	4.651326725741445
Encrypted:	false
SSDEEP:	768:ycNleYUqsH1mcyq8q9Uw9GEyoI4xswOUde/OIN8Tph/bX8B0d:yOeYUqsH1mTq86Uw9GEyoI4xswOUde/g
MD5:	9EF3285C42382FDBC1E3C9BEE57A0516
SHA1:	075ECAC90A63A2C1FA7AA50D6BFA1AE614A6117E
SHA-256:	E85EB49427618F7014437B6762BE04A66E740FA708BB7EFBEA634DA27A2D5500
SHA-512:	3F0AF2CA56E5F2A577006C1017814280B3C9D6F8A25663E10DD3521C0163A0CFE3A3161B21C28F4BCD928A8A3B3A3296E7CC29E1F7C007B02C2BE873B4C21646
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import json.import zlib..from hashlib import sha1.from math import pow, sqrt, floor.from .common import InfoExtractor.from .vrv import VRVIE.from ..compat import (. compat_b64decode,. compat_etree_Element,. compat_etree_fromstring,. compat_urllib_parse_urlencode,. compat_urllib_request,. compat_urlparse,.).from ..utils import (. ExtractorError,. bytes_to_intlist,. extract_attributes,. float_or_none,. intlist_to_bytes,. int_or_none,. lowercase_escape,. remove_end,. sanitized_Request,. unified_strdate,. urlencode_postdata,. xpath_text,.).from ..aes import (. aes_cbc_decrypt,.)...class CrunchyrollBaseIE(InfoExtractor):. _LOGIN_URL = 'https://www.crunchyroll.com/login'. _LOGIN_FORM = 'login_form'. _NETRC_MACHINE = 'crunchyroll'.. def _call_rpc_api(self, method, video_id, note=None, data=None):. data = data or {}. data['req'] = 'RpcApi' + meth

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cspan.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8006
Entropy (8bit):	4.580622102732138
Encrypted:	false
SSDEEP:	192:0JFjtgqvKK5/77mS3FMxFY/ih9nb/w0RMPdt3nTiE6N+V:Urg6KY/7CS3FMjY/S9nb/w0RMPdtXTiw
MD5:	99FD477062CFC66ED1763CA3444F93F2
SHA1:	F9440B7721A2B7748D8324A1A513DA3447418857
SHA-256:	7FF4AF6C01429896AF255BB4AFC8B6B6D0E7ED58B23E7B7EDCFC0CF4B8D5AD93
SHA-512:	2ADBF73029913E3E34FB6451AA7B9C97FB5B700BF89E62B2ABDE5BCDF118931CD4BA6F0F703E056F14D652DE7DBCC0A103BD0260F141CD68290D09CE7524AC19
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. extract_attributes,. find_xpath_attr,. get_element_by_class,. int_or_none,. smuggle_url,. unescapeHTML,.).from .senateisvp import SenateISVPIE.from .ustream import UstreamIE...class CSpanIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?c-span\.org/video/\?(?P<id>[0-9a-f]+)'. IE_DESC = 'C-SPAN'. _TESTS = [{. 'url': 'http://www.c-span.org/video/?313572-1/HolderonV',. 'md5': '94b29a4f131ff03d23471dd6f60b6a1d',. 'info_dict': {. 'id': '315139',. 'title': 'Attorney General Eric Holder on Voting Rights Act Decision',. },. 'playlist_mincount': 2,. 'skip': 'Regularly fails on travis, for unknown reasons',. }, {. 'url': 'http://www.c-span.org/video/?c4486943/cspan-international-health-care-models',. # md5 is unstable. 'info_dict': {

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ctsnews.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3647
Entropy (8bit):	5.506941526037366
Encrypted:	false
SSDEEP:	96:MT28hE9wQGm6R3GLXbosjzLcZZXBSpgtfVO/12VHtI:S2+ThmA3LsXLbuNox
MD5:	5DDD67CBC03BD7AEDA764F769354F3B8
SHA1:	EF2D73AA1B2550B113A43729DB4D0D85DD352D1C
SHA-256:	AA3FEE736E38D4A61348990E88E8EC08214290D368E8925982FDE672CFE49AEE
SHA-512:	A71DF72717DE6B3327FE1FF689B1B2B5FCB2D99F214F1BE5D1AFDBE7278EE67C73D885D9CEB5FDA27F114633F0B16CD0EF8335F37776EB19F5B21A9A981E1798
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import unified_timestamp.from .youtube import YoutubeIE..class CtsNewsIE(InfoExtractor):. IE_DESC = '....'. _VALID_URL = r'https?://news\.cts\.com\.tw/[a-z]+/[a-z]+/\d+/(?P<id>\d+)\.html'. _TESTS = [{. 'url': 'http://news.cts.com.tw/cts/international/201501/201501291578109.html',. 'md5': 'a9875cb790252b08431186d741beaabe',. 'info_dict': {. 'id': '201501291578109',. 'ext': 'mp4',. 'title': '......... 3... - .....',. 'description': '.......................................................................................................',. 'timestamp': 1422528540,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ctvnews.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2276
Entropy (8bit):	4.802941320936468
Encrypted:	false
SSDEEP:	48:+uuzWfz3xaeAv4IQIs5dvIrdXY8XblAbtfVXnUgqob+:iELxaeAv4IQIs5dvIrxYA5Axfhy
MD5:	779A7543D22FDB21FBFEA220DF78EAC8
SHA1:	71F519F8B6420FFCE142F9A94A3FE47D1349A5D8
SHA-256:	F407001087926FD4104CE81F442865E499A54B9D5472F2D5D82CF1EFFD0B3FFF
SHA-512:	2D35E215C2BA7D6ACED3EC47CA75D27B72D251405240BDBA2A0A619A933931E8B92D522FB72EF85B414FD8A575D062F1537CD3C2DF80577280112BFA23945218
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import orderedSet...class CTVNewsIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?ctvnews\.ca/(?:video\?(?:clip\|playlist\|bin)Id=\|.*?)(?P<id>[0-9.]+)'. _TESTS = [{. 'url': 'http://www.ctvnews.ca/video?clipId=901995',. 'md5': '9b8624ba66351a23e0b6e1391971f9af',. 'info_dict': {. 'id': '901995',. 'ext': 'flv',. 'title': 'Extended: \'That person cannot be me\' Johnson says',. 'description': 'md5:958dd3b4f5bbbf0ed4d045c790d89285',. 'timestamp': 1467286284,. 'upload_date': '20160630',. }. }, {. 'url': 'http://www.ctvnews.ca/video?playlistId=1.2966224',. 'info_dict':. {. 'id': '1.2966224',. },. 'playlist_mincount': 19,. }, {. 'url': 'http://www.ctvnews.ca/video?binId=1.2876780',. 'info_dict':. {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cultureunplugged.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2508
Entropy (8bit):	4.8144138324880235
Encrypted:	false
SSDEEP:	48:PuOrDQvXfySn3Po0XQrvyStfdfFkZVUKyNzadZBTVfNlofGyAk8csx:drDQvPySn3Po0XQrvyQfGmKyNedz1NlH
MD5:	3AAC8D3F4BE25B998F4C4F27EE5A4114
SHA1:	AC3B9E21EF4E326A73EA8B15AD91745B9D60B1CC
SHA-256:	01E4CA60934680AA257A27D5DD479FCDE1947D01419B2E9A636EB9FEF30A99DC
SHA-512:	68276076B513BAA566FC7781567BC870DC3FEA8EA70B41B11940567A2CCF38CBC6A4ED1D948B3F4F6A384327627C99E63691027EB411673D0AA77153A32A7311
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import time..from .common import InfoExtractor.from ..utils import (. int_or_none,. HEADRequest,.)...class CultureUnpluggedIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cultureunplugged\.com/documentary/watch-online/play/(?P<id>\d+)(?:/(?P<display_id>[^/]+))?'. _TESTS = [{. 'url': 'http://www.cultureunplugged.com/documentary/watch-online/play/53662/The-Next--Best-West',. 'md5': 'ac6c093b089f7d05e79934dcb3d228fc',. 'info_dict': {. 'id': '53662',. 'display_id': 'The-Next--Best-West',. 'ext': 'mp4',. 'title': 'The Next, Best West',. 'description': 'md5:0423cd00833dea1519cf014e9d0903b1',. 'thumbnail': r're:^https?://.*\.jpg$',. 'creator': 'Coldstream Creative',. 'duration': 2203,. 'view_count': int,. }. }, {. 'url': 'http://www.cultureunplugged.com/documentary/watch-online/play/53662',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\curiositystream.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5984
Entropy (8bit):	4.445534430518342
Encrypted:	false
SSDEEP:	96:AUfRzh96fK5WcBHvMYlaUD66OFf7/XBGkz9SLBrBTnnw16NkxdTNpdjYmIu0flMz:AYh96yz3laUDXOFbX0ddTnc6NkP1tiW
MD5:	9FCC363E2741B942C0D1EE6F63A9FFB8
SHA1:	80D553DF5BBB4739A0C37832976567612689644A
SHA-256:	8D099743248ECEF376DFF46E30F87145664F267DEAA75BD5D7D4CFE2D37E6E60
SHA-512:	8C91E1A9FFB1AB7E79977043CDE52AD4938F329426AAE0FC93567D5CE34C91BEF6E14ACFF02D89D201D5DA2C264C1F38F5DC8DA7B226A66A2E4D0DD72E72EA02
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. urlencode_postdata,. compat_str,. ExtractorError,.)...class CuriosityStreamBaseIE(InfoExtractor):. _NETRC_MACHINE = 'curiositystream'. _auth_token = None. _API_BASE_URL = 'https://api.curiositystream.com/v1/'.. def _handle_errors(self, result):. error = result.get('error', {}).get('message'). if error:. if isinstance(error, dict):. error = ', '.join(error.values()). raise ExtractorError(. '%s said: %s' % (self.IE_NAME, error), expected=True).. def _call_api(self, path, video_id):. headers = {}. if self._auth_token:. headers['X-Auth-Token'] = self._auth_token. result = self._download_json(. self._API_BASE_URL + path, video_id, headers=headers). self._handle_errors(result). return result['data'].. def

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\cwtv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3840
Entropy (8bit):	4.840685827606199
Encrypted:	false
SSDEEP:	96:pTMiWqF8qbZj2iFzrND6HZvF+rEXIkqHfOrnkzDMztRue:+IEyOHNXI/vU
MD5:	BE6BE74EABA4494C03F9EB15CDDF2043
SHA1:	DFE6D8BE581E79970A24A65468938925EF16CCDF
SHA-256:	C8B79E37207E6614BA1158F761B9272BD78E5E79016F763A9BEF70791DF43509
SHA-512:	E2C95526543256F9E60E46171E4866A6B7A775E8139200EF1C0F453B5F6CE5A4797D50311CB9A86A74EC81000D2410938F601023601354618315DA0E3F34AF2A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. parse_age_limit,. parse_iso8601,. smuggle_url,. str_or_none,.)...class CWTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cw(?:tv(?:pr)?\|seed)\.com/(?:shows/)?(?:[^/]+/)+[^?]\?.\b(?:play\|watch)=(?P<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})'. _TESTS = [{. 'url': 'http://cwtv.com/shows/arrow/legends-of-yesterday/?play=6b15e985-9345-4f60-baf8-56e96be57c63',. 'info_dict': {. 'id': '6b15e985-9345-4f60-baf8-56e96be57c63',. 'ext': 'mp4',. 'title': 'Legends of Yesterday',. 'description': 'Oliver and Barry Allen take Kendra Saunders and Carter Hall to a remote location to keep them hidden from Vandal Savage while they figure out how to defeat him.',. 'duration': 2665,. 'series': 'Arrow',. 'season_number': 4,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dailymail.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3138
Entropy (8bit):	4.726226695300948
Encrypted:	false
SSDEEP:	96:xQE/Nn+Eal8vj8cycqUlCzeKGSgHXiXsLBT/I6Ng:RF+Es8vNq4UGScyXiTA6Ng
MD5:	AE08FB971474CAAABC63ED8AAAF241AD
SHA1:	2937ACCE5B5E853796325A4A36A6C0D4665EAF9A
SHA-256:	9093C414EB826518C0D8715F2110D40F10D6E4AF01AB5E5BFE442889A460AE38
SHA-512:	FBB9A1ADED465FF9407E326AEFEC996B9D5A49D92B504A715D3D08EE1E101EC1E2AF2B5EF61A3A04FF7816E1E2BCD3351D92935E8586411F4494570E6C30E837
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. determine_protocol,. try_get,. unescapeHTML,.)...class DailyMailIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?dailymail\.co\.uk/(?:video/[^/]+/video-\|embed/video/)(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.dailymail.co.uk/video/tvshowbiz/video-1295863/The-Mountain-appears-sparkling-water-ad-Heavy-Bubbles.html',. 'md5': 'f6129624562251f628296c3a9ffde124',. 'info_dict': {. 'id': '1295863',. 'ext': 'mp4',. 'title': 'The Mountain appears in sparkling water ad for \'Heavy Bubbles\'',. 'description': 'md5:a93d74b6da172dd5dc4d973e0b766a84',. }. }, {. 'url': 'http://www.dailymail.co.uk/embed/video/1295863.html',. 'only_matching': True,. }].. @staticmethod. def _extract_urls(webpage):. return

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dailymotion.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	19932
Entropy (8bit):	4.627847416932105
Encrypted:	false
SSDEEP:	384:kXopNVQlGubdFJdioza0lpKJM+lgluQRd2q0ii2byTR36NHQPy7C40ZTe06NNfaD:WlpKJM+lgluQRd2q0ii2byTR38wPMPmr
MD5:	139D15A69B6D3004FEBE31877C28D8B4
SHA1:	644223FEBCA29CC4465077F2952E201038FE70D6
SHA-256:	A5BBB478E6B1B5EDBAA8599115C92B9AAADE3A9E5C05C8E3494C459E7DC59017
SHA-512:	62142C7F0F1F1A04DC365208CFEC51432216FA1D12FF69970BA5D542BC23EABCF4F54FFF4DF87C0F17FEC5BD67DD999F7113BAFF0B0C4E61807B1A9AB7240936
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import functools.import hashlib.import itertools.import json.import random.import re.import string..from .common import InfoExtractor.from ..compat import compat_struct_pack.from ..utils import (. determine_ext,. error_to_compat_str,. ExtractorError,. int_or_none,. mimetype2ext,. OnDemandPagedList,. parse_iso8601,. sanitized_Request,. str_to_int,. try_get,. unescapeHTML,. update_url_query,. url_or_none,. urlencode_postdata,.)...class DailymotionBaseInfoExtractor(InfoExtractor):. @staticmethod. def _build_request(url):. """Build a request with the family filter disabled""". request = sanitized_Request(url). request.add_header('Cookie', 'family_filter=off; ff=off'). return request.. def _download_webpage_handle_no_ff(self, url, args, *kwargs):. request = self._build_request(url). return self._download_webpage_handle(request,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\daisuki.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5209
Entropy (8bit):	4.745353254708157
Encrypted:	false
SSDEEP:	96:jOZigkzyGvMR+aeR1H57ACujPtSdK15j/6F6NMdspIWO0ZRegjsrTcfIxi:MigAdg+ae757ACubYdK15jm6NMWQa
MD5:	7FBDAC73EE209BE20E36B2931FB947F0
SHA1:	4EBD435985C88435BE771FCBE887CDDB2ECC0F13
SHA-256:	DFE00FB6670A034930D96BD13AC0849E5F651C2AD58AFCDD922E84E61E0BC904
SHA-512:	B4648EED7AD4E31A224D4BC70F98A07EA7C1DB60F3FABDD5818EBCC7604C0D919A9238F59CAA823C874041E8684A248CD37F6B35A0CDB071B159E35AD05850B4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import base64.import json.import random.import re..from .common import InfoExtractor.from ..aes import (. aes_cbc_decrypt,. aes_cbc_encrypt,.).from ..compat import compat_b64decode.from ..utils import (. bytes_to_intlist,. bytes_to_long,. extract_attributes,. ExtractorError,. intlist_to_bytes,. js_to_json,. int_or_none,. long_to_bytes,. pkcs1pad,.)...class DaisukiMottoIE(InfoExtractor):. _VALID_URL = r'https?://motto\.daisuki\.net/framewatch/embed/[^/]+/(?P<id>[0-9a-zA-Z]{3})'.. _TEST = {. 'url': 'http://motto.daisuki.net/framewatch/embed/embedDRAGONBALLSUPERUniverseSurvivalsaga/V2e/760/428',. 'info_dict': {. 'id': 'V2e',. 'ext': 'mp4',. 'title': '#117 SHOWDOWN OF LOVE! ANDROIDS VS UNIVERSE 2!!',. 'subtitles': {. 'mul': [{. 'ext': 'ttml',. }],. },. },. 'params': {. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\daum.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11802
Entropy (8bit):	5.028129119841808
Encrypted:	false
SSDEEP:	192:3E1n/lY2knbZHNn6F1YSQthU4FFzhtTP6Ns8HsOWv9vw+5oJUeJUGdBw1BTXIZMs:3E1/lunbZHNn41tQthUkFzhtTP6NRHsW
MD5:	D07FC78709C42273AAFBA0FF189B8897
SHA1:	090873E544FD26209CD1892CD7154910AE373801
SHA-256:	59176873821BC02B33499DC7C857B02A32C87928669E7A1935489A2D6920EB79
SHA-512:	4AFCCE183CE739D9286D116C211104E5836B21D4281CB70D4C42E587E894C38BC2BB3B6D9427743C26A037486478364584B30770E23AFDEDEC6F6B0C73023DCB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse_unquote,. compat_urllib_parse_urlencode,. compat_urlparse,.).from ..utils import (. int_or_none,. str_to_int,. xpath_text,. unescapeHTML,.)...class DaumIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:m\.)?tvpot\.daum\.net/v/\|videofarm\.daum\.net/controller/player/VodPlayer\.swf\?vid=)(?P<id>[^?#&]+)'. IE_NAME = 'daum.net'.. _TESTS = [{. 'url': 'http://tvpot.daum.net/v/vab4dyeDBysyBssyukBUjBz',. 'info_dict': {. 'id': 'vab4dyeDBysyBssyukBUjBz',. 'ext': 'mp4',. 'title': '.. .. vs .... ..',. 'description': 'Mark Hunt vs Antonio Silva',. 'upload_date': '20131217',. 'thumbnail': r're:^https?://.*\.(?:jpg\|png)',. 'duration': 2117,. 'view_count': int,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dbtv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1955
Entropy (8bit):	4.934639221531389
Encrypted:	false
SSDEEP:	48:+uhGIlbCf9ifkIXSgwWE1ziXwCt8cy38IdJulfFIxgT:FGIlQ9ifkIC5WE1zSn8cysIdJuQG
MD5:	3D218F47E31BA6B64A4450A3B33CEE78
SHA1:	E03630DEDF2CBFB8988F237C81BF74FF089B79C1
SHA-256:	FF5C7A1E6DC6A9AED46BEF85FDCD998EEFEB8EDD0421FC4E85E622837E834C3F
SHA-512:	BB18A5AB7ED369EB3D8919C590C9F099BEB681A72159A038BB4D25F86EA478A8ECE2E7B01D035F20FFC08FA7C456FD32B42DFFE6F29DD4D06822032BDDB1FF38
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class DBTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?dagbladet\.no/video/(?:(?:embed\|(?P<display_id>[^/]+))/)?(?P<id>[0-9A-Za-z_-]{11}\|[a-zA-Z0-9]{8})'. _TESTS = [{. 'url': 'https://www.dagbladet.no/video/PynxJnNWChE/',. 'md5': 'b8f850ba1860adbda668d367f9b77699',. 'info_dict': {. 'id': 'PynxJnNWChE',. 'ext': 'mp4',. 'title': 'Skulle teste ut forn.yelsespark, men kollegaen var bare opptatt av bikinikroppen',. 'description': 'md5:49cc8370e7d66e8a2ef15c3b4631fd3f',. 'thumbnail': r're:https?://.*\.jpg',. 'upload_date': '20160916',. 'duration': 69,. 'uploader_id': 'UCk5pvsyZJoYJBd7_oFPTlRQ',. 'uploader': 'Dagbladet',. },. 'add_ie': ['Youtube']. }, {. 'url': 'https://www.dagbladet.no/video/embed/xlGmyIeN9Jo/?autoplay=false',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dctp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3886
Entropy (8bit):	4.557597588637339
Encrypted:	false
SSDEEP:	96:giS7ozXjCexAcvJD8CjPGSlCC2ty3zN1TZrTVjV8F6Ng:P3HJDjPGCCRty3Xo6Ng
MD5:	E44AC4225AADF3D2AA1C026B69B14D59
SHA1:	4CA4BC48309497E784C1EE548DF21C1333F8AD52
SHA-256:	6E600C12A89AB67A4670C07B2B5183BB575FA83BCE9E76AC0079C7B7A76A7333
SHA-512:	A4AE676672A571FEA9A1E0978CAC2E68080A2B8B4023C5FDBEBC8C82E7A82F6DDE1532DD2D3E2EE4208E42D2775EA44729FEF5743E5FC95216B0986DAB61F894
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. float_or_none,. int_or_none,. unified_timestamp,. url_or_none,.)...class DctpTvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?dctp\.tv/(?:#/)?filme/(?P<id>[^/?#&]+)'. _TESTS = [{. # 4x3. 'url': 'http://www.dctp.tv/filme/videoinstallation-fuer-eine-kaufhausfassade/',. 'info_dict': {. 'id': '95eaa4f33dad413aa17b4ee613cccc6c',. 'display_id': 'videoinstallation-fuer-eine-kaufhausfassade',. 'ext': 'flv',. 'title': 'Videoinstallation f.r eine Kaufhausfassade',. 'description': 'Kurzfilm',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 71.24,. 'timestamp': 1302172322,. 'upload_date': '20110407',. },. 'params': {. # rtmp download. 'skip_download': True,. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\deezer.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3280
Entropy (8bit):	4.731910064673617
Encrypted:	false
SSDEEP:	96:Qp0suNYhBlzcZ/eQwhdWOt6wEiH4GBbAP2IBBTnqe06NhLc7UC:G00emJS1wA+oTqe06NE
MD5:	2AB7B77708748B752D43218FCA129DC3
SHA1:	295A4DA06B6A80C1BFB0550239370F957184EEA8
SHA-256:	81B7CE75545E152075D74E9D4BEEBDD0D228AE4CFD887BA07A496264D30EC700
SHA-512:	A47647367DCE9ABC9A2CF5CDDD61E8CA9E81289B7B5D07469460929072D12A5DF61139E37B5F822D70D4822977292E91087501A0402F2938F012BBFD9B0A2943
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. orderedSet,.)...class DeezerPlaylistIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?deezer\.com/playlist/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.deezer.com/playlist/176747451',. 'info_dict': {. 'id': '176747451',. 'title': 'Best!',. 'uploader': 'Anonymous',. 'thumbnail': r're:^https?://cdn-images\.deezer\.com/images/cover/.*\.jpg$',. },. 'playlist_count': 30,. 'skip': 'Only available in .de',. }.. def _real_extract(self, url):. if 'test' not in self._downloader.params:. self._downloader.report_warning('For now, this extractor only supports the 30 second previews. Patches welcome!').. mobj = re.match(self._VALID_URL, url). playlist_id = mobj.group('id').. webpage = self._download_webpage(

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\defense.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	4.900787707351976
Encrypted:	false
SSDEEP:	24:1R8lFvBn0wWFJzv/XedlCOJOaUXjlxTIBG4h+WapvfSwpZPlc:PuTn0LFhXe2OgaUXjlx0B/cWyvrZG
MD5:	C28DB9606EEBAB1CC95ED264A6861006
SHA1:	52396D330EC1C7A9FEBEA7857075E9E7C130FDE6
SHA-256:	88EFC6BB8F9D992C9539DE0505B92140A9C66373446D5B943C75E57E002B3ADC
SHA-512:	5837620804CF15B8DF9E46DDFF51176C1EC1F602A881808B315F55BEAA8598A2E673C37879049C99357A7CE536349F4F16F1F69E4B258E2735B8252643989AFE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class DefenseGouvFrIE(InfoExtractor):. IE_NAME = 'defense.gouv.fr'. _VALID_URL = r'https?://.?\.defense\.gouv\.fr/layout/set/ligthboxvideo/base-de-medias/webtv/(?P<id>[^/?#])'.. _TEST = {. 'url': 'http://www.defense.gouv.fr/layout/set/ligthboxvideo/base-de-medias/webtv/attaque-chimique-syrienne-du-21-aout-2013-1',. 'md5': '75bba6124da7e63d2d60b5244ec9430c',. 'info_dict': {. 'id': '11213',. 'ext': 'mp4',. 'title': 'attaque-chimique-syrienne-du-21-aout-2013-1'. }. }.. def _real_extract(self, url):. title = self._match_id(url). webpage = self._download_webpage(url, title).. video_id = self._search_regex(. r"flashvars.pvg_id=\"(\d+)\";",. webpage, 'ID').. json_url = (. 'http://static.videos.gouv.fr/brightcovehub/export/json/%s' %. video_id). info = self._downl

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\democracynow.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3101
Entropy (8bit):	4.672505823822513
Encrypted:	false
SSDEEP:	96:T8U7R6FuYj7kWFDAeqfJaNCxrZS1Vlf6BT6vIW54qBn6Ng:T718uiwQE7JaN2ZS1VlmT6vdxp6Ng
MD5:	47773DC4906A9D19151D6A8EFC94B2D7
SHA1:	5F15628A2E4A1E412D169D6EEF797E0243B74BFE
SHA-256:	E46C55F0B30E9B3B59477EFB38532EDBCC2C40FA0488E564FB6F13A301E1318C
SHA-512:	B4931CE92B4E393BE759B5224D89B7075917119B2D831A2EFBA67298B7273989F91EEDB7931E854644F788C44385D435603BA15BB8522740976C80BD035F8B20
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import os.path..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. url_basename,. remove_start,.)...class DemocracynowIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?democracynow\.org/(?P<id>[^\?]*)'. IE_NAME = 'democracynow'. _TESTS = [{. 'url': 'http://www.democracynow.org/shows/2015/7/3',. 'md5': '3757c182d3d84da68f5c8f506c18c196',. 'info_dict': {. 'id': '2015-0703-001',. 'ext': 'mp4',. 'title': 'Daily Show for July 03, 2015',. 'description': 'md5:80eb927244d6749900de6072c7cc2c86',. },. }, {. 'url': 'http://www.democracynow.org/2015/7/3/this_flag_comes_down_today_bree',. 'info_dict': {. 'id': '2015-0703-001',. 'ext': 'mp4',. 'title': '"This Flag Comes Down Today": Bree Newsome Scales SC Capitol Flagpole, Takes Down Confederate Flag',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dfb.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2255
Entropy (8bit):	4.737086000642958
Encrypted:	false
SSDEEP:	48:Pu+WFrzOf0XdOBdTntPpJulfFIifIkkAfL5UAaURdDU5iqS8OlTJBTSgCWh6Ng:bk/OsXdOBdbtPpJueCL5xIiqS8OllBTb
MD5:	F34961F879EC667081C745CDA8216713
SHA1:	B3B1C44F62C841572CC96F85D33DDDEA582A08EE
SHA-256:	F61F1B74F1CFBEF5A87656565B6110184331D544725DC40479A953FFD8534FD1
SHA-512:	5F8FDE223A1D6651A05CEE568688B4EE678B72A15C0B892D3DD5A92D3BD70B601C2AA84ADEF8DDA9052B294DA2181A7DF1C620D23447601CCC954CCB130BE4E2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import unified_strdate...class DFBIE(InfoExtractor):. IE_NAME = 'tv.dfb.de'. _VALID_URL = r'https?://tv\.dfb\.de/video/(?P<display_id>[^/]+)/(?P<id>\d+)'.. _TEST = {. 'url': 'http://tv.dfb.de/video/u-19-em-stimmen-zum-spiel-gegen-russland/11633/',. 'md5': 'ac0f98a52a330f700b4b3034ad240649',. 'info_dict': {. 'id': '11633',. 'display_id': 'u-19-em-stimmen-zum-spiel-gegen-russland',. 'ext': 'mp4',. 'title': 'U 19-EM: Stimmen zum Spiel gegen Russland',. 'upload_date': '20150714',. },. }.. def _real_extract(self, url):. display_id, video_id = re.match(self._VALID_URL, url).groups().. player_info = self._download_xml(. 'http://tv.dfb.de/server/hd_video.php?play=%s' % video_id,. display_id). video_info = player_info.find('video'). stream_access_url =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dhm.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	5.0008639249047535
Encrypted:	false
SSDEEP:	48:PuXo1fZeCjENXEQjgpDBSXefOZXh0C/BlXCwHLQBYPX4Ux0EKqQ8c4bdB:aoN5ENXEQjgZsXefO0CjCULjN3Kz8hxB
MD5:	E7B5A63FD2FC0E073E90D2A76AF42B9F
SHA1:	6AC8BB61DD3910FAD6F85C7262E61005C558840A
SHA-256:	3823C434310D2D343AE64FE02DBC096561B23BC66F0AC7CB995FF4E3B11DD4E1
SHA-512:	94FDC6524BDA070A8410F32A1324B93F1975595DB84CDAE4D56FDFE7AA105B6FA4E7D7F1B77058D374F2C51995CF54D9B259594F65589AAE4D9D287012BBC27F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import parse_duration...class DHMIE(InfoExtractor):. IE_DESC = 'Filmarchiv - Deutsches Historisches Museum'. _VALID_URL = r'https?://(?:www\.)?dhm\.de/filmarchiv/(?:[^/]+/)+(?P<id>[^/]+)'.. _TESTS = [{. 'url': 'http://www.dhm.de/filmarchiv/die-filme/the-marshallplan-at-work-in-west-germany/',. 'md5': '11c475f670209bf6acca0b2b7ef51827',. 'info_dict': {. 'id': 'the-marshallplan-at-work-in-west-germany',. 'ext': 'flv',. 'title': 'MARSHALL PLAN AT WORK IN WESTERN GERMANY, THE',. 'description': 'md5:1fabd480c153f97b07add61c44407c82',. 'duration': 660,. 'thumbnail': r're:^https?://.*\.jpg$',. },. }, {. 'url': 'http://www.dhm.de/filmarchiv/02-mapping-the-wall/peter-g/rolle-1/',. 'md5': '09890226332476a3e3f6f2cb74734aa5',. 'info_dict': {. 'id': 'rolle-1',. 'ext

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\digg.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1882
Entropy (8bit):	4.696264577759261
Encrypted:	false
SSDEEP:	48:Pu+YB5YgDxNDNQiL1wetfJoXhhZuXH0g7oI1:L05YgDxNNQMwcfJa60GD1
MD5:	F0B00CE1F90F7D21A0DF056FBEE311DC
SHA1:	90C55A54CCB39AAE11F13745F572251FAEAEDE84
SHA-256:	0C254B0687B1D1E83B9BE44F07AE550ECFE472C148CABEB24DC4D70A65192E57
SHA-512:	2335309CD2B203AAC01B2AF4D7344A5D1B36914C66366869F17B8F10155DD75B2C154A9B930967BE13BDD25A2F60ADC30F3BBE4D5413E2C3210ECDF55541DDA5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import js_to_json...class DiggIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?digg\.com/video/(?P<id>[^/?#&]+)'. _TESTS = [{. # JWPlatform via provider. 'url': 'http://digg.com/video/sci-fi-short-jonah-daniel-kaluuya-get-out',. 'info_dict': {. 'id': 'LcqvmS0b',. 'ext': 'mp4',. 'title': "'Get Out' Star Daniel Kaluuya Goes On 'Moby Dick'-Like Journey In Sci-Fi Short 'Jonah'",. 'description': 'md5:541bb847648b6ee3d6514bc84b82efda',. 'upload_date': '20180109',. 'timestamp': 1515530551,. },. 'params': {. 'skip_download': True,. },. }, {. # Youtube via provider. 'url': 'http://digg.com/video/dog-boat-seal-play',. 'only_matching': True,. }, {. # vimeo as regular embed. 'url': 'http://digg.com/video/dream-girl-short-film',. 'only_m

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\digiteka.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3509
Entropy (8bit):	4.588634332458504
Encrypted:	false
SSDEEP:	96:ZU67d3+r/InP5AIz/RX3m8c3Qntk6iuhBTfeNlmadt/8Z6Ng:F71+OP2Ip3vtauvTnZ6Ng
MD5:	5377A6CA5950C815DFA3D497ADA9C530
SHA1:	B96393E37CB9042581895E15D27A3B8F34365D87
SHA-256:	3B9300C66059C009E1092129787001937C9527B1FFDD9DF103DD85EB4C2E3878
SHA-512:	756797ED5368BDFD290C699CB0619CE67CA3705A547A8733DB92271CC8B9702E2C666A3351176FFF2AFB9E8C71C2A04FE7ECCE5F0774E219D33A825E72EC4F5C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class DigitekaIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://(?:www\.)?(?:digiteka\.net\|ultimedia\.com)/. (?:. deliver/. (?P<embed_type>. generic\|. musique. ). (?:/[^/]+)*/. (?:. src\|. article. )\|. default/index/video. (?P<site_type>. generic\|. music. ). /id. )/(?P<id>[\d+a-z]+)'''. _TESTS = [{. # news. 'url': 'https://www.ultimedia.com/default/index/videogeneric/id/s8uk0r',. 'md5': '276a0e49de58c7e85d32b057837952a2',. 'info_dict': {. 'id': 's8uk0r',. 'ext': 'mp4',. 'title': 'Loi sur la fin de vie: le texte pr.voit un renforcement des directives anticip.es',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\discovery.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4791
Entropy (8bit):	4.516801047460295
Encrypted:	false
SSDEEP:	96:mj3mZgPE6Wld/vv2vl+k5N6rXkxNwG4+ZcKlBbpST2:mjWZgPPwf2vl+kH6rY+klhpV
MD5:	AD8D8D02643A2D23D1D190B96F4A6630
SHA1:	5135C938FAE684202FA3FB4D9AC0904139E184A7
SHA-256:	DCF50E2D7A66D736025B0F5DCBC158D93B8BFBDD8A79232836800287C2659B1A
SHA-512:	A21BFA0223716DC6D277586FADDE46A20FE79B37857B034B539F750307E82667DC1513376F2D676D073881335231AFD9C35F3EB682A7F250ED17C0AA78A33AEC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import random.import re.import string..from .discoverygo import DiscoveryGoBaseIE.from ..compat import (. compat_str,. compat_urllib_parse_unquote,.).from ..utils import (. ExtractorError,. try_get,. HEADRequest.).from ..compat import compat_HTTPError...class DiscoveryIE(DiscoveryGoBaseIE):. _VALID_URL = r'''(?x)https?://. (?P<site>. (?:www\.\|go\.)?. (?:. discovery\|. investigationdiscovery\|. discoverylife\|. animalplanet\|. ahctv\|. destinationamerica\|. sciencechannel\|. tlc\|. velocity. )\|. watch\.. (?:. hgtv\|. foodnetwork\|. travelchannel\|. diynetwork\|. cookingchanneltv\|. motortr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\discoverygo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6079
Entropy (8bit):	4.555266815536536
Encrypted:	false
SSDEEP:	96:lOKUG8+LvpRIOfIi8BTrghNg5jD5sit3mh8qNTK6NPzL4CF73JaHDZomHRAnoIEA:0KUxajIOfIiUTZws3eK6NP40JajZjbmb
MD5:	255A4835A769A9B5847F38088163A45E
SHA1:	D68A57EFEF3244474260E8858EA9853B803D8924
SHA-256:	8CE5E86D85A74F16DB7CBE2460ACE0CC535931FCD31A4128718BB4D66383003C
SHA-512:	C04ECED2F12CD4F80B7EA4721C38172557171F05AB07D5E4071F5FCB34A206578B3812C1119920A3087E9DF21D13E407B82A97E8AA31700A887AD9F8D9928E91
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. extract_attributes,. ExtractorError,. int_or_none,. parse_age_limit,. remove_end,. unescapeHTML,. url_or_none,.)...class DiscoveryGoBaseIE(InfoExtractor):. _VALID_URL_TEMPLATE = r'''(?x)https?://(?:www\.)?(?:. discovery\|. investigationdiscovery\|. discoverylife\|. animalplanet\|. ahctv\|. destinationamerica\|. sciencechannel\|. tlc\|. velocitychannel. )go\.com/%s(?P<id>[^/?#&]+)'''.. def _extract_video_info(self, video, stream, display_id):. title = video['name'].. if not stream:. if video.get('authenticated') is True:. raise ExtractorError(. 'This video is only available via cable service provider subscription that'. ' is not currently supported. You may want

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\discoverynetworks.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2586
Entropy (8bit):	4.889857615322385
Encrypted:	false
SSDEEP:	48:+uOSs50efsRu3gOqnwlXSU/Sty5dfFFlvTDwrSBcxdFCuOGoISCT:CSG0YsRu39qnUSI5rX4FZ0CT
MD5:	6698FEAB37322F3680DAE5BFFB6F96A8
SHA1:	49ADB51EBB684E7D2F8EF9301B883DD6A74CE31D
SHA-256:	ADCA3D46661304CAA56BA2973DF364F8B32C6415AAA3B9235C72AE5D0316637E
SHA-512:	63A957C121C864ED5CD92F7868415586C4DED07192F655E6E21C90C8DFB9D8667F3156C232A0114852E81540DEE58132218833C39848C8B001C7952A3E0C026C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .brightcove import BrightcoveLegacyIE.from .dplay import DPlayIE.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import smuggle_url...class DiscoveryNetworksDeIE(DPlayIE):. _VALID_URL = r'''(?x)https?://(?:www\.)?(?P<site>discovery\|tlc\|animalplanet\|dmax)\.de/. (?:. .\#(?P<id>\d+)\|. (?:[^/]+/)videos/(?P<display_id>[^/?#]+)\|. programme/(?P<programme>[^/]+)/video/(?P<alternate_id>[^/]+). )'''.. _TESTS = [{. 'url': 'http://www.tlc.de/sendungen/breaking-amish/videos/#3235167922001',. 'info_dict': {. 'id': '3235167922001',. 'ext': 'mp4',. 'title': 'Breaking Amish: Die Welt da drau.en',. 'description': (. 'Vier Amische und eine Mennonitin wagen in New York'. ' den Sprung

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\discoveryvr.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2129
Entropy (8bit):	4.6341549046378665
Encrypted:	false
SSDEEP:	48:+uldfXmnmGaJoXjlhsBr3FubNVYGDZIiE5ad7BZQx+EYg6NDU:BdfWnmGaJse38N91Sat4x+EYg6NDU
MD5:	23FB5EB745BD588FA29E44674D849B4C
SHA1:	1AC45615FB324B0D788F1FF11E7EF65DD3D85464
SHA-256:	1289160B78B2BD7A5DAE5A262EFB826B0E26036A7CDB8D2A9FFB05113839D261
SHA-512:	83BE60051383313473D609FD16B211CD9CF8DD1133DABB0701BA96658FD77A9592298E37EE89E89BCF5DD80F63926098D9B4243A2F348507CF8DC3D68A640DEA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import parse_duration...class DiscoveryVRIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?discoveryvr\.com/watch/(?P<id>[^/?#]+)'. _TEST = {. 'url': 'http://www.discoveryvr.com/watch/discovery-vr-an-introduction',. 'md5': '32b1929798c464a54356378b7912eca4',. 'info_dict': {. 'id': 'discovery-vr-an-introduction',. 'ext': 'mp4',. 'title': 'Discovery VR - An Introduction',. 'description': 'md5:80d418a10efb8899d9403e61d8790f06',. }. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id).. bootstrap_data = self._search_regex(. r'root\.DVR\.bootstrapData\s+=\s+"({.+?})";',. webpage, 'bootstrap data'). bootstrap_data = self._parse_json(. bootstrap_data.encode('utf-8').decode('unico

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\disney.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	4.681680564846151
Encrypted:	false
SSDEEP:	192:TqFdAXB/uzmAmvHeTCHQRzM3MyTlN5RWpjUZTqj5uo1dQ+KmCuuIX3Tdh6No:+FdWB/uzmAeHe+HQRzI1TlN5opqTqj5t
MD5:	30B215E71817AD7125B978E4BE213532
SHA1:	F58DB76461C24C95908CA53E724FDC5F53C45461
SHA-256:	987DDE928D61553E706297DA4D1E94F09ED5D6E97C0A1B87D6F17480E6676EA8
SHA-512:	6679F504C5D773D84C4572B28D09A3DD3A3E45F3C1901EF215CAA1D7117A4B99895052F78BD9691FC690518DE5918422DA03403861E279ACBCD60113149B2564
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_strdate,. compat_str,. determine_ext,. ExtractorError,. update_url_query,.)...class DisneyIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://(?P<domain>(?:[^/]+\.)?(?:disney\.[a-z]{2,3}(?:\.[a-z]{2})?\|disney(?:(?:me\|latino)\.com\|turkiye\.com\.tr\|channel\.de)\|(?:starwars\|marvelkids)\.com))/(?:(?:embed/\|(?:[^/]+/)+[\w-]+-)(?P<id>[a-z0-9]{24})\|(?:[^/]+/)?(?P<display_id>[^/?#]+))'''. _TESTS = [{. # Disney.EmbedVideo. 'url': 'http://video.disney.com/watch/moana-trailer-545ed1857afee5a0ec239977',. 'info_dict': {. 'id': '545ed1857afee5a0ec239977',. 'ext': 'mp4',. 'title': 'Moana - Trailer',. 'description': 'A fun adventure for the entire Family! Bring home Moana on Digital HD Feb 21 & Blu-ray March 7',. 'upload_date': '20170112',. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dispeak.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4661
Entropy (8bit):	4.64184070203181
Encrypted:	false
SSDEEP:	96:oUl8XqP0A3kDnDuh5mgbyVOyhe8V7+Iav4s1RKV13AUml26Ax1agoSTag98vhJUV:oUUA3kX25FyIYSIav4rV13All26AjagN
MD5:	9E86B9CCF55B65D048CEFD071F64F87A
SHA1:	133FB68C70F12DDC2A10B8B48020AC1E657C45D4
SHA-256:	E0165544D9F140D007E041874B9BFC9EFB660CA9E7FA0A75F8224293A137A180
SHA-512:	33CAE96E4B089A18F49F7596ECBA0CE25D642563D82C9DCC3F6A7788B18463EEADFC6DB9888B12BC2DD6D2773D86723B1FC746CDB3D6E0760D2EC1AC6A9F5840
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. remove_end,. xpath_element,. xpath_text,.)...class DigitallySpeakingIE(InfoExtractor):. _VALID_URL = r'https?://(?:s?evt\.dispeak\|events\.digitallyspeaking)\.com/(?:[^/]+/)+xml/(?P<id>[^.]+)\.xml'.. _TESTS = [{. # From http://gdcvault.com/play/1023460/Tenacious-Design-and-The-Interface. 'url': 'http://evt.dispeak.com/ubm/gdc/sf16/xml/840376_BQRC.xml',. 'md5': 'a8efb6c31ed06ca8739294960b2dbabd',. 'info_dict': {. 'id': '840376_BQRC',. 'ext': 'mp4',. 'title': 'Tenacious Design and The Interface of \'Destiny\'',. },. }, {. # From http://www.gdcvault.com/play/1014631/Classic-Game-Postmortem-PAC. 'url': 'http://events.digitallyspeaking.com/gdc/sf11/xml/12396_1299111843500GMPX.xml',. 'only_matching': True,. }, {. # From http://www.gdc

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dlive.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3025
Entropy (8bit):	4.752854182011624
Encrypted:	false
SSDEEP:	48:PuXNnNyUBnsaafFIUqB1bOt7ZKEREErqGy9rBTJ26NQrb8r1UrXrmR8HJSXjdB1M:QnNyUZsagebOt7BiErdy5BT06NQX8JU1
MD5:	A2F2F369AB9A63FBA6DBA64BCE17D027
SHA1:	252E91C8FF5E93807284A6699B449CD9F303D54B
SHA-256:	603A5E7058E84B2FB5F3388812E831B25C37734B766A159F8E1BD6E77A30CD9B
SHA-512:	C83B1CBF31516155DE0A09142AC3687F11CBD986FB3FB688529504A526223F262CE64A0348940BB04800B8C0EC593C60D9A3102323ECAB8540DCD1E29F30E071
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import int_or_none...class DLiveVODIE(InfoExtractor):. IE_NAME = 'dlive:vod'. _VALID_URL = r'https?://(?:www\.)?dlive\.tv/p/(?P<uploader_id>.+?)\+(?P<id>[a-zA-Z0-9]+)'. _TEST = {. 'url': 'https://dlive.tv/p/pdp+3mTzOl4WR',. 'info_dict': {. 'id': '3mTzOl4WR',. 'ext': 'mp4',. 'title': 'Minecraft with james charles epic',. 'upload_date': '20190701',. 'timestamp': 1562011015,. 'uploader_id': 'pdp',. }. }.. def _real_extract(self, url):. uploader_id, vod_id = re.match(self._VALID_URL, url).groups(). broadcast = self._download_json(. 'https://graphigo.prd.dlive.tv/', vod_id,. data=json.dumps({'query': '''query {. pastBroadcast(permlink:"%s+%s") {. content. createdAt. length. playbackUrl. title. thumbnailUrl. viewCount. }.}''

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\dotsub.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3079
Entropy (8bit):	4.751739002934147
Encrypted:	false
SSDEEP:	96:lMj+TvU2bWZJ9veRR7V1atw2fxtoTQ0j4etExIBHWw6:IycXhve77au8xtKZtEvw6
MD5:	E676D3ED46103493A24917D9881D38B4
SHA1:	15673683BA9994ABA5B39A9A010D005075708BF7
SHA-256:	4A6C496D416D5F130FB60E140DB3B4026DFA8C20E632030931D03515D983A02B
SHA-512:	3BD043418E245D2CACFF5BAF1E14563596FB35B0F2C5CC440A14CBC1F5BCB841B3EA38F62690CB72D4C9767EEE7AC5DE3FDA6AFA65278657467CA049915CAF07
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. float_or_none,. int_or_none,.)...class DotsubIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?dotsub\.com/view/(?P<id>[^/]+)'. _TESTS = [{. 'url': 'https://dotsub.com/view/9c63db2a-fa95-4838-8e6e-13deafe47f09',. 'md5': '21c7ff600f545358134fea762a6d42b6',. 'info_dict': {. 'id': '9c63db2a-fa95-4838-8e6e-13deafe47f09',. 'ext': 'flv',. 'title': 'MOTIVATION - "It\'s Possible" Best Inspirational Video Ever',. 'description': 'md5:41af1e273edbbdfe4e216a78b9d34ac6',. 'thumbnail': 're:^https?://dotsub.com/media/9c63db2a-fa95-4838-8e6e-13deafe47f09/p',. 'duration': 198,. 'uploader': 'liuxt',. 'timestamp': 1385778501.104,. 'upload_date': '20131130',. 'view_count': int,. }. }, {. 'url': 'https://dotsub.com/view/747bcf58-bd59-45b7-8c8c-ac312

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\douyutv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6878
Entropy (8bit):	4.908855664852231
Encrypted:	false
SSDEEP:	192:uSCRCLQC/VPyEuXbsNPhISU0lYjHLnn07dJGtJt6NoB:uSg/a9XuYNPhISjlen07dJCt6N2
MD5:	C32B833C97989ED4E18D0E0B446C0F90
SHA1:	28782F7FD887B6F783EA543B3DC20FF3972C8251
SHA-256:	00FEFD9B0FBDA046ED34E4EACC6769BF4E7B564F1335B88720624FF4FC8E269A
SHA-512:	4D2B227F412C7249AD3B629BEFAEBE3CC7AE242970A834CDDCEB302BD3760F0ABDAD904C65F30AE75000C3F2922A58821315804D57EDCE278D7D763343A7DF18
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import time.import hashlib.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. unescapeHTML,. unified_strdate,. urljoin,.)...class DouyuTVIE(InfoExtractor):. IE_DESC = '..'. _VALID_URL = r'https?://(?:www\.)?douyu(?:tv)?\.com/(?:[^/]+/)(?P<id>[A-Za-z0-9]+)'. _TESTS = [{. 'url': 'http://www.douyutv.com/iseven',. 'info_dict': {. 'id': '17732',. 'display_id': 'iseven',. 'ext': 'flv',. 'title': 're:^............ [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': r're:.m7show@163\.com.',. 'thumbnail': r're:^https?://.\.jpg$',. 'uploader': '7..',. 'is_live': True,. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'http://www.douyutv.com/85982',. 'info_dict': {. 'id':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\hotnewhiphop.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2283
Entropy (8bit):	4.74208916269998
Encrypted:	false
SSDEEP:	48:PusS98RJ+kajXjlkABIgJBVYYLtVosBIoncYVO3Jq+qWfV83vf:/S98ukaqHg9Y4PoBoncYUJ1bO33
MD5:	2122A725F6CFB3257C6C1E05355F1854
SHA1:	482795BB7606F5FE55D537B82D0370C190714649
SHA-256:	C608E40CE5005AF737BD60CB47CB88B6DF974ED2E6240EAC36F517DAC1663101
SHA-512:	4DBA2BBD11863D05C06B031618D3A1EF6F1C848A0182A1FDB6A6523F6A0874EB39169565031ED2A40729CC690CBBBFC5C9918DBE6941D08C39933E2C2480F9FF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_b64decode.from ..utils import (. ExtractorError,. HEADRequest,. sanitized_Request,. urlencode_postdata,.)...class HotNewHipHopIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?hotnewhiphop\.com/.\.(?P<id>.)\.html'. _TEST = {. 'url': 'http://www.hotnewhiphop.com/freddie-gibbs-lay-it-down-song.1435540.html',. 'md5': '2c2cd2f76ef11a9b3b581e8b232f3d96',. 'info_dict': {. 'id': '1435540',. 'ext': 'mp3',. 'title': 'Freddie Gibbs - Lay It Down'. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. video_url_base64 = self._search_regex(. r'data-path="(.*?)"', webpage, 'video URL', default=None).. if video_url_base64 is None:. video_url = self._search_regex(. r'"contentUrl" c

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\hotstar.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7339
Entropy (8bit):	4.671202612664414
Encrypted:	false
SSDEEP:	192:YC0V8hQjYdVCjht+IOyTqAaGSTVv54MWlbObqTobiysTKR6N5pAa8R0Y:f0V86E7Cjht+hyTqJzJv4ObqTobiysTc
MD5:	D347ACE0A0469A1EC193FADB5DD6EC30
SHA1:	B06FF5010D3ACD630B5390AC01123A1F301BAC18
SHA-256:	63228AE21662EC1887BC07E433C03D47422DD7CD79EB6F1CBDD3FFCDF17A3607
SHA-512:	0F12AE6D8A32DAA5A4FE84D100B8E4B5F4190C59040AE3D838CA9C6EB2F0B235A2BA006363EFA92E5630E643DA2E5C20A5E26288767B6A12C9A65DE4B2EDBBA4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import hmac.import time.import uuid..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. str_or_none,. try_get,. url_or_none,.)...class HotStarBaseIE(InfoExtractor):. _AKAMAI_ENCRYPTION_KEY = b'\x05\xfc\x1a\x01\xca\xc9\x4b\xc4\x12\xfc\x53\x12\x07\x75\xf9\xee'.. def _call_api_impl(self, path, video_id, query):. st = int(time.time()). exp = st + 6000. auth = 'st=%d~exp=%d~acl=/*' % (st, exp). auth += '~hmac=' + hmac.new(self._AKAMAI_ENCRYPTION_KEY, auth.encode(), hashlib.sha256).hexdigest(). response = self._download_json(. 'https://api.hotstar.com/' + path, video_id, headers={. 'hotstarauth': auth,. 'x-country-code': 'IN',. 'x-platform-code': 'JIO',. }, query=query). if re

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\howcast.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	4.7952958431026165
Encrypted:	false
SSDEEP:	24:1R8lFvqLG+IwS0k4xYn/KdlogthxZ7nxNHNPb0eIXhgtxoBDaytnRYHJFOgEZQSm:PuULNIQkV/KNvnxFNP4jXhk6BDztnHat
MD5:	11D4B197FB0C793FD705EEE297786BB4
SHA1:	1788C65AF3C957751490E9C8575E5B051850536A
SHA-256:	939F68DAB38E148963F3953C8B25263AC8C03E6270AA10192F0E713ACBFB5E07
SHA-512:	093DF1BC1C0790D74CD4BEAAB7A352D313AED060675B032FAD66D83628267545FECA4E7C9003EF48D5E02B870D9CAB6894D9D8F5FE42BBF9A70BCC39E902E7D8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import parse_iso8601...class HowcastIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?howcast\.com/videos/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.howcast.com/videos/390161-How-to-Tie-a-Square-Knot-Properly',. 'md5': '7d45932269a288149483144f01b99789',. 'info_dict': {. 'id': '390161',. 'ext': 'mp4',. 'title': 'How to Tie a Square Knot Properly',. 'description': 'md5:dbe792e5f6f1489027027bf2eba188a3',. 'timestamp': 1276081287,. 'upload_date': '20100609',. 'duration': 56.823,. },. 'params': {. 'skip_download': True,. },. 'add_ie': ['Ooyala'],. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. embed_code = self._search_regex(. r'<iframe[^>]+src="[^"]+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\howstuffworks.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3465
Entropy (8bit):	4.738691250671751
Encrypted:	false
SSDEEP:	96:HQ+ksgKXFmt2c6Js59Ie6l7OFALBX/GlNxzcXgyLrLBTk71L38Ns6Ng:ngiUD6Js51Q7OFALBX/GlNxZyv9TkhJL
MD5:	51F05C8BE75E0A1EEEC09C1CF914D30D
SHA1:	C29D734EAFF84156BBA70CF12D1C041A9AB6D012
SHA-256:	D74F8DABECDF3BE43111DDBB530F37F9114BC6B34C08B90F8AE99538FE124C8B
SHA-512:	39C288EE3696736E52D255C9E84CC8D53556C90E3F449E31D15493AC5188973D85892D6F19CD27BAD42C5FB9217580FF6B51591A4429065A1768552702DF94A2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. find_xpath_attr,. int_or_none,. js_to_json,. unescapeHTML,. determine_ext,.)...class HowStuffWorksIE(InfoExtractor):. _VALID_URL = r'https?://[\da-z-]+\.(?:howstuffworks\|stuff(?:(?:youshould\|theydontwantyouto)know\|toblowyourmind\|momnevertoldyou)\|(?:brain\|car)stuffshow\|fwthinking\|geniusstuff)\.com/(?:[^/]+/)*(?:\d+-)?(?P<id>.+?)-video\.htm'. _TESTS = [. {. 'url': 'http://www.stufftoblowyourmind.com/videos/optical-illusions-video.htm',. 'md5': '76646a5acc0c92bf7cd66751ca5db94d',. 'info_dict': {. 'id': '855410',. 'ext': 'mp4',. 'title': 'Your Trickster Brain: Optical Illusions -- Science on the Web',. 'description': 'md5:e374ff9561f6833ad076a8cc0a5ab2fb',. },. },. {. 'url': 'http://shows.howstuffworks.com/more-shows/why-does-balloon-stick

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\hrti.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7202
Entropy (8bit):	4.756900344121029
Encrypted:	false
SSDEEP:	192:BJC0raUiVvv7JZDJW7ndPtYYAdMNvTnV6NeSJlXLHNKxU:/xiVvTPD87n7FAdCTnV6NeSJX0U
MD5:	AFCFD96714B49010F960CAE924D2921F
SHA1:	EC73B3975CFF387CAC1FB564584D1A5F2D7C41CF
SHA-256:	14B095D3AB3F27C604236A8913EB5369AA6DEE42D772631EE7158256A9CACD20
SHA-512:	987FFA4DE6D51874573DA29CFBDDB90CED42893963BB48E1C3D6234B466773F7603BCF2DD10D2D9492F963687FABB7D253BC9D36383FE500D92211928669ED35
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. clean_html,. ExtractorError,. int_or_none,. parse_age_limit,. sanitized_Request,. try_get,.)...class HRTiBaseIE(InfoExtractor):. """. Base Information Extractor for Croatian Radiotelevision. video on demand site https://hrti.hrt.hr. Reverse engineered from the JavaScript app in app.min.js. """. _NETRC_MACHINE = 'hrti'.. _APP_LANGUAGE = 'hr'. _APP_VERSION = '1.1'. _APP_PUBLICATION_ID = 'all_in_one'. _API_URL = 'http://clientapi.hrt.hr/client_api.php/config/identify/format/json'.. def _initialize_api(self):. init_data = {. 'application_publication_id': self._APP_PUBLICATION_ID. }.. uuid = self._download_json(. self._API_URL, None, note='Downloading uuid',. errnote='Unable to download uuid',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\huajiao.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1850
Entropy (8bit):	4.808888443573978
Encrypted:	false
SSDEEP:	48:+ug126CnAZBXoz8ajXjlkCBwV4GNKsCEQEIZN1RD18vH4s:e26CnAZBXoz8aqlVtIFdEON1MvH5
MD5:	25BF6C2695974CF2A527DE23AFEFB29A
SHA1:	CA0AF50E5883E3C90352B3F308D56652233935BC
SHA-256:	5E9B3EAFCA7371BD858368AB00AC46900BB34C9763B2E59910B4116890475D24
SHA-512:	7FAADA3B53C48205DB982572EFD13D6B92146AB421D6E53604181A3945E4F78AB3BB4BC03308EB7171E80174880D6986A98FE47D5A22288C8DA0248744A4CB18
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_duration,. parse_iso8601,.)...class HuajiaoIE(InfoExtractor):. IE_DESC = '....'. _VALID_URL = r'https?://(?:www\.)?huajiao\.com/l/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.huajiao.com/l/38941232',. 'md5': 'd08bf9ac98787d24d1e4c0283f2d372d',. 'info_dict': {. 'id': '38941232',. 'ext': 'mp4',. 'title': '#.....#',. 'description': 're:.',. 'duration': 2424.0,. 'thumbnail': r're:^https?://.\.jpg$',. 'timestamp': 1475866459,. 'upload_date': '20161007',. 'uploader': 'Penny_...',. 'uploader_id': '75206005',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. feed_json = self._search_regex(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\huffpost.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3389
Entropy (8bit):	4.56191882369334
Encrypted:	false
SSDEEP:	96:lOzPSdmpKCYegCK5xrcLNvMastAaXgmmXFpMwxtLOdzi3y8s1RhjBTI6Nj860Nx:0zPSVClMCLNAypTLOdzi3nsDhFTI6N4l
MD5:	6A356564DFC809A5B56B2A940ADF8BA3
SHA1:	8A6453A329F59F7732236D42E9614854526A1EBD
SHA-256:	3EA56805A4DC00367260C47BF63E23100AF85BF6C6D4B98F02AD3CA0FACBA414
SHA-512:	68BF8868B93ED1C23310E161B57F9A0202C37FDD6F2366506935704D27A7A6A2A45D51EEA193BB0550411F11348845279992FEBAC45E9F9D2C9F2E9CFDF71E2D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. parse_duration,. unified_strdate,.)...class HuffPostIE(InfoExtractor):. IE_DESC = 'Huffington Post'. _VALID_URL = r'''(?x). https?://(embed\.)?live\.huffingtonpost\.com/. (?:. r/segment/[^/]+/\|. HPLEmbedPlayer/\?segmentId=. ). (?P<id>[0-9a-f]+)'''.. _TEST = {. 'url': 'http://live.huffingtonpost.com/r/segment/legalese-it/52dd3e4b02a7602131000677',. 'md5': '55f5e8981c1c80a64706a44b74833de8',. 'info_dict': {. 'id': '52dd3e4b02a7602131000677',. 'ext': 'mp4',. 'title': 'Legalese It! with @MikeSacksHP',. 'description': 'This week on Legalese It, Mike talks to David Bosco about his new book on the ICC, "Rough Justice," he also discusses the Virginia AG\'s historic stance on gay marriage, the execution of Edgar Tamayo, the ICC\'s delay of K

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\hungama.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3803
Entropy (8bit):	4.632981079829008
Encrypted:	false
SSDEEP:	96:ffSDOv3nlqfaq096PCdl1NhBTh6Nu26SDOah0Jd6NhBT8/Mt766Ng:fKDOv3nlYaq0QCdl1NvTh6NznDOah0Jb
MD5:	AB5A610217574652CBD40985BEB54472
SHA1:	70A0E37D7024FC31353826427797CCD6616DF716
SHA-256:	453B2F2AD38DA2A6FC93F3226C2811A274D4F9CF51227E30F572ADD73B18F5A4
SHA-512:	EAA96B2DB4766ABA92B99D7C487DACBD5748E3823F079992C50F94498CF62502F45AEFB9C5FFA29AD28608A6A1787FB0EC7D416A3D24B05951FD0C4EF1BD014C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. urlencode_postdata,.)...class HungamaIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:www\.)?hungama\.com/. (?:. (?:video\|movie)/[^/]+/\|. tv-show/(?:[^/]+/){2}\d+/episode/[^/]+/. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://www.hungama.com/video/krishna-chants/39349649/',. 'md5': 'a845a6d1ebd08d80c1035126d49bd6a0',. 'info_dict': {. 'id': '2931166',. 'ext': 'mp4',. 'title': 'Lucky Ali - Kitni Haseen Zindagi',. 'track': 'Kitni Haseen Zindagi',. 'artist': 'Lucky Ali',. 'album': 'Aks',. 'release_year': 2000,. }. }, {. 'url': 'https://www.hungama.c

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\hypem.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	4.757003376707331
Encrypted:	false
SSDEEP:	48:PuJQdzV4cSCVagEZXRxNcQYnzuviECSHBe3XmEZ5/L:YQdzV4cSCVagEPcBKaEc32Ez/L
MD5:	A2EED26E1C7512DB3A5B7E532D1E3951
SHA1:	D9A5E70709514E66B3C9289D83E8B77C2E4D8AF2
SHA-256:	0D8D65AA6B0AFCE4F307FCF80376CE56E9C01E894D6BC7D8C0E18C325C1C4422
SHA-512:	89149553654E0D3228E31799DF075867AA9F3CEABBC50766B7A7BB06112EC3C6BC9FCF2685AAF086714274EF2F32B5C64005A08B2A7AD9C2AD127D706FAC2111
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import int_or_none...class HypemIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?hypem\.com/track/(?P<id>[0-9a-z]{5})'. _TEST = {. 'url': 'http://hypem.com/track/1v6ga/BODYWORK+-+TAME',. 'md5': 'b9cc91b5af8995e9f0c1cee04c575828',. 'info_dict': {. 'id': '1v6ga',. 'ext': 'mp3',. 'title': 'Tame',. 'uploader': 'BODYWORK',. 'timestamp': 1371810457,. 'upload_date': '20130621',. }. }.. def _real_extract(self, url):. track_id = self._match_id(url).. response = self._download_webpage(url, track_id).. track = self._parse_json(self._html_search_regex(. r'(?s)<script\s+type="application/json"\s+id="displayList-data">(.+?)</script>',. response, 'tracks'), track_id)['tracks'][0].. track_id = track['id']. title = track['song'].. final_url = s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\iconosquare.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	4.594931863602199
Encrypted:	false
SSDEEP:	48:Pu+UWa2h8/nDZEredlzjXhkDukazYUD7BTJPpdPaaDWZqgf9guUJ3Cb5wE9ZmHly:bUWa2h8/nDZEreHzarI7BTJxdPaaCri6
MD5:	50A501926D80861ECA8A4AE75C8D3180
SHA1:	A24A92311C752DDF779E5DDA891F24FFAAFD2769
SHA-256:	4CA09045F03B967DACD1C54E9BBC97DAB189BF6C853B10B7EB071DB0AE37C231
SHA-512:	8F9EB6DA0345EFC1DE1B15B4CFE8CED0CC3AEA16710DA8487515083C05D352720B1329C7DE7BA36D3E4CAE5D2AEF5EC71737A7A03BFA68CB81E13C18608FE9AF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. get_element_by_id,. remove_end,.)...class IconosquareIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:iconosquare\.com\|statigr\.am)/p/(?P<id>[^/]+)'. _TEST = {. 'url': 'http://statigr.am/p/522207370455279102_24101272',. 'md5': '6eb93b882a3ded7c378ee1d6884b1814',. 'info_dict': {. 'id': '522207370455279102_24101272',. 'ext': 'mp4',. 'title': 'Instagram photo by @aguynamedpatrick (Patrick Janelle)',. 'description': 'md5:644406a9ec27457ed7aa7a9ebcd4ce3d',. 'timestamp': 1376471991,. 'upload_date': '20130814',. 'uploader': 'aguynamedpatrick',. 'uploader_id': '24101272',. 'comment_count': int,. 'like_count': int,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._down

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ign.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9106
Entropy (8bit):	4.7571173147749315
Encrypted:	false
SSDEEP:	192:XpfdEpMO5oQeyNAdUNLtBOgOfiWO1MizuxsT/Hq6NQfcCV/cXksvp5l/G1F:XpypM8oQeyNAdUNLGPfiWO1MizuxsTCX
MD5:	E8386F79622058EF82ABE7301DA564FD
SHA1:	058451999708A9F2D798F870301C5BBD7EB30E45
SHA-256:	C265B6E033DC7EEF46D0A891BF8D870939DD5A993152441BC4784196E3B7FFCE
SHA-512:	5BF85CB8E2F7B66A245A6B2470D7C2C74420B9BD3C8039965A7FCB6D48C247D49477118F77C6791EB713F9B7443E88143440C4F6F273141E29FAB59D91D3447C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class IGNIE(InfoExtractor):. """. Extractor for some of the IGN sites, like www.ign.com, es.ign.com de.ign.com.. Some videos of it.ign.com are also supported. """.. _VALID_URL = r'https?://.+?\.ign\.com/(?:[^/]+/)?(?P<type>videos\|show_videos\|articles\|feature\|(?:[^/]+/\d+/video))(/.+)?/(?P<name_or_id>.+)'. IE_NAME = 'ign.com'.. _API_URL_TEMPLATE = 'http://apis.ign.com/video/v3/videos/%s'. _EMBED_RE = r'<iframe[^>]+?["\']((?:https?:)?//.+?\.ign\.com.+?/embed.+?)["\']'.. _TESTS = [. {. 'url': 'http://www.ign.com/videos/2013/06/05/the-last-of-us-review',. 'md5': 'febda82c4bafecd2d44b6e1a18a595f8',. 'info_dict': {. 'id': '8f862beef863986b2785559b9e1aa599',. 'ext': 'mp4',. 'title': 'The Last of Us Review',. 'description':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\imdb.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4554
Entropy (8bit):	4.838735892546165
Encrypted:	false
SSDEEP:	96:lOP2uHQaCvP6/aBez3fBKmNI7JTEwarRlSdpLOl3wGCoBT06NVjxpM3EYV+NMVRb:0+0JCvP6/aBeTBDI78C3LOl3wvoT06N2
MD5:	04808F307E248E4E92BEDB323E4FEABD
SHA1:	95F41D8CE8CD3CC5DE38255019BEE572EB475668
SHA-256:	C136541F4DA7D076F635EC384ADE99AD48C40A5132D919E37123980CF1DAED4B
SHA-512:	C8BE993D86D105B4366CD5D6E8A246C634BA9C01B7F1D66FBD2B94224AD9A4D88763CE458F3EA211FFACFD4E119507A3B0E9138CA67D00B095B8A6FF5BF65A2F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. mimetype2ext,. parse_duration,. qualities,. url_or_none,.)...class ImdbIE(InfoExtractor):. IE_NAME = 'imdb'. IE_DESC = 'Internet Movie Database trailers'. _VALID_URL = r'https?://(?:www\|m)\.imdb\.com/(?:video\|title\|list).+?[/-]vi(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.imdb.com/video/imdb/vi2524815897',. 'info_dict': {. 'id': '2524815897',. 'ext': 'mp4',. 'title': 'No. 2 from Ice Age: Continental Drift (2012)',. 'description': 'md5:87bd0bdc61e351f21f20d2d7441cb4e7',. }. }, {. 'url': 'http://www.imdb.com/video/_/vi2524815897',. 'only_matching': True,. }, {. 'url': 'http://www.imdb.com/title/tt1667889/?ref_=ext_shr_eml_vi#lb-vi2524815897',. 'only_matching': True,. }, {. 'url': 'http://www.imdb.com/title/tt1667889/#lb-vi252481

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\imgur.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5082
Entropy (8bit):	4.695351060733663
Encrypted:	false
SSDEEP:	96:qLoAGdHpN9Bfgqrg5CfCNhVALOuoHvV+b1RgVDyIBTg6NWn8o9mkY/FfbW/KvTHm:q09dHj9Jgqrg5CCNhVAyNHYb1RiTg6Nm
MD5:	1136C761214FF0870114F40C47F9D33C
SHA1:	C2DD205C74C5A50D67EC10CCF53FFA8FD958BF9C
SHA-256:	7AC6BC1AAC764399F5ECFBF5F56D69C25E54439CD5236C94736AF35446CE7197
SHA-512:	9FF9F4CD47B59A8AF599729A8CAFEAAED683ED89BC748B78637AB25547718EB16010C1B409018F0753C93C6ECF8ADD8A300F038A244B9F4437E0CF58D9CC7606
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. js_to_json,. mimetype2ext,. ExtractorError,.)...class ImgurIE(InfoExtractor):. _VALID_URL = r'https?://(?:i\.)?imgur\.com/(?!(?:a\|gallery\|(?:t(?:opic)?\|r)/[^/]+)/)(?P<id>[a-zA-Z0-9]+)'.. _TESTS = [{. 'url': 'https://i.imgur.com/A61SaA1.gifv',. 'info_dict': {. 'id': 'A61SaA1',. 'ext': 'mp4',. 'title': 're:Imgur GIF$\|MRW gifv is up and running without any bugs$',. },. }, {. 'url': 'https://imgur.com/A61SaA1',. 'only_matching': True,. }, {. 'url': 'https://i.imgur.com/crGpqCV.mp4',. 'only_matching': True,. }, {. # no title. 'url': 'https://i.imgur.com/jxBXAMC.gifv',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. 'https://i.imgur.c

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ina.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2852
Entropy (8bit):	4.611882404231231
Encrypted:	false
SSDEEP:	48:+uhWOL2JefNB6QuvfvQ9aXQ1XQjtfjXjbKiGlMthj2g3jOwXVqpwIaJkNEj/Cek6:YOyKWQuXva6oefGjlw2g3jlkOI2kNEDr
MD5:	9526F5446C9E91222ECE9767F30AD666
SHA1:	509EC0E8525F040849620C08DD99C7C1BE81E2BC
SHA-256:	1A6431D3FDD72E6DD9BB71B2CD62FC18B5C4A566AF09B98232943E7751C7BA1D
SHA-512:	DDB6642CD9985CFF1998EA462D39F97824E20F0B6F3132459EB5C98EB34BF06B8DBED31C2BDB06D7AD2F9161369692EFED1BA7159CBCE5A09982C65AA9D60365
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. strip_or_none,. xpath_attr,. xpath_text,.)...class InaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ina\.fr/(?:video\|audio)/(?P<id>[A-Z0-9_]+)'. _TESTS = [{. 'url': 'http://www.ina.fr/video/I12055569/francois-hollande-je-crois-que-c-est-clair-video.html',. 'md5': 'a667021bf2b41f8dc6049479d9bb38a3',. 'info_dict': {. 'id': 'I12055569',. 'ext': 'mp4',. 'title': 'Fran.ois Hollande "Je crois que c\'est clair"',. 'description': 'md5:3f09eb072a06cb286b8f7e4f77109663',. }. }, {. 'url': 'https://www.ina.fr/video/S806544_001/don-d-organes-des-avancees-mais-d-importants-besoins-video.html',. 'only_matching': True,. }, {. 'url': 'https://www.ina.fr/audio/P16173408',. 'only_matching': True,. }, {. 'url': 'https://

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\inc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2299
Entropy (8bit):	4.926360398313947
Encrypted:	false
SSDEEP:	48:Puf0LfPhKWRJowNigUtxC3UON2HYsntfJoXjlh3BlCBgatRj4eu:HzpzfowIgUtxvOoHHfJszatV4eu
MD5:	224B77A244D69713F795A1585E3DF16E
SHA1:	B15B6DA52E2EC2370E1ED8A95109EF765EDC0513
SHA-256:	6FBED364BF4145D77B22626975EB7953579244DE1C512DC0456F5F71B2590203
SHA-512:	3EE43189CC448897FCB9824A510FE5B2867478DE191C477370CF3812008FF38F40413810884FD3AD1D9CA3D6C303364E68208490C56A0C03B8545F88A285481B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .kaltura import KalturaIE...class IncIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?inc\.com/(?:[^/]+/)+(?P<id>[^.]+).html'. _TESTS = [{. 'url': 'http://www.inc.com/tip-sheet/bill-gates-says-these-5-books-will-make-you-smarter.html',. 'md5': '7416739c9c16438c09fa35619d6ba5cb',. 'info_dict': {. 'id': '1_wqig47aq',. 'ext': 'mov',. 'title': 'Bill Gates Says These 5 Books Will Make You Smarter',. 'description': 'md5:bea7ff6cce100886fc1995acb743237e',. 'timestamp': 1474414430,. 'upload_date': '20160920',. 'uploader_id': 'video@inc.com',. },. 'params': {. 'skip_download': True,. },. }, {. # div with id=kaltura_player_1_kqs38cgm. 'url': 'https://www.inc.com/oscar-raymundo/richard-branson-young-entrepeneurs.html',. 'info_dict': {. 'id': '1_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\indavideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4414
Entropy (8bit):	4.676814754004661
Encrypted:	false
SSDEEP:	96:z0W/gUJFqXd0PFff0hO8hxPcyYYiU56QnnpS70LVLcqD3EiMsGxBTSqYOyVRiWy+:zpoUbzff0Jx25U9pBLVLcy3EiD8TgEOL
MD5:	8FA4B9D49C77065CA7C6C13F0FF31110
SHA1:	C86752090BC71CB96B8150AE13448CDEE6520991
SHA-256:	F10F0BD86CDB497DF587A2FE68DC91A4AEB591B601CCF75CC51F3CBB940A789D
SHA-512:	81B11D83D120985B78A5217A85E90548ABE89EB1C1FB69636D9C299713F645E305CA26E207CC28C01FA92FCF0BE3CE886BE30036F215793AE1F15B9BD214A6F2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_age_limit,. parse_iso8601,. update_url_query,.)...class IndavideoEmbedIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:embed\.)?indavideo\.hu/player/video/\|assets\.indavideo\.hu/swf/player\.swf\?.\b(?:v(?:ID\|id))=)(?P<id>[\da-f]+)'. _TESTS = [{. 'url': 'http://indavideo.hu/player/video/1bdc3c6d80/',. 'md5': 'c8a507a1c7410685f83a06eaeeaafeab',. 'info_dict': {. 'id': '1837039',. 'ext': 'mp4',. 'title': 'Cicat.nc',. 'description': '',. 'thumbnail': r're:^https?://.\.jpg$',. 'uploader': 'cukiajanlo',. 'uploader_id': '83729',. 'timestamp': 1439193826,. 'upload_date': '20150810',. 'duration': 72,. 'age_limit': 0,. 'tags': ['t.nc', 'cica', 'cuki'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\infoq.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4987
Entropy (8bit):	4.834925795529843
Encrypted:	false
SSDEEP:	96:TOGPsNeWJ5vDqDEdYTOt9xtu8Xa/P6gPyTaiB8CPN668K1a/4bpQ3bfqJTEcctRa:iG6l0DEyTypQ4t2qidtRRNRTk6Ng
MD5:	69FA3D752783AD7326CCA46C23972281
SHA1:	9F03C26F4066EE4229373C73440887949631EE52
SHA-256:	C1E499D37566A5605DE921A4F1114DDD6969F757FC83A66ECBE1CB9B5F5421AA
SHA-512:	09F2BD177C6876A82A98EFCEDD5F062AC2021E544CA01B6C9008B048D5927CBFB94AF1C525634368EFAF8DEF8516FD1CB83EBD285E5E37B2B93B61D6E97CE0C1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..from ..compat import (. compat_b64decode,. compat_urllib_parse_unquote,. compat_urlparse,.).from ..utils import (. determine_ext,. update_url_query,.).from .bokecc import BokeCCBaseIE...class InfoQIE(BokeCCBaseIE):. _VALID_URL = r'https?://(?:www\.)?infoq\.com/(?:[^/]+/)+(?P<id>[^/]+)'.. _TESTS = [{. 'url': 'http://www.infoq.com/presentations/A-Few-of-My-Favorite-Python-Things',. 'md5': 'b5ca0e0a8c1fed93b0e65e48e462f9a2',. 'info_dict': {. 'id': 'A-Few-of-My-Favorite-Python-Things',. 'ext': 'mp4',. 'description': 'Mike Pirnat presents some tips and tricks, standard libraries and third party packages that make programming in Python a richer experience.',. 'title': 'A Few of My Favorite [Python] Things',. },. }, {. 'url': 'http://www.infoq.com/fr/presentations/changez-avis-sur-javascript',. 'only_matching': True,. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\instagram.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15667
Entropy (8bit):	4.344719381179493
Encrypted:	false
SSDEEP:	192:27rGnQpOxv1ME8hOqeU3cci6N5/dXqBpyjrMnVDfnUl7YBfx8:27rGnQpOxv1p8h/e6c36N5cwrUxnUyJ8
MD5:	70B99D0040AF4C45D32A8CA1F2E752A3
SHA1:	F8E4A300C88149757333EEDF16E4A9AEFA5DE43B
SHA-256:	350891E80BF4316A9FC4A8364E35D124E1CF64F7090ACE5208E3AD2963B995E6
SHA-512:	9506BBDC9C428B023CA6A12D40EA989F41CCC16DADBF89BA1F6D77A185DBD598DF58A7BA88B535C29A52EA1D23D9426A939009288013242C67B3B5180ABA86A0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import itertools.import hashlib.import json.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_HTTPError,.).from ..utils import (. ExtractorError,. get_element_by_attribute,. int_or_none,. lowercase_escape,. std_headers,. try_get,. url_or_none,.)...class InstagramIE(InfoExtractor):. _VALID_URL = r'(?P<url>https?://(?:www\.)?instagram\.com/p/(?P<id>[^/?#&]+))'. _TESTS = [{. 'url': 'https://instagram.com/p/aye83DjauH/?foo=bar#abc',. 'md5': '0d2da106a9d2631273e192b372806516',. 'info_dict': {. 'id': 'aye83DjauH',. 'ext': 'mp4',. 'title': 'Video by naomipq',. 'description': 'md5:1f17f0ab29bd6fe2bfad705f58de3cb8',. 'thumbnail': r're:^https?://.*\.jpg',. 'timestamp': 1371748545,. 'upload_date': '20130620',. 'uploader_id': 'naomipq',. 'uploader': 'Naomi Leonor Phan-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\internazionale.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	4.794717959641716
Encrypted:	false
SSDEEP:	96:VnZrSU5dNdwwidXd+bpMY08bXd0fJaG4BPVcQidBkbowBTrpE6Ng:9YoNdjXlMY0xJa8QidBkboATG6Ng
MD5:	2432113AA5B869481E45317CF80B60D0
SHA1:	6671FE747F1C84C3FE420C9E65439E8FE2DA5939
SHA-256:	36F99011141BA6C0D086F61789C04644E1A969E6D7D3EFACA115831DEBEE425B
SHA-512:	97F67EAEDCE52BFE3A0A4B1CB4F236BC1FE40430ABDD20A6287C6E4DC8DE53DE0C883470DD9D7910B5B4E2C4CFDCB7D536073B3A3224733A05D358030A1DC0AC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import unified_timestamp...class InternazionaleIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?internazionale\.it/video/(?:[^/]+/)(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.internazionale.it/video/2015/02/19/richard-linklater-racconta-una-scena-di-boyhood',. 'md5': '3e39d32b66882c1218e305acbf8348ca',. 'info_dict': {. 'id': '265968',. 'display_id': 'richard-linklater-racconta-una-scena-di-boyhood',. 'ext': 'mp4',. 'title': 'Richard Linklater racconta una scena di Boyhood',. 'description': 'md5:efb7e5bbfb1a54ae2ed5a4a015f0e665',. 'timestamp': 1424354635,. 'upload_date': '20150219',. 'thumbnail': r're:^https?://.\.jpg$',. },. 'params': {. 'format': 'bestvideo',. },. }, {. 'url': 'https://www.internazionale.it/video/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\internetvideoarchive.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	4.391741304980828
Encrypted:	false
SSDEEP:	96:xOM3YGBoRR5YNrGXaJoHqkyjA8TdGCBzPiiC3xxoC3O0XlBT21McK+6N1tk:4M3YGBe5YECoHnyj/TdGCBzPiiCfoCNi
MD5:	6E4F74B76B584DD65EBB211C6D0E5203
SHA1:	19BBE8C1A542D4383AA1C9F9ECBAAEAC8B6C66DF
SHA-256:	64545916CF8DC4B73CCD5974A2FA797786ABF6C06869868A3EE555DDFEAA5283
SHA-512:	776CBCB67F8E4243B920151538AC38114CD6AF6F38E1BDB4729EA41A65994D40ED66C0CE1A9ACF1C963E6DD930C6B28BD4BC903C55AE5642310C1118D80E1891
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import (. determine_ext,. int_or_none,. xpath_text,.)...class InternetVideoArchiveIE(InfoExtractor):. _VALID_URL = r'https?://video\.internetvideoarchive\.net/(?:player\|flash/players)/.?\?.?publishedid.*?'.. _TEST = {. 'url': 'http://video.internetvideoarchive.net/player/6/configuration.ashx?customerid=69249&publishedid=194487&reporttag=vdbetatitle&playerid=641&autolist=0&domain=www.videodetective.com&maxrate=high&minrate=low&socialplayer=false',. 'info_dict': {. 'id': '194487',. 'ext': 'mp4',. 'title': 'KICK-ASS 2',. 'description': 'md5:c189d5b7280400630a1d3dd17eaa8d8a',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. @staticmethod. def _build_json_url(query):. return 'http://video.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\iprima.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4681
Entropy (8bit):	4.684194376036062
Encrypted:	false
SSDEEP:	96:anO5NbKdbxvJ6mVeY8GG2PETT9fb1zvdYggtm/J8Adr3DC1rExjwAvMeZ51oGBTD:j7WdFEgeY8GGEETTdb17ibtc8Adr3DCw
MD5:	C00881874D96CEC6ED42E3F650333A6E
SHA1:	5CEDDA775B42CF10AA50DEAF7A94B613EE2E0BAB
SHA-256:	3D80DB8571890F8EC77D359299126302C50704B0619279722A063A7754DD6993
SHA-512:	B44298DD9066FA6FD2DA9B1BA1655D0CD1F90F02AD777DF4CAAF6AB9B1FC4A6A600A9A85B70AA8954C5E177C3F76DC0B6D6E152F6285E77876A657C00E099C60
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time..from .common import InfoExtractor.from ..utils import (. determine_ext,. js_to_json,.)...class IPrimaIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+)\.iprima\.cz/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _GEO_BYPASS = False.. _TESTS = [{. 'url': 'http://play.iprima.cz/gondici-s-r-o-33',. 'info_dict': {. 'id': 'p136534',. 'ext': 'mp4',. 'title': 'Gond.ci s. r. o. (34)',. 'description': 'md5:16577c629d006aa91f59ca8d8e7f99bd',. },. 'params': {. 'skip_download': True, # m3u8 download. },. }, {. 'url': 'http://play.iprima.cz/particka/particka-92',. 'only_matching': True,. }, {. # geo restricted. 'url': 'http://play.iprima.cz/closer-nove-pripady/closer-nove-pripady-iv-1',. 'only_matching': True,. }, {. # iframe api.play-backend.iprima.cz. 'url': 'https://pri

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\iqiyi.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	13633
Entropy (8bit):	4.839947315373942
Encrypted:	false
SSDEEP:	384:0SMnAKVeG/tLz+luKmnoK/NzH4pbBKYyj4Q5LvicTp6Ng:0SMnBGelzY5QYyjbicTp8g
MD5:	D5B9DC145E19BB2BFE26C9A42DB3BDEA
SHA1:	E5665DB75CFEB1CDAFAAF6D82862E2C69202C3C2
SHA-256:	6815017D45A6FCC873B9998EC72AAB2F6148D6E47526CDCDE696CCD6EBE04DC2
SHA-512:	86953FDE9ADF86EF1DE4544A8A461E11C3F0E8A88D8A78E0DA1BC94AD721F1AFE8F170E237122DB135A8F53F79F955CBD0EC831EB4632F5BE941B7C48F8DC44B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import itertools.import re.import time..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urllib_parse_urlencode,.).from ..utils import (. clean_html,. decode_packed_codes,. get_element_by_id,. get_element_by_attribute,. ExtractorError,. ohdave_rsa_encrypt,. remove_start,.)...def md5_text(text):. return hashlib.md5(text.encode('utf-8')).hexdigest()...class IqiyiSDK(object):. def __init__(self, target, ip, timestamp):. self.target = target. self.ip = ip. self.timestamp = timestamp.. @staticmethod. def split_sum(data):. return compat_str(sum(map(lambda p: int(p, 16), list(data)))).. @staticmethod. def digit_sum(num):. if isinstance(num, int):. num = compat_str(num). return compat_str(sum(map(int, num))).. def even_odd(self):. even = self.digit_sum(compat_str(self.timestamp)[::2]).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ir90tv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	5.244844071771739
Encrypted:	false
SSDEEP:	48:+uuHcfQHlXYNbOOAZJXgvhXYNbOOCtfjXjlk6b8B4uvFeBgNJbjtc:yOSeOOAZJXgvVeOOAfqAcvFTJbjtc
MD5:	B85D411B67711345BEC5A382CA88321E
SHA1:	9BC44BC372F225F6A3F12E14ED1A83961E58B215
SHA-256:	8420D0CD478815B615CA6F9E5AE9162B88DADE467CC695681CDEC2098831DCDC
SHA-512:	7C84E9E667F0780F96FF1A864569FA2EA1FB9F06FF2D9334765C3047A00F44832BD40F94A823B0AC1A0423743B514D88D96EFBFAC9B288484012700EBC927661
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import remove_start...class Ir90TvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?90tv\.ir/video/(?P<id>[0-9]+)/.'. _TESTS = [{. 'url': 'http://90tv.ir/video/95719/%D8%B4%D8%A7%DB%8C%D8%B9%D8%A7%D8%AA-%D9%86%D9%82%D9%84-%D9%88-%D8%A7%D9%86%D8%AA%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%85%D9%87%D9%85-%D9%81%D9%88%D8%AA%D8%A8%D8%A7%D9%84-%D8%A7%D8%B1%D9%88%D9%BE%D8%A7-940218',. 'md5': '411dbd94891381960cb9e13daa47a869',. 'info_dict': {. 'id': '95719',. 'ext': 'mp4',. 'title': '...... ... . ........ ... ...... ..... 94/02/18',. 'thumbnail': r're:^https?://.\.jpg$',. }. }, {. 'url': 'http://www.90tv.ir/video/95719/%D8%B4%D8%A7%DB%8C%D8%B9%D8%A7%D8%AA-%D9%86%D9%82%D9%84-%D9%88-%D8%A7%D9%86%D8%AA%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%85%D9%87%D9%85-%D9%81%D9%88%D8%AA%D8%A8%

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-004CF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	4.623478462168655
Encrypted:	false
SSDEEP:	96:N1IYhNMTHFpPMYv0fJsgvflEysOC+E7iSVy8RLAWBT70GNNW6NQ:EY+UYviJs4EysOC+E7iWyUAyT7S6NQ
MD5:	4338EDC9267874A7684A4563C1E4E767
SHA1:	595B4F074CEC8DC7F1E3F36B34E107B58BAD1577
SHA-256:	28F7210065DD8D090E24A304552F9DD672E4C05CD4645C2CD17666649102D585
SHA-512:	35ECF6B91979E58BE393C81D8CC53027FF784140771F04B751ABDFE8A2A6BEB4315579AF3947C067D1B6B6F68967E89BD4B75681287FAD6450E6A7C2301CAF61
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class AudiMediaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?audi-mediacenter\.com/(?:en\|de)/audimediatv/(?:video/)?(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'https://www.audi-mediacenter.com/en/audimediatv/60-seconds-of-audi-sport-104-2015-wec-bahrain-rookie-test-1467',. 'md5': '79a8b71c46d49042609795ab59779b66',. 'info_dict': {. 'id': '1565',. 'ext': 'mp4',. 'title': '60 Seconds of Audi Sport 104/2015 - WEC Bahrain, Rookie Test',. 'description': 'md5:60e5d30a78ced725f7b8d34370762941',. 'upload_date': '20151124',. 'timestamp': 1448354940,. 'duration': 74022,. 'view_count': int,. }. }, {. 'url': 'https://www.audi-mediacenter.com/en/audimediatv/video/60-seconds-of-audi-sport-104-2015-wec-bahrain-rookie-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-01H13.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	14346
Entropy (8bit):	4.820457275247811
Encrypted:	false
SSDEEP:	384:F1uJgzwHkK8WAJqXwR9+RwEbqiiyOG9VoImTaf77ex6N+qKGDsjG4N4Ykm01GzXr:PuIYAiy9abqiiyOGroImTaT7ex8+PnlF
MD5:	A38BB9901FB1253C5BF9D439A526CA1D
SHA1:	033A7EA16075AC2F6122B228CB9FB07B011B17EC
SHA-256:	445BA9C66E7D8042B1C4979493EF3720BB08FB6285056150EE826D4188F2A18F
SHA-512:	B78F5E2FFC91896AD4A6EC474B8003B763C4D7ABD3B2A672EBE4F46882A2129DA1879EDD5235C109B5A3AD0DCE6EF2A1AC3D377F2D88077C3BA0D25CA6186298
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. parse_iso8601,. qualities,.)...class NDRBaseIE(InfoExtractor):. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). display_id = next(group for group in mobj.groups() if group). webpage = self._download_webpage(url, display_id). return self._extract_embed(webpage, display_id)...class NDRIE(NDRBaseIE):. IE_NAME = 'ndr'. IE_DESC = 'NDR.de - Norddeutscher Rundfunk'. _VALID_URL = r'https?://(?:www\.)?ndr\.de/(?:[^/]+/)*(?P<id>[^/?#]+),[\da-z]+\.html'. _TESTS = [{. # httpVideo, same content id. 'url': 'http://www.ndr.de/fernsehen/Party-Poette-und-Parade,hafengeburtstag988.html',. 'md5': '6515bc255dc5c5f8c85bbc38e035a659',. 'info_dict': {. 'id': 'hafengeburtstag988',. 'display_id': 'Party-Poette-und-Parade',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-02DMS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	4.813665904509695
Encrypted:	false
SSDEEP:	48:PuU4ACeD/Y6bPzgq+adfFGlkZb/XAd5dC5PLX8W+c9UM:3zCeD/Y6bPzz+apVigPbX9UM
MD5:	772BA956218064AB0F90E16518D71900
SHA1:	0CDD7F65BAF5FCE9C854C93DE588C2BEA92AB1B9
SHA-256:	A66409543F54DBB3A39B5212DD5798101604FDFA094B5EEB52BA6D81DA3AE9A1
SHA-512:	BB0C14840AEE33AE564B9ECDF65235909998632273FEB29C13CA51AD5FE5297D4BF73EB8B3D6CFFDE176331F94CE6D91CDAE2B52DB38714CB2D95552E31194CB
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. str_to_int,.)...class PornoXOIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pornoxo\.com/videos/(?P<id>\d+)/(?P<display_id>[^/]+)\.html'. _TEST = {. 'url': 'http://www.pornoxo.com/videos/7564/striptease-from-sexy-secretary.html',. 'md5': '582f28ecbaa9e6e24cb90f50f524ce87',. 'info_dict': {. 'id': '7564',. 'ext': 'flv',. 'title': 'Striptease From Sexy Secretary!',. 'display_id': 'striptease-from-sexy-secretary',. 'description': 'md5:0ee35252b685b3883f4a1d38332f9980',. 'categories': list, # NSFW. 'thumbnail': r're:https?://.*\.jpg$',. 'age_limit': 18,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id, display_id = mobj.groups().. webpage = self._download_webpage(url, video_id). vid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-02OLJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13075
Entropy (8bit):	4.400549566429501
Encrypted:	false
SSDEEP:	384:tkDItJzo27aKLEK88DXCLpi1/O3fNTh6NZeBGY0w:t+27DEK8kspiNO3fNTh8ZekY0w
MD5:	088A05BD30F2A362AB7392AB8C33E366
SHA1:	A0412432AB80D9EFEC093AD9F1DBD8515F1A1B28
SHA-256:	2DDE3733365B4C73321513CEB848C62F6F7D5AD6D4436A5D19276FDDEB4D14E3
SHA-512:	887F8A7CA3506B8C7BA68781C2B9DE93667C70A3F7F1B3C6B747793E9AD4726A456D419265A2F47D74D92B0E2BC95B89A95FD5933ABF448864CC4A9B08FCAF51
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import uuid.import xml.etree.ElementTree as etree.import json.import re..from .common import InfoExtractor.from .brightcove import BrightcoveNewIE.from ..compat import (. compat_str,. compat_etree_register_namespace,.).from ..utils import (. determine_ext,. ExtractorError,. extract_attributes,. int_or_none,. merge_dicts,. parse_duration,. smuggle_url,. url_or_none,. xpath_with_ns,. xpath_element,. xpath_text,.)...class ITVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?itv\.com/hub/[^/]+/(?P<id>[0-9a-zA-Z]+)'. _GEO_COUNTRIES = ['GB']. _TESTS = [{. 'url': 'http://www.itv.com/hub/mr-bean-animated-series/2a2936a0053',. 'info_dict': {. 'id': '2a2936a0053',. 'ext': 'flv',. 'title': 'Home Movie',. },. 'params': {. # rtmp download. 'skip_download': True,. },. }, {. # unavailable via da

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-03TNK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2283
Entropy (8bit):	4.74208916269998
Encrypted:	false
SSDEEP:	48:PusS98RJ+kajXjlkABIgJBVYYLtVosBIoncYVO3Jq+qWfV83vf:/S98ukaqHg9Y4PoBoncYUJ1bO33
MD5:	2122A725F6CFB3257C6C1E05355F1854
SHA1:	482795BB7606F5FE55D537B82D0370C190714649
SHA-256:	C608E40CE5005AF737BD60CB47CB88B6DF974ED2E6240EAC36F517DAC1663101
SHA-512:	4DBA2BBD11863D05C06B031618D3A1EF6F1C848A0182A1FDB6A6523F6A0874EB39169565031ED2A40729CC690CBBBFC5C9918DBE6941D08C39933E2C2480F9FF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_b64decode.from ..utils import (. ExtractorError,. HEADRequest,. sanitized_Request,. urlencode_postdata,.)...class HotNewHipHopIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?hotnewhiphop\.com/.\.(?P<id>.)\.html'. _TEST = {. 'url': 'http://www.hotnewhiphop.com/freddie-gibbs-lay-it-down-song.1435540.html',. 'md5': '2c2cd2f76ef11a9b3b581e8b232f3d96',. 'info_dict': {. 'id': '1435540',. 'ext': 'mp3',. 'title': 'Freddie Gibbs - Lay It Down'. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. video_url_base64 = self._search_regex(. r'data-path="(.*?)"', webpage, 'video URL', default=None).. if video_url_base64 is None:. video_url = self._search_regex(. r'"contentUrl" c

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-03VC8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3655
Entropy (8bit):	4.655535835487998
Encrypted:	false
SSDEEP:	96:uvvB2lCB2v+ALNmHSjex6bLCvbWebLX15NXQAKFyo4p+C7ZyfOkpxvF:QZDKLcMexLCWyYofC7ZgXxt
MD5:	F364AF9C9F564E02CA8EB71A804A6A09
SHA1:	A32F915113498934D904B18CB0378E9D2A6CFD4C
SHA-256:	E9632B18F17D9CB69894CD091B7B12AF501328C88D89F0DE866A1FD87934120D
SHA-512:	E0C70D6574380A506FE516D493318BE5D7932C93C741E1BF9B472402815869F1E0B365866897F7D8803B4AE09EBFFA45FB0A56090F18338C2183518B49FA7658
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from .facebook import FacebookIE...class BuzzFeedIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?buzzfeed\.com/[^?#]*?/(?P<id>[^?#]+)'. _TESTS = [{. 'url': 'http://www.buzzfeed.com/abagg/this-angry-ram-destroys-a-punching-bag-like-a-boss?utm_term=4ldqpia',. 'info_dict': {. 'id': 'this-angry-ram-destroys-a-punching-bag-like-a-boss',. 'title': 'This Angry Ram Destroys A Punching Bag Like A Boss',. 'description': 'Rambro!',. },. 'playlist': [{. 'info_dict': {. 'id': 'aVCR29aE_OQ',. 'ext': 'mp4',. 'title': 'Angry Ram destroys a punching bag..',. 'description': 'md5:c59533190ef23fd4458a5e8c8c872345',. 'upload_date': '20141024',. 'uploader_id': 'Buddhanz1',. 'uploader': 'Angry Ram',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-04A64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3293
Entropy (8bit):	4.693690753275121
Encrypted:	false
SSDEEP:	96:g1BI5yCf/EePjfymoqfag73mdDdHZNYY2KW/gMFsD:SB0ZUeLHaIZKHpD
MD5:	E22F5FA527BA2AE2450723596855FEED
SHA1:	CC05537A4805053F531513D3066CF4A112774C42
SHA-256:	A1A01E83E67323DBC35E6017196867AD33D53785221EE86747108F72D47F94DC
SHA-512:	18259B7E71E617B8AB5E01D35A924C0231E3D34DE7A9C1F455C09BF0BAB54EA0DF0A038CFC9D1C81E55BDBDE3E954F6B089C791D85D9CEB3AAB2399AF606B297
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_timestamp,.)...class Zaq1IE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?zaq1\.pl/video/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://zaq1.pl/video/xev0e',. 'md5': '24a5eb3f052e604ae597c4d0d19b351e',. 'info_dict': {. 'id': 'xev0e',. 'title': 'DJ NA WESELE. TANIEC Z FIGURAMI.w.gr.w/soko..w podlaski/siedlce/mi.sk mazowiecki/warszawa',. 'description': 'www.facebook.com/weseledjKontakt: 728 448 199 / 505 419 147',. 'ext': 'mp4',. 'duration': 511,. 'timestamp': 1490896361,. 'uploader': 'Anonim',. 'upload_date': '20170330',. 'view_count': int,. }. }, {. # malformed JSON-LD. 'url': 'http://zaq1.pl/video/x81vn',. 'info_dict': {. 'id': 'x81vn',. 'title': 'SEKRETNE .Y

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-051MA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4474
Entropy (8bit):	4.833024368222409
Encrypted:	false
SSDEEP:	96:avXs9vqfuLd29v4X65kTqfD4S9yBdc2hubMIOrKixQVa3BTexwWBle3aDi6Ng:eXcvB521ZwYD4Sg3hKMIOrKi+V4T2jBC
MD5:	1C90F84FCAC485B715A412C62503A2DC
SHA1:	F65C9AEC40CC04FF19589A0B638F50506F2508F7
SHA-256:	D98A4E750CFDC24A84D1FD211F48890BF41E0132CA8A5969541FEE6FCBA9A7B1
SHA-512:	AD49AFD27C49B95F83F02CB83649BEFB5111836AA35D879CF8D83296D952402E3C43FFC17ED0F8712A2025DD8AAC8D4EBD1DC7F02789417072252C8EB2FE095F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. # ExtractorError,. # HEADRequest,. int_or_none,. qualities,. unified_strdate,.)...class CanalplusIE(InfoExtractor):. IE_DESC = 'mycanal.fr and piwiplus.fr'. _VALID_URL = r'https?://(?:www\.)?(?P<site>mycanal\|piwiplus)\.fr/(?:[^/]+/)(?P<display_id>[^?/]+)(?:\.html\?.\bvid=\|/p/)(?P<id>\d+)'. _VIDEO_INFO_TEMPLATE = 'http://service.canal-plus.com/video/rest/getVideosLiees/%s/%s?format=json'. _SITE_ID_MAP = {. 'mycanal': 'cplus',. 'piwiplus': 'teletoon',. }.. # Only works for direct mp4 URLs. _GEO_COUNTRIES = ['FR'].. _TESTS = [{. 'url': 'https://www.mycanal.fr/d17-emissions/lolywood/p/1397061',. 'info_dict': {. 'id': '1397061',. 'display_id': 'lolywood',. 'ext': 'mp4',. 'title': 'Euro 2016 : Je pr.f.re te pr.venir - Lolywood - Episode 34',. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-06OJC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1627
Entropy (8bit):	4.686370645619891
Encrypted:	false
SSDEEP:	24:1R8lFvFoG9jfw/p1cZCU/LFluL86fXXtBBpxW12/rXlDpi32l4ifPiTvNcNyL5lM:PuwwfEZ0246fXXtBBpxWs/rVkJ7M
MD5:	6543CA2EDD48D95D57673631DDC4649D
SHA1:	5AEC993F85AD0D07878E603D124E74E54A01267E
SHA-256:	F4D497C6A285196CD3711924EEF8344832FEEB3EDEDEC06932A818A12519AF8F
SHA-512:	5272F1DA3E64FFFB8631CD00AFAC6E07B607B6E61D03751567A192780B8D15826D7A55F9E725814541D341F0AB53C1CA63B7C5EA3DAC95BF7EA82DC8C09F8B96
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. qualities,. str_or_none,.)...class ReverbNationIE(InfoExtractor):. _VALID_URL = r'^https?://(?:www\.)?reverbnation\.com/.?/song/(?P<id>\d+).?$'. _TESTS = [{. 'url': 'http://www.reverbnation.com/alkilados/song/16965047-mona-lisa',. 'md5': 'c0aaf339bcee189495fdf5a8c8ba8645',. 'info_dict': {. 'id': '16965047',. 'ext': 'mp3',. 'title': 'MONA LISA',. 'uploader': 'ALKILADOS',. 'uploader_id': '216429',. 'thumbnail': r're:^https?://.*\.jpg',. },. }].. def _real_extract(self, url):. song_id = self._match_id(url).. api_res = self._download_json(. 'https://api.reverbnation.com/song/%s' % song_id,. song_id,. note='Downloading information of song %s' % song_id. ).. THUMBNAILS = ('thumbnail', 'image'). quality = qualities(TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-082HU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9894
Entropy (8bit):	4.522412569086747
Encrypted:	false
SSDEEP:	192:pJkS+55Y+Bb+d+0+/K+f+F+yO+3Sub59TIsOoruOr3vuhmbTDd6Nrnt++z+wDu/L:pJkS+5i+Bb+dT+/K+f+F+yO+3bb590sx
MD5:	5D8463752717BD33104A619EE86F1DE3
SHA1:	7750D4486B506B15E6EDB7617A517FCA74281C33
SHA-256:	63444529F5C74247CB8D4BEBF4C3CAA4836F6B340843D5E97B3851093B77D945
SHA-512:	A286BDE427AFE473B29A34540C6B2FA80DBB36FBADF6B098B623B9BD42C9FF4EA6715A965B6930A508DDCEBBB124EE999F7152BB96BAC47E51D8F09A1E147E92
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import itertools..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. parse_iso8601,. url_or_none,.)...class VidmeIE(InfoExtractor):. IE_NAME = 'vidme'. _VALID_URL = r'https?://vid\.me/(?:e/)?(?P<id>[\da-zA-Z]{,5})(?:[^\da-zA-Z]\|$)'. _TESTS = [{. 'url': 'https://vid.me/QNB',. 'md5': 'f42d05e7149aeaec5c037b17e5d3dc82',. 'info_dict': {. 'id': 'QNB',. 'ext': 'mp4',. 'title': 'Fishing for piranha - the easy way',. 'description': 'source: https://www.facebook.com/photo.php?v=312276045600871',. 'thumbnail': r're:^https?://.*\.jpg',. 'timestamp': 1406313244,. 'upload_date': '20140725',. 'age_limit': 0,. 'duration': 119.92,. 'view_count': int,. 'like_count': int,. 'comment_count': int,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-08B52.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9912
Entropy (8bit):	4.756609838193076
Encrypted:	false
SSDEEP:	192:OqPst/5+Pst/5nLkVUtyZoJrQ+0G4V6NSf3AkPA+Y:Oq6R+6RL4KS+I6NSf3q
MD5:	904E8DCA0BE16FC05A59BFBF118F2DCE
SHA1:	4D3E46F531019EC9BDCCE46799E198694AE1CA22
SHA-256:	8420222E3B7850A0BFD69245784858C30137EA4A0369AE4D977A229F812B882B
SHA-512:	98F19A270D71FC25118397CE50D02B4E020214EAEBEE93B792881EF0AD89E064ADB85DC8E263EEADFF9EE32C04AF70213583F52CC79E8FD4CB59A427CC5C7DE0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor...class XimalayaBaseIE(InfoExtractor):. _GEO_COUNTRIES = ['CN']...class XimalayaIE(XimalayaBaseIE):. IE_NAME = 'ximalaya'. IE_DESC = '....FM'. _VALID_URL = r'https?://(?:www\.\|m\.)?ximalaya\.com/(?P<uid>[0-9]+)/sound/(?P<id>[0-9]+)'. _USER_URL_FORMAT = '%s://www.ximalaya.com/zhubo/%i/'. _TESTS = [. {. 'url': 'http://www.ximalaya.com/61425525/sound/47740352/',. 'info_dict': {. 'id': '47740352',. 'ext': 'm4a',. 'uploader': '......',. 'uploader_id': 61425525,. 'uploader_url': 'http://www.ximalaya.com/zhubo/61425525/',. 'title': '261....................',. 'description': "contains:.........\n.....\n................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0CIDE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9150
Entropy (8bit):	4.445757981179268
Encrypted:	false
SSDEEP:	192:bITUjQ/KMA22cwMPS6y3m0JJZlOHRQ1sxi3O4d1H47TsTC6NTa:bITUjQCMA22cwIAJJHODxi3O4H47TsTo
MD5:	001B399FAA3F1A9A35A935A3C6BC1679
SHA1:	15C1D5A581EA55F55A04A64BFB52770F148260BC
SHA-256:	9B8CEA47FBFD4FCF25E3B725375C0F3BFCDAAB2A0FAA48E2AF3CF7FD3F03EFAB
SHA-512:	0323D3E3DDB3A1F55D2D3FA3CF27171904B06E1C3A0B63CB39729F9F0427ED568125DAC7EB0ED165264ADDB9C0364EF78F35C678FB22A66260B314ED19521397
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .srgssr import SRGSSRIE.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_duration,. parse_iso8601,. unescapeHTML,. determine_ext,.)...class RTSIE(SRGSSRIE):. IE_DESC = 'RTS.ch'. _VALID_URL = r'rts:(?P<rts_id>\d+)\|https?://(?:.+?\.)?rts\.ch/(?:[^/]+/){2,}(?P<id>[0-9]+)-(?P<display_id>.+?)\.html'.. _TESTS = [. {. 'url': 'http://www.rts.ch/archives/tv/divers/3449373-les-enfants-terribles.html',. 'md5': 'ff7f8450a90cf58dacb64e29707b4a8e',. 'info_dict': {. 'id': '3449373',. 'display_id': 'les-enfants-terribles',. 'ext': 'mp4',. 'duration': 1488,. 'title': 'Les Enfants Terribles',. 'description': 'France Pommier et sa soeur Luce Feral, les deux filles de ce groupe de 5.',. 'uploader': 'Divers',. 'upload_date': '19

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0CVSG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2467
Entropy (8bit):	4.72493443514785
Encrypted:	false
SSDEEP:	48:+uodzpvYL/iXW1DajXjlksXk9Dq2JJB2onX4GkXTnZK/F7k5S8cbvf:cQLaXiDaqBD5Jmoo/jZKN7k88S3
MD5:	0065B9EBBCBB5419EB96C8B8B331289B
SHA1:	729286F7EF36D28247A458F9274FF0111956ECAB
SHA-256:	B1C02403D5ABABDDA0D20287AEC37AC30997FC6422B8EE2F56B67AE69BB2B8FF
SHA-512:	5224EC78CF59346E8F166F69D4419D6BB81DCD766F089E1D73F65409839AC8C5A0D7D87E26769E99016016199029CD2016C2234D6A660709804500D291EC1BAF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. parse_filesize,. sanitized_Request,. urlencode_postdata,.)...class MinhatecaIE(InfoExtractor):. _VALID_URL = r'https?://minhateca\.com\.br/[^?#]+,(?P<id>[0-9]+)\.'. _TEST = {. 'url': 'http://minhateca.com.br/pereba/misc/youtube-dl+test+video,125848331.mp4(video)',. 'info_dict': {. 'id': '125848331',. 'ext': 'mp4',. 'title': 'youtube-dl test video',. 'thumbnail': r're:^https?://.\.jpg$',. 'filesize_approx': 1530000,. 'duration': 9,. 'view_count': int,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. token = self._html_search_regex(. r'<input name="__RequestVerificationToken".?value="([^"]+)"',. webpage, 're

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0DPTQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2129
Entropy (8bit):	4.6341549046378665
Encrypted:	false
SSDEEP:	48:+uldfXmnmGaJoXjlhsBr3FubNVYGDZIiE5ad7BZQx+EYg6NDU:BdfWnmGaJse38N91Sat4x+EYg6NDU
MD5:	23FB5EB745BD588FA29E44674D849B4C
SHA1:	1AC45615FB324B0D788F1FF11E7EF65DD3D85464
SHA-256:	1289160B78B2BD7A5DAE5A262EFB826B0E26036A7CDB8D2A9FFB05113839D261
SHA-512:	83BE60051383313473D609FD16B211CD9CF8DD1133DABB0701BA96658FD77A9592298E37EE89E89BCF5DD80F63926098D9B4243A2F348507CF8DC3D68A640DEA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import parse_duration...class DiscoveryVRIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?discoveryvr\.com/watch/(?P<id>[^/?#]+)'. _TEST = {. 'url': 'http://www.discoveryvr.com/watch/discovery-vr-an-introduction',. 'md5': '32b1929798c464a54356378b7912eca4',. 'info_dict': {. 'id': 'discovery-vr-an-introduction',. 'ext': 'mp4',. 'title': 'Discovery VR - An Introduction',. 'description': 'md5:80d418a10efb8899d9403e61d8790f06',. }. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id).. bootstrap_data = self._search_regex(. r'root\.DVR\.bootstrapData\s+=\s+"({.+?})";',. webpage, 'bootstrap data'). bootstrap_data = self._parse_json(. bootstrap_data.encode('utf-8').decode('unico

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0E3Q7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7089
Entropy (8bit):	4.534797835488534
Encrypted:	false
SSDEEP:	192:0nduoUhe0hVONIYhCTWHSzypmYkxNijZiaEYrq04pk:u3Uc0DYsTWHYypTSYMpk
MD5:	3A1C2639ADD75C5A3B6E14A0E53F06AB
SHA1:	6AD9E724CEF03B8860A076E053FBBAC0CBFA28F5
SHA-256:	1D6FBADB86A424FBFD690A229EB5C40BFF557C45A2E5E69843CC187251A0BD6B
SHA-512:	F13E24E2B38E18939C0250C906A2A0F92BDCEAD59F2ADCA0E9AA1D37A2B1F0EB01CAC2EE92EA6AE096A43ABF072A83ACA727EF66F42AB7A657F820952068C1F3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. try_get,.)..CDN_API_BASE = 'https://cdn.younow.com/php/api'.MOMENT_URL_FORMAT = '%s/moment/fetch/id=%%s' % CDN_API_BASE...class YouNowLiveIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?younow\.com/(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'https://www.younow.com/AmandaPadeezy',. 'info_dict': {. 'id': 'AmandaPadeezy',. 'ext': 'mp4',. 'is_live': True,. 'title': 'March 26, 2017',. 'thumbnail': r're:^https?://.*\.jpg$',. 'tags': ['girls'],. 'categories': ['girls'],. 'uploader': 'AmandaPadeezy',. 'uploader_id': '6716501',. 'uploader_url': 'https://www.younow.com/AmandaPadeezy',. 'creator': 'AmandaPadeezy',. },. 'skip': True,. }..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0F61V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8167
Entropy (8bit):	4.733529877520487
Encrypted:	false
SSDEEP:	192:pNEd7AdkjsSqbTQyTbekCKNAjqr0hePQu5p2M:pNQsMsSqbTQyTbekuWr0gPQu50M
MD5:	FD031AC409DB4F6B1C85278A72689F91
SHA1:	750E2C9F1D4A64719212228A6C8D6CE7C6AA8DE9
SHA-256:	943075FB60173A57AF14E66ED58749A47A0F285089D8325944F098B30B7255F2
SHA-512:	29A39390EB421D96B973CA5B46BD78551E81D1CBD65760F06100F3C6250BCF18145C6CC1AE5C8A30A699779E5CF457A4F883EC74BB7BC8025F76699BC85CD892
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. qualities,. try_get,. unified_strdate,.)..# There are different sources of video in arte.tv, the extraction process.# is different for each one. The videos usually expire in 7 days, so we can't.# add tests....class ArteTVBaseIE(InfoExtractor):. def _extract_from_json_url(self, json_url, video_id, lang, title=None):. info = self._download_json(json_url, video_id). player_info = info['videoJsonPlayer'].. vsr = try_get(player_info, lambda x: x['VSR'], dict). if not vsr:. error = None. if try_get(player_info, lambda x: x['custom_msg']['type']) == 'error':. error = try_get(. player_info, lambda x: x['custom_msg']['msg'], compat_str). if not error:. error = 'Video %s is not availab

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0FAB2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.625357670358476
Encrypted:	false
SSDEEP:	48:PuLWiDfxhbp2TEFJ3GxfCRvxjsVAfdfFkVkHlx98SllMGzmBTbX85T6NKQ5j:TirxhbQMJWxaRv5KAf/Fx98AaGzmBTQo
MD5:	40BED2673C5B2AB8BFDFEDB0654EE4E5
SHA1:	8C63430FE187C8C3B87F5FCE18BA74E60DFA8A1A
SHA-256:	042181DC05290F3806558A60359ABF925D52CB66EE3E56BEA67595BF0EB23986
SHA-512:	CFD8581DBE788B329E1AE03457B4BBF32A18A54DB1EBA8C490DA068FB5EA52EA384EE667418026A8D27571D9298B527D10244C9D80A76D025E517944A3FC7D13
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. fix_xml_ampersands,.)...class MetacriticIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?metacritic\.com/.+?/trailers/(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.metacritic.com/game/playstation-4/infamous-second-son/trailers/3698222',. 'info_dict': {. 'id': '3698222',. 'ext': 'mp4',. 'title': 'inFamous: Second Son - inSide Sucker Punch: Smoke & Mirrors',. 'description': 'Take a peak behind-the-scenes to see how Sucker Punch brings smoke into the universe of inFAMOUS Second Son on the PS4.',. 'duration': 221,. },. 'skip': 'Not providing trailers anymore',. }, {. 'url': 'http://www.metacritic.com/game/playstation-4/tales-from-the-borderlands-a-telltale-game-series/trailers/5740315',. 'info_dict': {. 'id': '5740315',. 'ext': 'mp4',. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0GFDC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10574
Entropy (8bit):	4.5561786299636005
Encrypted:	false
SSDEEP:	192:yFLqLK6irBfnerWFJmGZL9kzu5vh5jp2vrZ4oAjzcvmivO6+Wf3T5H6NQoBa8qab:yFLqLK6irBfnIWFgGZL9kzu555V2zZ4B
MD5:	89CF8C4886998F22DF3CA515B28CD890
SHA1:	F524EDFC332F95C3963DB01B1A189EB64B9E01D2
SHA-256:	B8CF443E6DBE50AA8653C9BB9AC841D2E100C72BC38BA02B0DB214ABDB8515B5
SHA-512:	638C66B2D6F4106A34F6E5777FA667C54CD5C95CA528239203D91AF78AEC3D8565624BC64D82311463BDF8F74108E41B70F88BF658587812FA748A3E43E0CFA1
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import random.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. encode_data_uri,. ExtractorError,. int_or_none,. float_or_none,. mimetype2ext,. str_or_none,.)...class UstreamIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ustream\.tv/(?P<type>recorded\|embed\|embed/recorded)/(?P<id>\d+)'. IE_NAME = 'ustream'. _TESTS = [{. 'url': 'http://www.ustream.tv/recorded/20274954',. 'md5': '088f151799e8f572f84eb62f17d73e5c',. 'info_dict': {. 'id': '20274954',. 'ext': 'flv',. 'title': 'Young Americans for Liberty February 7, 2012 2:28 AM',. 'description': 'Young Americans for Liberty February 7, 2012 2:28 AM',. 'timestamp': 1328577035,. 'upload_date': '20120207',. 'uploader': 'yaliberty',. 'uploader_id': '6780869',. },. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0GU66.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	4.651653401750048
Encrypted:	false
SSDEEP:	48:+uvWOQWbCX4N1arnkYarD1qajXjlkdXWQlZeFaPidy/hLOd9VLVBTzNXqQPgrK/c:KO724OTkYargaqEQlZ3Pidy/hLOd9JVe
MD5:	D7085E755EAF9332D827EA2D1EC94452
SHA1:	8FB3AAF432A8D5570147F3B5BC43503495503C04
SHA-256:	FD877E2738F4C632DF3E7146D8CB75AFACEAC0709FCBBB602E2DD6F39B53872B
SHA-512:	CFBEC455DFCEE85429824472FB22B925518EBB95D87E3C0F3274686FE6A821113F398490A6D8F629DA8DFD7E2A229728A5F2518DC043F84B27FEA1561E44418B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. determine_protocol,. parse_duration,. int_or_none,.)...class Lecture2GoIE(InfoExtractor):. _VALID_URL = r'https?://lecture2go\.uni-hamburg\.de/veranstaltungen/-/v/(?P<id>\d+)'. _TEST = {. 'url': 'https://lecture2go.uni-hamburg.de/veranstaltungen/-/v/17473',. 'md5': 'ac02b570883020d208d405d5a3fd2f7f',. 'info_dict': {. 'id': '17473',. 'ext': 'mp4',. 'title': '2 - Endliche Automaten und regul.re Sprachen',. 'creator': 'Frank Heitmann',. 'duration': 5220,. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._html_search_regex(r'<em[^>]+class="title">(.+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0GVJA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	4.603615544056786
Encrypted:	false
SSDEEP:	48:+u4XXx0XmPiA/tF5NqWX+PjtfjXhkdXRbsb+7EavILeTBvFbAMrBTbOd/6Nq:eyXZ0tvsWXQfa7sb+7E9LeZJAqBTe6Nq
MD5:	1E0994216F013497E607A8649A0173B6
SHA1:	1B72D0A70CDFECF8ABE0D41166FEA1BD7C4DEB66
SHA-256:	08DAAF86251D3FE40F732A7BCCEBB4A6CC270F218FEACBCCD1E2E6D28F218509
SHA-512:	4C6AADB216000351DE324AB86644DB62760ACD7D5F7D42906EF67DEBAE903BF67CED0B2DDBA7FC467791DCB5B4ACC7928AF8FBAE1638E4151C2F33AC31613605
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_urllib_parse_unquote,.)...class BigflixIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bigflix\.com/.+/(?P<id>[0-9]+)'. _TESTS = [{. # 2 formats. 'url': 'http://www.bigflix.com/Tamil-movies/Drama-movies/Madarasapatinam/16070',. 'info_dict': {. 'id': '16070',. 'ext': 'mp4',. 'title': 'Madarasapatinam',. 'description': 'md5:9f0470b26a4ba8e824c823b5d95c2f6b',. 'formats': 'mincount:2',. },. 'params': {. 'skip_download': True,. }. }, {. # multiple formats. 'url': 'http://www.bigflix.com/Malayalam-movies/Drama-movies/Indian-Rupee/15967',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0HLFU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	18928
Entropy (8bit):	4.761926064477707
Encrypted:	false
SSDEEP:	384:MyWgnCl34c0u5LlcpQmsYErPJVwO0ABshXusQ7cBUuldmbdlVbqdFxBTU6NwdWB2:TirPniesQ7cBUulgbdlVbqdFxBTU8wDz
MD5:	5AB579065F7A2A064FA7768714E56FAB
SHA1:	623CB97B651ECADE074E9D217315BC39E115669F
SHA-256:	E7107CE5224E8616975F7A60E60F98EF1D58E4BD408A66EB3CB4992B34CCE5D3
SHA-512:	BAA5E2204CFCB8EFC78BE8522A6F19F0EFE8CBDDBB4333B9FB93B6DF9E5FDF2D549016F600B5623DD502562C363A06333E401989F1CA94AAC69245E9911AE2C5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_HTTPError,.).from ..utils import (. js_to_json,. smuggle_url,. try_get,. xpath_text,. xpath_element,. xpath_with_ns,. find_xpath_attr,. orderedSet,. parse_duration,. parse_iso8601,. parse_age_limit,. strip_or_none,. int_or_none,. ExtractorError,.)...class CBCIE(InfoExtractor):. IE_NAME = 'cbc.ca'. _VALID_URL = r'https?://(?:www\.)?cbc\.ca/(?!player/)(?:[^/]+/)+(?P<id>[^/?#]+)'. _TESTS = [{. # with mediaId. 'url': 'http://www.cbc.ca/22minutes/videos/clips-season-23/don-cherry-play-offs',. 'md5': '97e24d09672fc4cf56256d6faa6c25bc',. 'info_dict': {. 'id': '2682904050',. 'ext': 'mp4',. 'title': 'Don Cherry . All-Stars',. 'description': 'Don Cherry has a bee in his bonnet about AHL player John Scott because

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0K38T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2431
Entropy (8bit):	4.879629621397853
Encrypted:	false
SSDEEP:	48:wu6STQFHSffsUgqGvQELyzjXQnI2X8X3GcC9gKYJYdGzaHDVGgQ8c26N1/YJ:YS8FyffzzOBLasISX99YZCDk8V6N1/q
MD5:	61C8914F811CF96E816E3824D9F166DC
SHA1:	5CF28D4066B1344E75B2926EA3C33F4FC8284041
SHA-256:	CBB6942EB3BCD870BB508BEB8A628BB7EE345D596F4C47044DB247A246E4BA00
SHA-512:	8A0BB1B3962E3780DC95D733AE9B480D65C2D213B7690F16D22985706091573B77CD3F3D284749C8E456E4E36E627BBBA0A5CD36CF0203DF90F54CEB3245DA0B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import parse_duration...class RadioBremenIE(InfoExtractor):. _VALID_URL = r'http?://(?:www\.)?radiobremen\.de/mediathek/(?:index\.html)?\?id=(?P<id>[0-9]+)'. IE_NAME = 'radiobremen'.. _TEST = {. 'url': 'http://www.radiobremen.de/mediathek/?id=141876',. 'info_dict': {. 'id': '141876',. 'ext': 'mp4',. 'duration': 178,. 'width': 512,. 'title': 'Druck auf Patrick .zt.rk',. 'thumbnail': r're:https?://.*\.jpg$',. 'description': 'Gegen den SPD-B.rgerschaftsabgeordneten Patrick .zt.rk wird wegen Beihilfe zum gewerbsm..igen Betrug ermittelt. Am Donnerstagabend sollte er dem Vorstand des SPD-Unterbezirks Bremerhaven dazu Rede und Antwort stehen.',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. meta_url = 'http://www.radiobre

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0KBD9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	4.66385945172676
Encrypted:	false
SSDEEP:	48:+u1GehozEQd+Q72X3VDYQ8OQ1zXQ5LIMfRb8f/dfFk0UkoEjzzc3jYyVlEVoBT09:bhoz1ZCX3x/8OIzXQ5LIG66koEj08yVq
MD5:	8E68D6ECE390309E4FEAEEB9C30060A2
SHA1:	FF30CE88A46421DC14F49CD2DC0C8D75423AB91F
SHA-256:	C6BBCAC0964EF87C9EF5E0CA6B8154DEEF3C320F0995A62BFBA1391CA53E07A8
SHA-512:	BF2F0330D26B6F220874B2EBEEF8DE3CCD75B9E420401DF7D608B2F62E534E09EC4FB9B8D84A32CC3065B9967C26CEF38A6368C6EE33C107F9D1BDCE4E75BB66
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. qualities,. unified_strdate,.)...class MgoonIE(InfoExtractor):. _VALID_URL = r'''(?x)https?://(?:www\.)?. (?:(:?m\.)?mgoon\.com/(?:ch/(?:.+)/v\|play/view)\|. video\.mgoon\.com)/(?P<id>[0-9]+)'''. _API_URL = 'http://mpos.mgoon.com/player/video?id={0:}'. _TESTS = [. {. 'url': 'http://m.mgoon.com/ch/hi6618/v/5582148',. 'md5': 'dd46bb66ab35cf6d51cc812fd82da79d',. 'info_dict': {. 'id': '5582148',. 'uploader_id': 'hi6618',. 'duration': 240.419,. 'upload_date': '20131220',. 'ext': 'mp4',. 'title': 'md5:543aa4c27a4931d371c3f433e8cebebc',. 'thumbnail': r're:^https?://.*\.jpg$',. }. },. {. 'url': 'http://www.mgoon.com/play/view/5582148',. 'on

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0L301.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2000
Entropy (8bit):	4.637499393863701
Encrypted:	false
SSDEEP:	48:Pu0BZggicnnNlJ0gq+ajXjlkEsuXXqp4ZaQShv5BTXXAhyKJ6cqqbAtZ9e6Ne:DZgg/nfqz+aqno7kBTSXJY5tZ9e6Ne
MD5:	AEBE15E2E19E5F18BF20DF6928F07D99
SHA1:	426B68614F316191973242624DADBAD32F631FF9
SHA-256:	34F1FCFC49DB7C642642BE50F875E7E0E28240AA81BC77B03531FE02D176F15C
SHA-512:	BE7C033C31FA6B1D1985412B43097795630765C6F21AD9FCDD738384C648660F428B8EBE28422E8CF54218183A11D60809E67C5D24FA1AC90617A799E638AE9C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class SexuIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?sexu\.com/(?P<id>\d+)'. _TEST = {. 'url': 'http://sexu.com/961791/',. 'md5': 'ff615aca9691053c94f8f10d96cd7884',. 'info_dict': {. 'id': '961791',. 'ext': 'mp4',. 'title': 'md5:4d05a19a5fc049a63dbbaf05fb71d91b',. 'description': 'md5:2b75327061310a3afb3fbd7d09e2e403',. 'categories': list, # NSFW. 'thumbnail': r're:https?://.\.jpg$',. 'age_limit': 18,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. jwvideo = self._parse_json(. self._search_regex(r'\.setup$\s({.+?})\s*$;', webpage, 'jwvideo'),. video_id).. sources = jwvideo['sources'].. formats = [{. 'url': source['file'].replace('\\', ''),.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0L89D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5082
Entropy (8bit):	4.695351060733663
Encrypted:	false
SSDEEP:	96:qLoAGdHpN9Bfgqrg5CfCNhVALOuoHvV+b1RgVDyIBTg6NWn8o9mkY/FfbW/KvTHm:q09dHj9Jgqrg5CCNhVAyNHYb1RiTg6Nm
MD5:	1136C761214FF0870114F40C47F9D33C
SHA1:	C2DD205C74C5A50D67EC10CCF53FFA8FD958BF9C
SHA-256:	7AC6BC1AAC764399F5ECFBF5F56D69C25E54439CD5236C94736AF35446CE7197
SHA-512:	9FF9F4CD47B59A8AF599729A8CAFEAAED683ED89BC748B78637AB25547718EB16010C1B409018F0753C93C6ECF8ADD8A300F038A244B9F4437E0CF58D9CC7606
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. js_to_json,. mimetype2ext,. ExtractorError,.)...class ImgurIE(InfoExtractor):. _VALID_URL = r'https?://(?:i\.)?imgur\.com/(?!(?:a\|gallery\|(?:t(?:opic)?\|r)/[^/]+)/)(?P<id>[a-zA-Z0-9]+)'.. _TESTS = [{. 'url': 'https://i.imgur.com/A61SaA1.gifv',. 'info_dict': {. 'id': 'A61SaA1',. 'ext': 'mp4',. 'title': 're:Imgur GIF$\|MRW gifv is up and running without any bugs$',. },. }, {. 'url': 'https://imgur.com/A61SaA1',. 'only_matching': True,. }, {. 'url': 'https://i.imgur.com/crGpqCV.mp4',. 'only_matching': True,. }, {. # no title. 'url': 'https://i.imgur.com/jxBXAMC.gifv',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. 'https://i.imgur.c

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0NLNP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	4.9759178886261735
Encrypted:	false
SSDEEP:	48:+ubXc47ab3u5EBcxi0y7RnjXhkJIwnU4y3bIWWC:vp7GqEBcxm1naJ3U4yrvWC
MD5:	3C5BF5BA17CF030539B71B27AB41745F
SHA1:	C949139CEC46DA1F252025D3F2198864FD3EDCAB
SHA-256:	2E29EF630639530615A4B6B2EA05FA69120BE3DAE52B3A45C420AE1E33E3AB67
SHA-512:	BB72DBBA94491A77A7F9A444A5CAAD48B4A8B9CEC83CE68D47F5B1C57265CC32B9F5BD2BE261CDE091CDCEF8E87EA7643ED21224D55F666707AA551C0C15404F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. js_to_json,. get_element_by_class,. unified_strdate,.)...class RudoIE(InfoExtractor):. _VALID_URL = r'https?://rudo\.video/vod/(?P<id>[0-9a-zA-Z]+)'.. _TEST = {. 'url': 'http://rudo.video/vod/oTzw0MGnyG',. 'md5': '2a03a5b32dd90a04c83b6d391cf7b415',. 'info_dict': {. 'id': 'oTzw0MGnyG',. 'ext': 'mp4',. 'title': 'Comentario Tom.s Mosciatti',. 'upload_date': '20160617',. },. }.. @classmethod. def _extract_url(cls, webpage):. mobj = re.search(. r'<iframe[^>]+src=(?P<q1>[\'"])(?P<url>(?:https?:)?//rudo\.video/vod/[0-9a-zA-Z]+)(?P=q1)',. webpage). if mobj:. return mobj.group('url').. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id, encoding='iso-8859

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0NOC5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11404
Entropy (8bit):	4.888410830578849
Encrypted:	false
SSDEEP:	192:Nz9yeJVBvIa2STn6YDNFjnK8wZz2+CHVnjxen0/Puz2C62mK/spItpg0555T06Nf:NRyeJnIa2Sj6YBFzKhZrCHFjxmaPuz79
MD5:	D8BA3F89B3F57D74B020204795ACBE13
SHA1:	7E223693711DB2B3B74496316289044C3658147A
SHA-256:	330321D626F418E2D5FCD4E30D940B5BED2C273C0A55C76A5BC93DFCF617A7E2
SHA-512:	929BD0B0E12D638A911358BF83C6F9F61713A0EFDCB5F05AC34A520A6D38E4862BA444EB79EC871AABD594B6F021FB6DDE2BEAB843590051B0B4C8F43FAFDDF3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random.import re.import string.import time..from .common import InfoExtractor.from ..utils import (. ExtractorError,. get_element_by_class,. js_to_json,. str_or_none,. strip_jsonp,.)...class YoukuIE(InfoExtractor):. IE_NAME = 'youku'. IE_DESC = '..'. _VALID_URL = r'''(?x). (?:. https?://(. (?:v\|player)\.youku\.com/(?:v_show/id_\|player\.php/sid/)\|. video\.tudou\.com/v/)\|. youku:). (?P<id>[A-Za-z0-9]+)(?:\.html\|/v\.swf\|). '''.. _TESTS = [{. # MD5 is unstable. 'url': 'http://v.youku.com/v_show/id_XMTc1ODE5Njcy.html',. 'info_dict': {. 'id': 'XMTc1ODE5Njcy',. 'title': '.Smile.. Git Fresh -Booty Music...',. 'ext': 'mp4',. 'duration': 74.73,. 'thumbnail': r're:^https?://.*',. 'uploader': '.....',. 'uploader_id': '36

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0RGKH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3299
Entropy (8bit):	4.539558601443991
Encrypted:	false
SSDEEP:	96:EtejpXV1io4Xefquiogwn9cvWrlbOBTe1gl6NF18t:59FkoPqu3aTL6NAt
MD5:	3549C212C0D074C15B2DB8FD63A2101A
SHA1:	D47CC536BB58B43C25F743D50B5CA418A6D16B5E
SHA-256:	64442A70A80A1E070EFAE94789CC105521F4FE4371143043A25A430F118F44B1
SHA-512:	7CF3BC799B1D4FF881932201FFBDF3499E59B9F4E4F4ECAB3BE1D1CE1C6F9933BADF4DDFD55C78F301A09B7543AA0012C96DABC13DCAA73BE1207081FB3AA3FD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote,. compat_urllib_parse_unquote_plus,.).from ..utils import (. clean_html,. ExtractorError,.)...class PlayvidIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?playvid\.com/watch(\?v=\|/)(?P<id>.+?)(?:#\|$)'. _TESTS = [{. 'url': 'http://www.playvid.com/watch/RnmBNgtrrJu',. 'md5': 'ffa2f6b2119af359f544388d8c01eb6c',. 'info_dict': {. 'id': 'RnmBNgtrrJu',. 'ext': 'mp4',. 'title': 'md5:9256d01c6317e3f703848b5906880dc8',. 'duration': 82,. 'age_limit': 18,. },. 'skip': 'Video removed due to ToS',. }, {. 'url': 'http://www.playvid.com/watch/hwb0GpNkzgH',. 'md5': '39d49df503ad7b8f23a4432cbf046477',. 'info_dict': {. 'id': 'hwb0GpNkzgH',. 'ext': 'mp4',. 'title': 'Ellen Euro Cutie Blond Takes a Sexy

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0RKIC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.365828798235554
Encrypted:	false
SSDEEP:	24:zi8lFvXDBG7wQdqz4B0/nzVdlHmzmgvVf+oDFvHeIXjl+tpZeX0oZeXkckcz6ylt:+uHOtSJj5g9LFvjXjlCHeXbZeXRf6SXB
MD5:	FA5E82CDAF0F66FB6C0102986C726616
SHA1:	499521BD23917E9B1A43CE8551ED8A7F8825CED1
SHA-256:	0DA08AE87A55C0A0A3490B24287564D351944D9DA576007E2243A06067D0F000
SHA-512:	AAC0D63C0ECB10809B3018140F6B8A12798D7D1BEE085527D6393330E6EE7410C7AE071539DAB177656AB53DB3C18964710CDAF40CFD27C98E9C5AB15F9513EB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class MiaoPaiIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?miaopai\.com/show/(?P<id>[-A-Za-z0-9~_]+)'. _TEST = {. 'url': 'http://www.miaopai.com/show/n~0hO7sfV1nBEw4Y29-Hqg__.htm',. 'md5': '095ed3f1cd96b821add957bdc29f845b',. 'info_dict': {. 'id': 'n~0hO7sfV1nBEw4Y29-Hqg__',. 'ext': 'mp4',. 'title': '...........',. 'thumbnail': 're:^https?://.*/n~0hO7sfV1nBEw4Y29-Hqg___m.jpg',. }. }.. _USER_AGENT_IPAD = 'Mozilla/5.0 (iPad; CPU OS 9_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13B143 Safari/601.1'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. url, video_id, headers={'User-Agent': self._USER_AGENT_IPAD}).. title = self._html_search_regex(. r'<title>([^<]+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0V1LK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3575
Entropy (8bit):	4.645532952108251
Encrypted:	false
SSDEEP:	96:KO099dXdrsKspkfqASUSF1YLfpLOl9vily/iYbR11BTg6NJdJ:H0DTsoq3USF1YLxLOlJilNYV1LTg6NR
MD5:	59C4AE7A6EF2B45645024A46F5A9D16A
SHA1:	DD6204488E08DEFD66FA3F5061F378D7A7646E10
SHA-256:	4F19746A94E4B4C1CAEAE55FB560E1D33D793A20271F73F1CF46B7B80FB00605
SHA-512:	C247E4967338DF16EBEBDD5A964E2E69284C7048940F10E7FF409E56E2EC5AEFD6E9F03FF1EC83D838385D4AC7595D891EFAB2574EB8CCE19910999B2E88A532
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. js_to_json,.).from ..compat import compat_urlparse...class UDNEmbedIE(InfoExtractor):. IE_DESC = '....'. _PROTOCOL_RELATIVE_VALID_URL = r'//video\.udn\.com/(?:embed\|play)/news/(?P<id>\d+)'. _VALID_URL = r'https?:' + _PROTOCOL_RELATIVE_VALID_URL. _TESTS = [{. 'url': 'http://video.udn.com/embed/news/300040',. 'info_dict': {. 'id': '300040',. 'ext': 'mp4',. 'title': '....... ..."..."',. 'thumbnail': r're:^https?://.*\.jpg$',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'expected_warnings': ['Failed to parse JSON Expecting value'],. }, {. 'url': 'https://video.udn.com/embed/news/300040',. 'only_matching': True,. }, {. # From https://

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-0VEP1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4532
Entropy (8bit):	4.706343970961764
Encrypted:	false
SSDEEP:	96:W1qdlGTV8da3V+etG4rEQmRQnj7gZQTtnw6NPmrEn7qwQyXgv0fJslPGEcEsLlID:W1qdQR8da3Il+EpkH8T6NP2E7qBZviJA
MD5:	908587F31B641525A5D3E4ADC001BB7A
SHA1:	C7C90DE8A402CA031403F69E3729F03F1038DA50
SHA-256:	E93280E0A086ECCA3E4DD222A079A2AC304C3D26ABAFDA1AC576D830F763B6CD
SHA-512:	7EE3C21D5393207F8BD6E9C6D7D78B7FDF1C8CD599E7D20A5EA33C4508ED56C005BE99B754DB5C2B38C9E364AFF8D420763A33F63FEC9D1E5E269BFE4E207B4A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. try_get,. unescapeHTML,. url_or_none,. urljoin,.)...class WWEBaseIE(InfoExtractor):. _SUBTITLE_LANGS = {. 'English': 'en',. 'Deutsch': 'de',. }.. def _extract_entry(self, data, url, video_id=None):. video_id = compat_str(video_id or data['nid']). title = data['title'].. formats = self._extract_m3u8_formats(. data['file'], video_id, 'mp4', entry_protocol='m3u8_native',. m3u8_id='hls').. description = data.get('description'). thumbnail = urljoin(url, data.get('image')). series = data.get('show_name'). episode = data.get('episode_name').. subtitles = {}. tracks = data.get('tracks'). if isinstance(tracks, list):. for track in tracks:. if not isinstance(track, dict):. continue.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-10335.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10576
Entropy (8bit):	4.077770528612054
Encrypted:	false
SSDEEP:	192:lS1kx5Ei63vs2FLtnhWKqtIXl5l/jJayT2oluNfJ6Ng:lr5Eios2FLLFmCjJayTNlC6Ng
MD5:	A0DF5F55D8A28D54DDEBFC0BEB278629
SHA1:	B6CA52041F55BACFED2C2DB169CD52B311AA69AF
SHA-256:	6A0D64FCF2F8A7D25928C57B6D1FE73AB1AC1BFBDEA20DC19F8DFDFB9BAC8ACD
SHA-512:	7AF38B515530B86431E2B474836A926304348D3E4B020EDD03171201242BC5F3D775C48AFA82B74946505FE3EA3398F88524FCF570E9C9E91353A4C6E9009572
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_resolution,. try_get,. unified_timestamp,. url_or_none,. urljoin,.)...class PeerTubeIE(InfoExtractor):. _INSTANCES_RE = r'''(?:. # Taken from https://instances.joinpeertube.org/instances. tube\.openalgeria\.org\|. peertube\.pointsecu\.fr\|. peertube\.nogafa\.org\|. peertube\.pl\|. megatube\.lilomoino\.fr\|. peertube\.tamanoir\.foucry\.net\|. peertube\.inapurna\.org\|. peertube\.netzspielplatz\.de\|. video\.deadsuperhero\.com\|. peertube\.devosi\.org\|. peertube\.1312\.media\|.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-10JI6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3280
Entropy (8bit):	4.731910064673617
Encrypted:	false
SSDEEP:	96:Qp0suNYhBlzcZ/eQwhdWOt6wEiH4GBbAP2IBBTnqe06NhLc7UC:G00emJS1wA+oTqe06NE
MD5:	2AB7B77708748B752D43218FCA129DC3
SHA1:	295A4DA06B6A80C1BFB0550239370F957184EEA8
SHA-256:	81B7CE75545E152075D74E9D4BEEBDD0D228AE4CFD887BA07A496264D30EC700
SHA-512:	A47647367DCE9ABC9A2CF5CDDD61E8CA9E81289B7B5D07469460929072D12A5DF61139E37B5F822D70D4822977292E91087501A0402F2938F012BBFD9B0A2943
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. orderedSet,.)...class DeezerPlaylistIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?deezer\.com/playlist/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.deezer.com/playlist/176747451',. 'info_dict': {. 'id': '176747451',. 'title': 'Best!',. 'uploader': 'Anonymous',. 'thumbnail': r're:^https?://cdn-images\.deezer\.com/images/cover/.*\.jpg$',. },. 'playlist_count': 30,. 'skip': 'Only available in .de',. }.. def _real_extract(self, url):. if 'test' not in self._downloader.params:. self._downloader.report_warning('For now, this extractor only supports the 30 second previews. Patches welcome!').. mobj = re.match(self._VALID_URL, url). playlist_id = mobj.group('id').. webpage = self._download_webpage(

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-11ULD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10137
Entropy (8bit):	4.521880530503634
Encrypted:	false
SSDEEP:	192:81FOP6KnqStHmFSES6imINUVbB2/AVN69MX0ZdgWBvT5TokbEcccb6NLl:81gP6KnqStHmFSES6imQUVbU/AVN6mkM
MD5:	EEDD599CA2FED7DA71AAB28EA1BF9449
SHA1:	0CBDA54E9B8120E93C6D6FC2115630C48FA74E23
SHA-256:	421B254ECE63DBA31D848C131AF30FA6EB6457F1E4579D195FF0AE099D73F358
SHA-512:	60B668CADDDEF797B922FAB7C15FDDBB4A42BB8E70148961A70811B464F387DC91FDA2C92923BCB7AE4DB239AF65BDED05BFB7F65D2349B454FA63237CFB3D32
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. ExtractorError,. int_or_none,. parse_iso8601,. qualities,. unescapeHTML,.)...class Channel9IE(InfoExtractor):. IE_DESC = 'Channel 9'. IE_NAME = 'channel9'. _VALID_URL = r'https?://(?:www\.)?(?:channel9\.msdn\.com\|s\.ch9\.ms)/(?P<contentpath>.+?)(?P<rss>/RSS)?/?(?:[?#&]\|$)'.. _TESTS = [{. 'url': 'http://channel9.msdn.com/Events/TechEd/Australia/2013/KOS002',. 'md5': '32083d4eaf1946db6d454313f44510ca',. 'info_dict': {. 'id': '6c413323-383a-49dc-88f9-a22800cab024',. 'ext': 'wmv',. 'title': 'Developer Kick-Off Session: Stuff We Love',. 'description': 'md5:b80bf9355a503c193aff7ec6cd5a7731',. 'duration': 4576,. 'thumbnail': r're:https?://.*\.jpg',. 'timestamp': 1377717420,. 'upload_date': '20130828',. 'session_code': 'KOS002

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-12JUB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3478
Entropy (8bit):	4.081156785097402
Encrypted:	false
SSDEEP:	48:+uXH6XfJB5fNXhTZqXGlk58Jg4wDBORojCUxsC3Cql6nVT5boRAx47WBTNm+6N0:zGdfBY81oxxnlcnoRAxWWBT96N0
MD5:	94B4BD2443E7DF665630BA17AED8DC77
SHA1:	5B6B43EF3ED5E54646BE6424D4EF2DEAB9492439
SHA-256:	905DB35D3F04A6BE179AAA5964A8BBD5586B36155E1FC39C7318197D1C8910E1
SHA-512:	E52BD584A845EA7CFAFD581A7D0795664D39FE492820156E45E1F50D6C485D750C550CE33F8024A4D84CE8459C67D850247F3E72752B82F9AD2D9507A8EC9E1B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. url_or_none,.)...class CamModelsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cammodels\.com/cam/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.cammodels.com/cam/AutumnKnight/',. 'only_matching': True,. 'age_limit': 18. }].. def _real_extract(self, url):. user_id = self._match_id(url).. webpage = self._download_webpage(. url, user_id, headers=self.geo_verification_headers()).. manifest_root = self._html_search_regex(. r'manifestUrlRoot=([^&\']+)', webpage, 'manifest', default=None).. if not manifest_root:. ERRORS = (. ("I'm offline, but let's stay connected", 'This user is currently offline'),. ('in a private show', 'This user is in a private show'),. ('is currently performing LIVE', '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-16039.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2195
Entropy (8bit):	4.86455195891334
Encrypted:	false
SSDEEP:	48:+uag1bYXlnQEldSHLvrD1fjXjZqlpLHchW2LvNfJoXjlhwBGdMYO:uaAlnTldSHLvrVIpLHL2Lv5JsJ2
MD5:	0147CA1FAFDE08EF43B4641FBE80A99F
SHA1:	82584E121FDF44025BEEF3A21527EA9CDCAD3C3D
SHA-256:	3E98D0E7AB5D30388B64FD6B82DB6DBCA9E8BA9F48A86D1E922141A32ED4263E
SHA-512:	A703C52AFF509F03D953117EE2FA082D6D02D1B3459264124A8A8FAB04A20F01C90A7ECC703332ECD3751BE7720552063988D5729E6BFD106B2389A0D47DBDD9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals...from .common import InfoExtractor.from ..utils import smuggle_url...class CNBCIE(InfoExtractor):. _VALID_URL = r'https?://video\.cnbc\.com/gallery/\?video=(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://video.cnbc.com/gallery/?video=3000503714',. 'info_dict': {. 'id': '3000503714',. 'ext': 'mp4',. 'title': 'Fighting zombies is big business',. 'description': 'md5:0c100d8e1a7947bd2feec9a5550e519e',. 'timestamp': 1459332000,. 'upload_date': '20160330',. 'uploader': 'NBCU-CNBC',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). return {. '_type': 'url_transparent',. 'ie_key': 'ThePlatform',. 'url': smuggle_url(. 'http://link.theplatform.com/s/gZWlPC/media

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-172R8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	13103
Entropy (8bit):	4.775203746866203
Encrypted:	false
SSDEEP:	384:QnsImQ9WlAI6maR/IEvYiyTW6N/J+ejqh50GNPSitH5GGBTH6Ng:HGIEvByTW81itH5GGBTH8g
MD5:	12DD9FF00FC72E3D6DF7F0174F0855C1
SHA1:	0310E7F0AE499F8EFC1909D3394B5476B64FC9BC
SHA-256:	8F0F8A3B654DB79DE8A6BFD0D7B114547386ACFC98E91D26AE9CD41E9CB8A42A
SHA-512:	02CC77051F6301ECD9081AF4A183B8C2E03B215671029C78D89A4E91D6A9323898DCE1FC7CA80DEA0473F789DE6510A8C96AE547DC143FC2FE1389178ACC8777
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import datetime.import hashlib.import re.import time..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_ord,. compat_str,. compat_urllib_parse_urlencode,.).from ..utils import (. determine_ext,. encode_data_uri,. ExtractorError,. int_or_none,. orderedSet,. parse_iso8601,. str_or_none,. url_basename,. urshift,.)...class LeIE(InfoExtractor):. IE_DESC = '...'. _VALID_URL = r'https?://(?:www\.le\.com/ptv/vplay\|(?:sports\.le\|(?:www\.)?lesports)\.com/(?:match\|video))/(?P<id>\d+)\.html'. _GEO_COUNTRIES = ['CN']. _URL_TEMPLATE = 'http://www.le.com/ptv/vplay/%s.html'.. _TESTS = [{. 'url': 'http://www.le.com/ptv/vplay/22005890.html',. 'md5': 'edadcfe5406976f42f9f266057ee5e40',. 'info_dict': {. 'id': '22005890',. 'ext': 'mp4',. 'title': '.87........... .......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-1CRK3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2551
Entropy (8bit):	4.502864543958263
Encrypted:	false
SSDEEP:	48:wuNkRBwYJMaXgajXjlkdXLMFd6/PX+1Dfjr0AXcLxpXh9eX4D6NSqtc:IRBwYJMaXgaqFMFd6/2FrUFf9JD6Ndtc
MD5:	B143242B7556DC1175295F608F460036
SHA1:	000A04F8DA009A5A938C260F8761233D16071756
SHA-256:	12B46ED5AF77DC79246FFAE9E8780615F7A84240A3D6D8F0CA14772EFF496B01
SHA-512:	41D6B0051265D13E9C86F30FC51ACAD1D69C9B31148FBE1B844B6FCB88DE083BE5B64AA260F287BFDFCDE3C9F53BCA6EE77C4922B120FBDB57374D1BBF69DDA4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_iso8601,. qualities,.)..import re...class ClippitIE(InfoExtractor):.. _VALID_URL = r'https?://(?:www\.)?clippituser\.tv/c/(?P<id>[a-z]+)'. _TEST = {. 'url': 'https://www.clippituser.tv/c/evmgm',. 'md5': '963ae7a59a2ec4572ab8bf2f2d2c5f09',. 'info_dict': {. 'id': 'evmgm',. 'ext': 'mp4',. 'title': 'Bye bye Brutus. #BattleBots - Clippit',. 'uploader': 'lizllove',. 'uploader_url': 'https://www.clippituser.tv/p/lizllove',. 'timestamp': 1472183818,. 'upload_date': '20160826',. 'description': 'BattleBots \| ABC',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._html_search_regex(r'<title.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-1EHAL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5522
Entropy (8bit):	4.676831689371388
Encrypted:	false
SSDEEP:	96:BPmw7+9dvscL4+vQU4N9y7bHJegeg5BRA84aTxIs/vsqOIK503GrBTqfY+VhNpOL:ZU9dv9L4+vv4N9y7bHsRaFj/vtOIQYGz
MD5:	D064D70F7EA7C50D2EA83985E04109EE
SHA1:	6A2AB9843B90A7F71781F297DF383F1918400DC2
SHA-256:	F2A38626CABEF8C409FCED5E3A03BFF71EBE143DC0E2E12A3BD97F65FC2DEC62
SHA-512:	9240926F917FE7F2EAB5108BDAC0F44EAE283D2437E996191D6FCB2520061DC2394E4B1283CE1C826836DA2E97FD43429457274C8F4F844790E707652AE03EAC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. parse_duration,. update_url_query,. str_or_none,.)...class UOLIE(InfoExtractor):. IE_NAME = 'uol.com.br'. _VALID_URL = r'https?://(?:.+?\.)?uol\.com\.br/.*?(?:(?:mediaId\|v)=\|view/(?:[a-z0-9]+/)?\|video(?:=\|/(?:\d{4}/\d{2}/\d{2}/)?))(?P<id>\d+\|[\w-]+-[A-Z0-9]+)'. _TESTS = [{. 'url': 'http://player.mais.uol.com.br/player_video_v3.swf?mediaId=15951931',. 'md5': '25291da27dc45e0afb5718a8603d3816',. 'info_dict': {. 'id': '15951931',. 'ext': 'mp4',. 'title': 'Miss simpatia . encontrada morta',. 'description': 'md5:3f8c11a0c0556d66daf7e5b45ef823b2',. }. }, {. 'url': 'http://tvuol.uol.com.br/video/incendio-destroi-uma-das-maiores-casas-noturnas-de-londres-04024E9A3268D4C95326',. 'md5': 'e41a2fb7b7398a3a46b6af37b15c00c9',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-1EKLV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2668
Entropy (8bit):	4.721301470920179
Encrypted:	false
SSDEEP:	48:PuuXUhQDkWtylGadfFkZVmhuBQXuXDErpeBFJgqdG2KXxWKQUfcZ64KPtZ918cfu:ZUhQDkWtYGaG6f6ErpybjKhPQScZgPtw
MD5:	6A60A81B1FAE7E6D439961C5CFA79097
SHA1:	904F3D9CF4C927E8877F0118A918F048841630D5
SHA-256:	49E36A60B044AE5F3F1132C3FFC877B47C497F5357404839247996ECF8A7E612
SHA-512:	840958911B41D3B1B00C6652BCFC19BD39063DE77CF69C4CEBCE50730DF8DC0372A7C2DE15A079F5AF9C5508063E7A485DDB930E9DD1440006E578EC606A560D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_duration,. int_or_none,.)...class XXXYMoviesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?xxxymovies\.com/videos/(?P<id>\d+)/(?P<display_id>[^/]+)'. _TEST = {. 'url': 'http://xxxymovies.com/videos/138669/ecstatic-orgasm-sofcore/',. 'md5': '810b1bdbbffff89dd13bdb369fe7be4b',. 'info_dict': {. 'id': '138669',. 'display_id': 'ecstatic-orgasm-sofcore',. 'ext': 'mp4',. 'title': 'Ecstatic Orgasm Sofcore',. 'duration': 931,. 'categories': list,. 'view_count': int,. 'like_count': int,. 'dislike_count': int,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). display_id = mobj.group('display_id').. webpage = self._download

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-1HUPM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8836
Entropy (8bit):	4.775665609345363
Encrypted:	false
SSDEEP:	192:Lubjky9sz3LOlmDo0INTVFs6Nk0svs++DS2JvnetvQCWRVXvk:I59snOlmDo0INTVFs6NRwV+DS2depQC1
MD5:	600351E65AC976D4DB6CD758D78C8BB6
SHA1:	22EDB93173AFBBA21BBD46113766951F9E3477EB
SHA-256:	00A78C6338C0BA0B12A4EDB587E05F264492B47E1F0248AAFE42796EFD78E603
SHA-512:	CD27EC5E13DDCA3941BE0A4051C9078051B6791F4768EE3CC049AC5BE89BEA8E4F5A77E8C70BA4818CA2512984571F15AE222AC4067431F780D406B7923E9E22
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hmac.import hashlib.import base64..from .common import InfoExtractor.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. js_to_json,. mimetype2ext,. parse_iso8601,. remove_start,.)...class NYTimesBaseIE(InfoExtractor):. _SECRET = b'pX(2MbU2);4N{7J8)>YwKRJ+/pQ3JkiU2Q^V>mFYv6g6gYvt6v'.. def _extract_video_from_id(self, video_id):. # Authorization generation algorithm is reverse engineered from `signer` in. # http://graphics8.nytimes.com/video/vhs/vhs-2.x.min.js. path = '/svc/video/api/v3/video/' + video_id. hm = hmac.new(self._SECRET, (path + ':vhs').encode(), hashlib.sha512).hexdigest(). video_data = self._download_json('http://www.nytimes.com' + path, video_id, 'Downloading video JSON', headers={. 'Authorization': 'NYTV ' + base64.b64encode(hm.encode()).decode(),. 'X-NYTV': 'vhs',. }, fatal=False). if not vide

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-1KOIQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2031
Entropy (8bit):	4.893143960863876
Encrypted:	false
SSDEEP:	48:+uPqfbfXnnDRkXNqvb7tfIXYBsgk6tYes43UBsGcDr+6Ng:LErXn9SsvFfRltYes42T6Ng
MD5:	72C92C9BA939622E60477D106E490820
SHA1:	11BFA76B73D26AAE3E4EDBEAE95564EAF0AF85A4
SHA-256:	74A1CD375D079BA0A892FDC9A2051A7DA08D0078D13FA02757F76F18A43D83DF
SHA-512:	0563AA77E3134EC7193EF4218EB8A3A03A5F9BF4699586609921CC59D9A802662D867E38E65A94B5FEF9E47D1B5C7788C3E36AD93D88C2A02E95346632DF47F3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str...class VyboryMosIE(InfoExtractor):. _VALID_URL = r'https?://vybory\.mos\.ru/(?:#precinct/\|account/channels\?.*?\bstation_id=)(?P<id>\d+)'. _TESTS = [{. 'url': 'http://vybory.mos.ru/#precinct/13636',. 'info_dict': {. 'id': '13636',. 'ext': 'mp4',. 'title': 're:^.......... ............. ........ .2231 [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': '......, ......, ..... ..........., 32.',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'http://vybory.mos.ru/account/channels?station_id=13636',. 'only_matching': True,. }].. def _real_extract(self, url):. station_id = self._match_id(url).. channels = self._download_json(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-1PLEU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2943
Entropy (8bit):	4.862374509820064
Encrypted:	false
SSDEEP:	48:+uuVUCQmzmAUen6aNvi/I5jXhkdXjKkUSLuXPexvT7gGgr6FtBo5quOhfqYoFjWc:qUCQOmAUs6aJt5aRW8H66F/VhcS2a8
MD5:	47B377E5FCB7C5BA35C287CAB88553AF
SHA1:	1CB3DD3049E9F7A06BCDE8E9C24C54A92735465B
SHA-256:	0BA175AC88CA46081F94AAA9680C08F41B70C468E68B995D3A0573EA22A220E7
SHA-512:	8798EC3D02AC8C7D7EA0674828BA441BF653C28AAF2722A948C43F3269660073B514F53BEB3B6AF3CA5A115D2004D8A68F4689169833DF4D40FD833E0AB87FBC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .brightcove import BrightcoveNewIE.from ..utils import (. int_or_none,. parse_age_limit,. smuggle_url,. unescapeHTML,.)...class VrakIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vrak\.tv/videos\?.*?\btarget=(?P<id>[\d.]+)'. _TEST = {. 'url': 'http://www.vrak.tv/videos?target=1.2306782&filtre=emission&id=1.1806721',. 'info_dict': {. 'id': '5345661243001',. 'ext': 'mp4',. 'title': 'Ob.sit., film de hockey et Roseline Filion',. 'timestamp': 1488492126,. 'upload_date': '20170302',. 'uploader_id': '2890187628001',. 'creator': 'VRAK.TV',. 'age_limit': 8,. 'series': 'ALT (Actualit. L.g.rement Tordue)',. 'episode': 'Ob.sit., film de hockey et Roseline Filion',. 'tags': list,. },. 'params': {. 'skip_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-1U8PF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	4.701210640472291
Encrypted:	false
SSDEEP:	48:+u41Fy5us7SXd/9ajXjlkvppkGcLuFfFQVSeuXHMnJSHKmzvq:E1Fgus7SXd/9aqTk9u95+aKmzS
MD5:	298A62204B742AC1EB2CDCE11179AAA7
SHA1:	1E9F0E6A57E7B56A8B319814D96A98C8D9D97749
SHA-256:	493D551E91617FD2352031E53F43076FE025AE2BD6F43791956B2CFF64901AC6
SHA-512:	4210400F8A971C808DF0DA474CD112F61D914BA22CB88FB82A288D3277F5E45EAF4AF6E774C8A8D6D20F473CC3AEBB07B3C21CB9BC87C2C732C64EFBD14ED0B8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. js_to_json,.)...class OnDemandKoreaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ondemandkorea\.com/(?P<id>[^/]+)\.html'. _GEO_COUNTRIES = ['US', 'CA']. _TEST = {. 'url': 'http://www.ondemandkorea.com/ask-us-anything-e43.html',. 'info_dict': {. 'id': 'ask-us-anything-e43',. 'ext': 'mp4',. 'title': 'Ask Us Anything : E43',. 'thumbnail': r're:^https?://.*\.jpg$',. },. 'params': {. 'skip_download': 'm3u8 download'. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id, fatal=False).. if not webpage:. # Page sometimes returns captcha page with HTTP 403. raise ExtractorError(. 'Unable to access page. You may have been blocked.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-1UMN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3674
Entropy (8bit):	4.652865843622039
Encrypted:	false
SSDEEP:	96:sEMqK9CPZ+87NieWz7RDxrEjxv79aC41Ul877WwfJsqp:svqA2fMeWz7wh74Cc2GJsY
MD5:	4DBB6A20B439B828853089DEBF297EE3
SHA1:	5199B82D383684885A726FE2C1588BC24E9B159D
SHA-256:	89846FA5FDD7FF4DD85C77902705532BE78D662B8BA7DFE3E6CA431F985F8A6C
SHA-512:	6D088453EA857BC68D173B78235A3D9B6332834904E8817309873D182571E660C879CF2ED74AC335380B6B5F82CC782268B8C87102B369B36AD03A5BA4935258
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .anvato import AnvatoIE.from .sendtonews import SendtoNewsIE.from ..compat import compat_urlparse.from ..utils import (. parse_iso8601,. unified_timestamp,.)...class CBSLocalIE(AnvatoIE):. _VALID_URL = r'https?://[a-z]+\.cbslocal\.com/(?:\d+/\d+/\d+\|video)/(?P<id>[0-9a-z-]+)'.. _TESTS = [{. # Anvato backend. 'url': 'http://losangeles.cbslocal.com/2016/05/16/safety-advocates-say-fatal-car-seat-failures-are-public-health-crisis',. 'md5': 'f0ee3081e3843f575fccef901199b212',. 'info_dict': {. 'id': '3401037',. 'ext': 'mp4',. 'title': 'Safety Advocates Say Fatal Car Seat Failures Are \'Public Health Crisis\'',. 'description': 'Collapsing seats have been the focus of scrutiny for decades, though experts say remarkably little has been done to address the issue. Randy Paige reports.',. 'thumbnail': 're:^https?://.*',. 'timestamp'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-221HI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4838
Entropy (8bit):	4.671964013175705
Encrypted:	false
SSDEEP:	96:4+yAs6Pfuru5BcCbWlFbtzFfJsqIrEDf/K7KvoieWBTP6NptTvOYWLhB:hyVc5BcCbUF5zFJsqI2ymvoieyTP6N+
MD5:	36B16C5F89DD5CFA90B59D1F3C726810
SHA1:	74BB5C40A64E3B26F4D892F2D771ACFB508B3F74
SHA-256:	360F218B7A02536A6006C2C29A6952F47FFDDF876B8058D7DE827A08D9676E22
SHA-512:	AE7D3ABB12F00BD9A09D38E6A56A940E6D3F78AAEE78A5A59EA980D7DED1DC099596AC3B93350074EE685DDF162D119B79E8958DAC61D05D4671727D63CE6CD1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .theplatform import ThePlatformIE.from ..utils import (. int_or_none,. parse_age_limit,. try_get,. update_url_query,.)...class AMCNetworksIE(ThePlatformIE):. _VALID_URL = r'https?://(?:www\.)?(?:amc\|bbcamerica\|ifc\|(?:we\|sundance)tv)\.com/(?:movies\|shows(?:/[^/]+)+)/(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'http://www.ifc.com/shows/maron/season-04/episode-01/step-1',. 'md5': '',. 'info_dict': {. 'id': 's3MX01Nl4vPH',. 'ext': 'mp4',. 'title': 'Maron - Season 4 - Step 1',. 'description': 'In denial about his current situation, Marc is reluctantly convinced by his friends to enter rehab. Starring Marc Maron and Constance Zimmer.',. 'age_limit': 17,. 'upload_date': '20160505',. 'timestamp': 1462468831,. 'uploader': 'AMCN',. },. 'params': {. # m3u8 download. 'skip_download'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-26BG3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2697
Entropy (8bit):	4.810687115253343
Encrypted:	false
SSDEEP:	48:+u2ZWb2slR8aFggwcv9EBx9STeaJoXjlhwXlaaywUuzcKM2tZnXRrKmTXRI08cHx:4WbblR8aFwcv9kx9STeaJsUP6dKD9pKU
MD5:	42C797C2492E625943351358F0C7025E
SHA1:	B9F53EA003E5EACDA2A3C6BBF1CA291056FCF6EB
SHA-256:	CB231A0D7B75356F6F2E752E2D7A641525CA1556571F625752336995DB54734C
SHA-512:	F27DBB40F8314631E9D597FBB76226936A7F57909EFF14ED7B63EC57E9A1F4DF89D7F53B9BD26AACA0DD8173C176842350FBE264C9BFD38C617A8718647D7414
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. parse_iso8601,.)...class AirMozillaIE(InfoExtractor):. _VALID_URL = r'https?://air\.mozilla\.org/(?P<id>[0-9a-z-]+)/?'. _TEST = {. 'url': 'https://air.mozilla.org/privacy-lab-a-meetup-for-privacy-minded-people-in-san-francisco/',. 'md5': '8d02f53ee39cf006009180e21df1f3ba',. 'info_dict': {. 'id': '6x4q2w',. 'ext': 'mp4',. 'title': 'Privacy Lab - a meetup for privacy minded people in San Francisco',. 'thumbnail': r're:https?://.*/poster\.jpg',. 'description': 'Brings together privacy professionals and others interested in privacy at for-profits, non-profits, and NGOs in an effort to contribute to the state of the ecosystem...',. 'timestamp': 1422487800,. 'upload_date': '20150128',. 'location': 'SFO Commons',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-29QK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3523
Entropy (8bit):	4.953665147272208
Encrypted:	false
SSDEEP:	96:LZfjb/FdpxFyem6mcSe3eEISPbPWHOe589ftN46M:FfvjoZc3eEISDP4FpJ
MD5:	DD614F81DCD6860CF9DE101AF1E8464B
SHA1:	6290C9275F02AEAC78BEC36F932D54EC594BDCB1
SHA-256:	F28319CC29CC26DA1685EA65AFA693C464FFD2D038749D61832E5B4969B979CB
SHA-512:	61E8803EEA3B00F3713ED83EC6863E4F02973898A34DDB22E8151DB25AF4DA4EA3EF410408E44413ED500AF752DAC30551D0E502B74468BFDA3BAE63514B5AB5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,. float_or_none,. get_element_by_class,. strip_or_none,. unified_timestamp,.)...class VRTIE(InfoExtractor):. IE_DESC = 'VRT NWS, Flanders News, Flandern Info and Sporza'. _VALID_URL = r'https?://(?:www\.)?(?P<site>vrt\.be/vrtnws\|sporza\.be)/[a-z]{2}/\d{4}/\d{2}/\d{2}/(?P<id>[^/?&#]+)'. _TESTS = [{. 'url': 'https://www.vrt.be/vrtnws/nl/2019/05/15/beelden-van-binnenkant-notre-dame-een-maand-na-de-brand/',. 'md5': 'e1663accf5cf13f375f3cd0d10476669',. 'info_dict': {. 'id': 'pbs-pub-7855fc7b-1448-49bc-b073-316cb60caa71$vid-2ca50305-c38a-4762-9890-65cbd098b7bd',. 'ext': 'mp4',. 'title': 'Beelden van binnenkant Notre-Dame, ..n maand na de brand',. 'description': 'Op maandagavond 15 april ging een deel van het dakgebinte van de Parijse kathedraal in vlammen op.',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2AHQU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2950
Entropy (8bit):	4.68809524360337
Encrypted:	false
SSDEEP:	48:PuWRb5fm5lDOmrBgBpYvNqvm+tPtfJulfFIjhBHMcuXH94CDQqLbR68dG7/QBTXT:rbBUDOeGfYvsvdVfJuWBHW94C8sRRdG0
MD5:	A139D841354C61FE1D73D5F5E79E39D7
SHA1:	104524D0EE0E1D22D75674BBE3F4F83E338AF924
SHA-256:	DB6E9E0A8E5FBC86AECB3D20B24BB2C0B5768107AE935CA6AB76091D2EEB3B10
SHA-512:	6E32675F127C6F67436FF254C9B4B667D8E24037FF3BF043BF113B1AAB18D7EDA1FE69D2E97028CB7B0C78E63A12FBE28407EFA96E35C75444FD100716D35413
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .youtube import YoutubeIE.from ..utils import (. int_or_none,. url_or_none,.)...class BreakIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?break\.com/video/(?P<display_id>[^/]+?)(?:-(?P<id>\d+))?(?:[/?#&]\|$)'. _TESTS = [{. 'url': 'http://www.break.com/video/when-girls-act-like-guys-2468056',. 'info_dict': {. 'id': '2468056',. 'ext': 'mp4',. 'title': 'When Girls Act Like D-Bags',. 'age_limit': 13,. },. }, {. # youtube embed. 'url': 'http://www.break.com/video/someone-forgot-boat-brakes-work',. 'info_dict': {. 'id': 'RrrDLdeL2HQ',. 'ext': 'mp4',. 'title': 'Whale Watching Boat Crashing Into San Diego Dock',. 'description': 'md5:afc1b2772f0a8468be51dd80eb021069',. 'upload_date': '20160331',. 'uploader': 'Steve Holden',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2BRG0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1540
Entropy (8bit):	4.845875098584299
Encrypted:	false
SSDEEP:	24:1R8lxrvbinCp7vr3tfgFsVxWoerJj4/R58Ve0wmEUvRtfCXjdRmzFIFP:Puxwo7T3tfVfWosCwbwmE2RtfCXjm8
MD5:	41F09CCB4824BFCED553CD001105E688
SHA1:	B7F197559116D5BEB6979FF599B24CA44D6FF6C4
SHA-256:	7D67C5C02C19EA6367969EE44BCC5C8A28543EA1BE635115C66A6E6D14265577
SHA-512:	21B6473E4FA16E2457BF7D2F5ADB5529DA28FB35BB1B985BE54629F1D1BC49324D3BA895E4F0DEA68DD15BB78C14375D9232F579610879B54D6BB8C600C5FF5C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import sys..from .common import InfoExtractor.from ..utils import ExtractorError...class CommonMistakesIE(InfoExtractor):. IE_DESC = False # Do not list. _VALID_URL = r'''(?x). (?:url\|URL)$. '''.. _TESTS = [{. 'url': 'url',. 'only_matching': True,. }, {. 'url': 'URL',. 'only_matching': True,. }].. def _real_extract(self, url):. msg = (. 'You\'ve asked youtube-dl to download the URL "%s". '. 'That doesn\'t make any sense. '. 'Simply remove the parameter in your command or configuration.'. ) % url. if not self._downloader.params.get('verbose'):. msg += ' Add -v to the command line to see what arguments and configuration youtube-dl got.'. raise ExtractorError(msg, expected=True)...class UnicodeBOMIE(InfoExtractor):. IE_DESC = False. _VALID_URL = r'(?P<bom>\ufeff)(?P<id>.*)$'.. # Disable test for python 3.2 since

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2BUTR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2299
Entropy (8bit):	4.926360398313947
Encrypted:	false
SSDEEP:	48:Puf0LfPhKWRJowNigUtxC3UON2HYsntfJoXjlh3BlCBgatRj4eu:HzpzfowIgUtxvOoHHfJszatV4eu
MD5:	224B77A244D69713F795A1585E3DF16E
SHA1:	B15B6DA52E2EC2370E1ED8A95109EF765EDC0513
SHA-256:	6FBED364BF4145D77B22626975EB7953579244DE1C512DC0456F5F71B2590203
SHA-512:	3EE43189CC448897FCB9824A510FE5B2867478DE191C477370CF3812008FF38F40413810884FD3AD1D9CA3D6C303364E68208490C56A0C03B8545F88A285481B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .kaltura import KalturaIE...class IncIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?inc\.com/(?:[^/]+/)+(?P<id>[^.]+).html'. _TESTS = [{. 'url': 'http://www.inc.com/tip-sheet/bill-gates-says-these-5-books-will-make-you-smarter.html',. 'md5': '7416739c9c16438c09fa35619d6ba5cb',. 'info_dict': {. 'id': '1_wqig47aq',. 'ext': 'mov',. 'title': 'Bill Gates Says These 5 Books Will Make You Smarter',. 'description': 'md5:bea7ff6cce100886fc1995acb743237e',. 'timestamp': 1474414430,. 'upload_date': '20160920',. 'uploader_id': 'video@inc.com',. },. 'params': {. 'skip_download': True,. },. }, {. # div with id=kaltura_player_1_kqs38cgm. 'url': 'https://www.inc.com/oscar-raymundo/richard-branson-young-entrepeneurs.html',. 'info_dict': {. 'id': '1_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2CO5E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7406
Entropy (8bit):	4.806934294203906
Encrypted:	false
SSDEEP:	192:kpg72PYeA6MDJLdKTP6NgTXruf3e9dzKTuHL6NyRIOMygv:kpgxl6MDpdKTP6NgTX6P+d+Tur6NyyVB
MD5:	BAF19C6407F29D2CBCB6018545DE47C4
SHA1:	08829D1F74F3317FC7971873681B6ED70376C0E2
SHA-256:	78971FA76390D83C9A10E933801E760152A7980C1C3C25BF52D5EC75AE110A49
SHA-512:	4AF2B00D58A70C0DE72B78717AEBEBB3DFC2506F37EF0310C3098F1B4EB76DBE7CA9CF2A0770650BDC0462B11C701DD2350819D78D9B7ED3CFC7AE77D2BDD56A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..aes import aes_cbc_decrypt.from ..compat import (. compat_b64decode,. compat_ord,. compat_str,.).from ..utils import (. bytes_to_intlist,. ExtractorError,. intlist_to_bytes,. int_or_none,. strip_or_none,.)...class RTL2IE(InfoExtractor):. IE_NAME = 'rtl2'. _VALID_URL = r'https?://(?:www\.)?rtl2\.de/sendung/[^/]+/(?:video/(?P<vico_id>\d+)[^/]+/(?P<vivi_id>\d+)-\|folge/)(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'http://www.rtl2.de/sendung/grip-das-motormagazin/folge/folge-203-0',. 'info_dict': {. 'id': 'folge-203-0',. 'ext': 'f4v',. 'title': 'GRIP sucht den Sommerk.nig',. 'description': 'md5:e3adbb940fd3c6e76fa341b8748b562f'. },. 'params': {. # rtmp download. 'skip_download': True,. },. 'expected_warnings': ['Unable to download f4m manifest', 'Fai

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2ELM5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	4.578216293800892
Encrypted:	false
SSDEEP:	96:ZmrkRznoft4o2d8IWfJasz2y9LhZ7dDKn2:0AEl6CJa8nJl
MD5:	995762B39ED58D5A6FDAB0E017AD2775
SHA1:	1C510933074CF715616F4545790680C5C0B9AECD
SHA-256:	C8B94769AA2A7A7B00EAF82D47FD7F4597FE30E6DC70477A31835ED4F6913656
SHA-512:	C469419681E26EFD7D37FB4D66B6882AA360FFFC00F7D7F6A3CD5136530C3B0D7BABA6C265BD6AD0E5BD2FAE99B4127FD7E55EC5B5B7BFFE3616C964371E5253
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class CloserToTruthIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?closertotruth\.com/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://closertotruth.com/series/solutions-the-mind-body-problem#video-3688',. 'info_dict': {. 'id': '0_zof1ktre',. 'display_id': 'solutions-the-mind-body-problem',. 'ext': 'mov',. 'title': 'Solutions to the Mind-Body Problem?',. 'upload_date': '20140221',. 'timestamp': 1392956007,. 'uploader_id': 'CTTXML'. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'http://closertotruth.com/episodes/how-do-brains-work',. 'info_dict': {. 'id': '0_iuxai6g6',. 'display_id': 'how-do-brains-work',. 'ext': 'mov',. 'title': 'How do Brains Work?',. 'upload

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2I9PJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.750358422690739
Encrypted:	false
SSDEEP:	48:PuFHAEV1fZ5TJYTg6tfjXjd41YM7TfcBoWg1Y8nhqlgkEhHrqZ1BPNg:yDHTJYTdfgYwJDYAhqlgkEhHr41BPNg
MD5:	B23B2492B86DE653EB294790401C5AA3
SHA1:	8DE736AA65552655048CB4D83B9700D4728383DB
SHA-256:	AD9AE692B208DB72ACAAF06BD7D1BD51A1D736CC5F5F7697CED814E2E97FCAC0
SHA-512:	1F61261F132BE3C2E0787C4A2A093A1D4082D9546A0ECE2F99CBDCE09EFB9CF2D0157120B8D183B22922B7B44C475718BA6FA4E88A8FA0D4DB65933908AF469F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. find_xpath_attr,. fix_xml_ampersands.)...class ClipsyndicateIE(InfoExtractor):. _VALID_URL = r'https?://(?:chic\|www)\.clipsyndicate\.com/video/play(list/\d+)?/(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.clipsyndicate.com/video/play/4629301/brick_briscoe',. 'md5': '4d7d549451bad625e0ff3d7bd56d776c',. 'info_dict': {. 'id': '4629301',. 'ext': 'mp4',. 'title': 'Brick Briscoe',. 'duration': 612,. 'thumbnail': r're:^https?://.+\.jpg',. },. }, {. 'url': 'http://chic.clipsyndicate.com/video/play/5844117/shark_attack',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). js_player = self._download_webpage(. 'http://eplayer.clipsyndicate.com/embed/player.js?va_id=%s' % video_id,. video_id, 'Downlaoding pla

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2JP7F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	12536
Entropy (8bit):	4.945925182182424
Encrypted:	false
SSDEEP:	384:HfconmgKrZndTS2AGRTu6NVD/9sY7M0xyA5fJGn9AvtGIgTx6Ng:EoBKr62AGRTu8H9B/GIgTx8g
MD5:	436E711A91172866AAB150C1C20D2E47
SHA1:	9F01DD5E9277CE9C5957AC27CC573E1D2EFAECEE
SHA-256:	E550DD96F8A590746060F4CD9522C762279BB116E407700DEECABE1D4AB33055
SHA-512:	82B53D7CD49FC6AFABEAA96BA8543AD57BD21D936B56016631F9777B96DD13FDF6528223F987D5B12F6D829D995A9DEE6B44C5BF8F9EF6D949D87ED51EDE891F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. get_element_by_id,. clean_html,. ExtractorError,. InAdvancePagedList,. remove_start,.)...class KuwoBaseIE(InfoExtractor):. _FORMATS = [. {'format': 'ape', 'ext': 'ape', 'preference': 100},. {'format': 'mp3-320', 'ext': 'mp3', 'br': '320kmp3', 'abr': 320, 'preference': 80},. {'format': 'mp3-192', 'ext': 'mp3', 'br': '192kmp3', 'abr': 192, 'preference': 70},. {'format': 'mp3-128', 'ext': 'mp3', 'br': '128kmp3', 'abr': 128, 'preference': 60},. {'format': 'wma', 'ext': 'wma', 'preference': 20},. {'format': 'aac', 'ext': 'aac', 'abr': 48, 'preference': 10}. ].. def _get_formats(self, song_id, tolerate_ip_deny=False):. formats = []. for file_format in self._FORMATS:. query = {. 'format': file_format['ext'],. 'br':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2KM8D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11017
Entropy (8bit):	4.642263120050363
Encrypted:	false
SSDEEP:	192:eU1QXNjN6s2FPOS9J26I24bmuKsTv/96NqvqhVQonrzrv+rM0Y8uJEgVs:EXNjN6sqPOS9JI24bXKsTn96NOqhVQou
MD5:	0E29430BD4925ED028CFA5A9DE5F79BE
SHA1:	DB36E4077BDD46401A05654F0B04DC5C6C519FDA
SHA-256:	4CB3287443E01032C92BA4C708EC1BDB0D1DBD785E76FB8A2BB2D926970CB688
SHA-512:	FA7FA307DAD6820EBC8F20BB4DA2E521B007EAFBB04C5F4C2ED81BC4BBA391CBF1722D4CC0AD3B2A8691B35EACF4EBA041F00A8FDB20781125EF8389B3C6C5AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import json.import re..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote.from ..utils import (. int_or_none,. parse_duration,. remove_end,. try_get,.)...class MailRuIE(InfoExtractor):. IE_NAME = 'mailru'. IE_DESC = '.....@Mail.Ru'. _VALID_URL = r'''(?x). https?://. (?:(?:www\|m)\.)?my\.mail\.ru/. (?:. video/.*\#video=/?(?P<idv1>(?:[^/]+/){3}\d+)\|. (?:(?P<idv2prefix>(?:[^/]+/){2})video/(?P<idv2suffix>[^/]+/\d+))\.html\|. (?:video/embed\|\+/video/meta)/(?P<metaid>\d+). ). '''. _TESTS = [. {. 'url': 'http://my.mail.ru/video/top#video=/mail/sonypicturesrus/75/76',. 'md5': 'dea205f03120046894db4ebb6159879a',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2L65B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	4.835891686776289
Encrypted:	false
SSDEEP:	48:+u6XMqfbR8hIN16aXEbR8tfjX0B71XEa+ACNvBT5B72A6Ng:+XVl8hIkaXElyfsXEBNvBT5B72A6Ng
MD5:	B9DFB4362E67919D56E8F6CE032F7BBE
SHA1:	248318840AEB32164DFE98F48A0505E371E27BFD
SHA-256:	59490B7E7A016AD50F4A80761796DA74269F6BF7E72C681CBA5EEF2E4C53FC88
SHA-512:	FE5EC9E4DCBED4C60CC7762F0A8584D6D8C3687C68CA9BE661D226E7E576B1567A1D0B7F5A95665A985D500D24262F39B67ADCA933CBA1D57313E79F612A41A0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import ExtractorError...class YinYueTaiIE(InfoExtractor):. IE_NAME = 'yinyuetai:video'. IE_DESC = '..Tai'. _VALID_URL = r'https?://v\.yinyuetai\.com/video(?:/h5)?/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://v.yinyuetai.com/video/2322376',. 'md5': '6e3abe28d38e3a54b591f9f040595ce0',. 'info_dict': {. 'id': '2322376',. 'ext': 'mp4',. 'title': '...._PARTY_Music Video Teaser',. 'creator': '....',. 'duration': 25,. 'thumbnail': r're:^https?://.*\.jpg$',. },. }, {. 'url': 'http://v.yinyuetai.com/video/h5/2322376',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. info = self._download_json(. 'http://ext.yinyuetai.com/main/get-h-mv-info?json=true&videoId=%s' % video_id, video_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2LK22.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3767
Entropy (8bit):	4.504400938410313
Encrypted:	false
SSDEEP:	96:IMOs6EbhXNIOcHiWxoDBTeoUT1UUQX+v91WNs6NPW:BOs6ErIOcHiqolTxL+D6NPW
MD5:	E8475744E2DA2A0B5E3A19226F15D379
SHA1:	FF2D399BB807C40029BA0675D7563EE0EB83555C
SHA-256:	E0229B0BCBE67F41C48EB12DC5C586A734010CF66A1FD3DE2F1837CA7D9CE390
SHA-512:	82A3532243303A2613949708AF13CA31C91A9FFECAEC66453165751EC6A1E8AF950B0661049B0A223F54823D089E514A361C10F2B820E783F0C8B1A6BC400BAB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_iso8601,. float_or_none,. ExtractorError,. int_or_none,.)...class NineCNineMediaIE(InfoExtractor):. IE_NAME = '9c9media'. _GEO_COUNTRIES = ['CA']. _VALID_URL = r'9c9media:(?P<destination_code>[^:]+):(?P<id>\d+)'. _API_BASE_TEMPLATE = 'http://capi.9c9media.com/destinations/%s/platforms/desktop/contents/%s/'.. def _real_extract(self, url):. destination_code, content_id = re.match(self._VALID_URL, url).groups(). api_base_url = self._API_BASE_TEMPLATE % (destination_code, content_id). content = self._download_json(api_base_url, content_id, query={. '$include': '[Media,Season,ContentPackages]',. }). title = content['Name']. if len(content['ContentPackages']) > 1:. raise ExtractorError('multiple content packages'). content_package = content['ContentPackages'][0].

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2NCSJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4628
Entropy (8bit):	4.717624433140512
Encrypted:	false
SSDEEP:	96:rOcxsjJjqpCbrwzvbTqy8LF75vfKeIQeJkJ02xPdr3zmjsl2oBTmOj5Wxiz3ZXTF:acQJjmiwbHqy8LF7hKFtePdr3zAsl2or
MD5:	760816652C5CFEFC9EFE2E3499680862
SHA1:	38AF8205B92138F1E758746A4835A02438C82CDE
SHA-256:	0A0C4E9067B7CFA36A38ADCD9A92BEA61FFF1E03EA2BF834B5A03C841A52C456
SHA-512:	FE523D60D79F44DCE06197BFF68846F70921441567CDC88420B77B8E8F0FCCE4EB8393718C0F01330C8919D9D4EED4196F9260248DF793FF6CB78A2CDD2C25C6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. unescapeHTML,.)...class MSNIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?msn\.com/(?:[^/]+/)+(?P<display_id>[^/]+)/[a-z]{2}-(?P<id>[\da-zA-Z]+)'. _TESTS = [{. 'url': 'http://www.msn.com/en-ae/foodanddrink/joinourtable/criminal-minds-shemar-moore-shares-a-touching-goodbye-message/vp-BBqQYNE',. 'md5': '8442f66c116cbab1ff7098f986983458',. 'info_dict': {. 'id': 'BBqQYNE',. 'display_id': 'criminal-minds-shemar-moore-shares-a-touching-goodbye-message',. 'ext': 'mp4',. 'title': 'Criminal Minds - Shemar Moore Shares A Touching Goodbye Message',. 'description': 'md5:e8e89b897b222eb33a6b5067a8f1bc25',. 'duration': 104,. 'uploader': 'CBS Entertainment',. 'uploader

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2NUND.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	28194
Entropy (8bit):	4.607071252095226
Encrypted:	false
SSDEEP:	768:Ko6+Sg5sso2o83O8Ms81B1TU8SPCC+8nXWWPhuGSOln3MUA5mOMid4VSahTQZ8ue:Ko6+Sg5sso2o83O8Ms81B1TU8SPCCnn/
MD5:	523AD9F68CD3968910C75D217EFF1B57
SHA1:	E340D0F75D481FEC74A8A6CF7FF6AC8E91602309
SHA-256:	5D3DF9AE0DD639AFA73047E46125393ED119D650808234230B6F2A66631DCD81
SHA-512:	B050E691A19796804567B357C938FD2C3F10442FDB639FF452AA9DF5ADE40A41645928FA0852AE71013FF49CC0A901455CB721883C5E552C54211814A803B4B9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. determine_ext,. ExtractorError,. fix_xml_ampersands,. int_or_none,. merge_dicts,. orderedSet,. parse_duration,. qualities,. str_or_none,. strip_jsonp,. unified_strdate,. unified_timestamp,. url_or_none,. urlencode_postdata,.)...class NPOBaseIE(InfoExtractor):. def _get_token(self, video_id):. return self._download_json(. 'http://ida.omroep.nl/app.php/auth', video_id,. note='Downloading token')['token']...class NPOIE(NPOBaseIE):. IE_NAME = 'npo'. IE_DESC = 'npo.nl, ntr.nl, omroepwnl.nl, zapp.nl and npo3.nl'. _VALID_URL = r'''(?x). (?:. npo:\|. https?://. (?:www\.)?. (?:. npo\.nl/(?:[^/]+/)*

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2OECQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3903
Entropy (8bit):	4.774902913940402
Encrypted:	false
SSDEEP:	96:GxlG74VbXv8p7ulGIjYdIBTY8S6vgtq6N1tonydndMDsjdYrVdKLdGJBTKxFNN3L:G+MV4MlGIcdITJB6N1toydndMA4dKLdl
MD5:	C7A5D0E98D234ECF932BF4D19248D3B0
SHA1:	0522ED6241F40FD68B926992B685F23C1870808C
SHA-256:	FAF9527859763A6F778A8A88127AA813109C71BC6D403EE0090FBA4007CC1BEB
SHA-512:	A6E7EBBD99D75E3B1BD6C8A76DE4F868837083D1AA2E8FC2DE7C80443F89C893766F88ABEAC849316FA79832E872150EE3C7F648F7E3FC95AD064D78081876CF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class ABCOTVSIE(InfoExtractor):. IE_NAME = 'abcotvs'. IE_DESC = 'ABC Owned Television Stations'. _VALID_URL = r'https?://(?:abc(?:7(?:news\|ny\|chicago)?\|11\|13\|30)\|6abc)\.com(?:/[^/]+/(?P<display_id>[^/]+))?/(?P<id>\d+)'. _TESTS = [. {. 'url': 'http://abc7news.com/entertainment/east-bay-museum-celebrates-vintage-synthesizers/472581/',. 'info_dict': {. 'id': '472581',. 'display_id': 'east-bay-museum-celebrates-vintage-synthesizers',. 'ext': 'mp4',. 'title': 'East Bay museum celebrates vintage synthesizers',. 'description': 'md5:24ed2bd527096ec2a5c67b9d5a9005f3',. 'thumbnail': r're:^https?://.*\.jpg$',. 'timestamp': 1421123075,. 'upload_date': '20150113',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2PO97.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5068
Entropy (8bit):	4.8684127985839565
Encrypted:	false
SSDEEP:	96:7t9MgXu08ILzoIQuR/va84l0S3G7zgPGRtukyS/aZ0dGY4KtdUyXysNsPW:B0c2CddSgzgPiEkyCGY5MyXDNsO
MD5:	617430C19AC774C425585C3A1B90A486
SHA1:	7B001C5C80AF9BE558AAE1474198B0E480215EA6
SHA-256:	6871864C1C605DF9BB147FFD45D642DA035E2CD86406B145F9C4810A49C98E3E
SHA-512:	D2C8E272584426449DB4B57E2ED5A01A6B216B2850C07A041B5E0F9DB610998FD47A21C30D3D153A6BC1C814069C393D04EC7F1803B9BCE5A6EB8082E097330C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. xpath_text,. int_or_none,. ExtractorError,. sanitized_Request,.)...class MioMioIE(InfoExtractor):. IE_NAME = 'miomio.tv'. _VALID_URL = r'https?://(?:www\.)?miomio\.tv/watch/cc(?P<id>[0-9]+)'. _TESTS = [{. # "type=video" in flashvars. 'url': 'http://www.miomio.tv/watch/cc88912/',. 'info_dict': {. 'id': '88912',. 'ext': 'flv',. 'title': '.SKY... ....VS.. ......FEAT.. ..... ..',. 'duration': 5923,. },. 'skip': 'Unable to load videos',. }, {. 'url': 'http://www.miomio.tv/watch/cc184024/',. 'info_dict': {. 'id': '43729',. 'title': '..........',. },. 'playlist_mincount': 86,. 'skip': 'Unable to load vid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2R1FA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18471
Entropy (8bit):	4.708639692577113
Encrypted:	false
SSDEEP:	384:kSSQyLgPvS6bwLtuOWji9ucb8V6NYuqeAO/SvF+i/FOuLyLoXL27nvOfOdIkyzn4:oj0y6bOWji9Xb8V8aFLykXRKuTgDzksd
MD5:	485516C32A5FB521728C039D6057464B
SHA1:	F78E3A112236C42D13E3C44435EB7C64ECF671B1
SHA-256:	E7F032E40B9A28C54FC0A882B63B58AED47720E46D2585A5397B7A24B3B318CF
SHA-512:	1BA200C7951F158B736CFC62510D3759C6BBACBB2F125F2F04E09F5E935F420D1A25ADCF41D72E207E677AEEA731997A10199E46524CAB0A7519AA6AD857BD59
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urlparse,. compat_str,.).from ..utils import (. ExtractorError,. determine_ext,. find_xpath_attr,. fix_xml_ampersands,. GeoRestrictedError,. int_or_none,. parse_duration,. strip_or_none,. try_get,. unescapeHTML,. unified_strdate,. unified_timestamp,. update_url_query,. urljoin,. xpath_text,.)...class RaiBaseIE(InfoExtractor):. _UUID_RE = r'[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}'. _GEO_COUNTRIES = ['IT']. _GEO_BYPASS = False.. def _extract_relinker_info(self, relinker_url, video_id):. if not re.match(r'https?://', relinker_url):. return {'formats': [{'url': relinker_url}]}.. formats = []. geoprotection = None. is_live = None. duration = None.. for platform in ('mon', 'flash', 'native'):. relinker = self._download_xml(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2S374.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	5.018939124125765
Encrypted:	false
SSDEEP:	24:zi8lNFBGSeowJZ5zYl0ET/wdl+ow9VTa3CZ4OaJoXhhgM1LG:+upXeoi/6bww9k3FOaJoXhhg8LG
MD5:	4DDEA9C2222319B95B568BAE35AE8064
SHA1:	EF982E5E7A4FB5614E56BA458ADE5D3AEB3C10FD
SHA-256:	1D9F61140B63AEDD3059E6535835828BE9E6379783AD8A33D6A7B6E12ADCFB05
SHA-512:	4D0A97148AA0458148DA321FD27EE9D8D7DFD4E847F852AD9F5D9CBDD026A2A4D2978D9B9B18D5A46E9F5C835887385C079D3AB7D5B6C6552B0652FA90DE5438
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .onet import OnetBaseIE...class ClipRsIE(OnetBaseIE):. _VALID_URL = r'https?://(?:www\.)?clip\.rs/(?P<id>[^/]+)/\d+'. _TEST = {. 'url': 'http://www.clip.rs/premijera-frajle-predstavljaju-novi-spot-za-pesmu-moli-me-moli/3732',. 'md5': 'c412d57815ba07b56f9edc7b5d6a14e5',. 'info_dict': {. 'id': '1488842.1399140381',. 'ext': 'mp4',. 'title': 'PREMIJERA Frajle predstavljaju novi spot za pesmu Moli me, moli',. 'description': 'md5:56ce2c3b4ab31c5a2e0b17cb9a453026',. 'duration': 229,. 'timestamp': 1459850243,. 'upload_date': '20160405',. }. }.. def _real_extract(self, url):. display_id = self._match_id(url).. webpage = self._download_webpage(url, display_id).. mvp_id = self._search_mvp_id(webpage).. info_dict = self._extract_from_id(mvp_id, webpage). info_dict['display_id'] = display

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2TSQJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	29072
Entropy (8bit):	4.651326725741445
Encrypted:	false
SSDEEP:	768:ycNleYUqsH1mcyq8q9Uw9GEyoI4xswOUde/OIN8Tph/bX8B0d:yOeYUqsH1mTq86Uw9GEyoI4xswOUde/g
MD5:	9EF3285C42382FDBC1E3C9BEE57A0516
SHA1:	075ECAC90A63A2C1FA7AA50D6BFA1AE614A6117E
SHA-256:	E85EB49427618F7014437B6762BE04A66E740FA708BB7EFBEA634DA27A2D5500
SHA-512:	3F0AF2CA56E5F2A577006C1017814280B3C9D6F8A25663E10DD3521C0163A0CFE3A3161B21C28F4BCD928A8A3B3A3296E7CC29E1F7C007B02C2BE873B4C21646
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import json.import zlib..from hashlib import sha1.from math import pow, sqrt, floor.from .common import InfoExtractor.from .vrv import VRVIE.from ..compat import (. compat_b64decode,. compat_etree_Element,. compat_etree_fromstring,. compat_urllib_parse_urlencode,. compat_urllib_request,. compat_urlparse,.).from ..utils import (. ExtractorError,. bytes_to_intlist,. extract_attributes,. float_or_none,. intlist_to_bytes,. int_or_none,. lowercase_escape,. remove_end,. sanitized_Request,. unified_strdate,. urlencode_postdata,. xpath_text,.).from ..aes import (. aes_cbc_decrypt,.)...class CrunchyrollBaseIE(InfoExtractor):. _LOGIN_URL = 'https://www.crunchyroll.com/login'. _LOGIN_FORM = 'login_form'. _NETRC_MACHINE = 'crunchyroll'.. def _call_rpc_api(self, method, video_id, note=None, data=None):. data = data or {}. data['req'] = 'RpcApi' + meth

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2U854.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	4.8684164371388965
Encrypted:	false
SSDEEP:	48:+uL1ef0J1piOsXjYNCWdIodt1m4xXjXN8fJoXhh6B35+8e47:nqg1pTsXjY0iIodLm4xXjXqfJa+08e47
MD5:	114A6340C9DE19754693F53023E6A16F
SHA1:	55C075AF6EFA2C579ADDB1DBB67F1309025DCD8A
SHA-256:	3DEBECC2FA0004D4DDEA38B8E1AA293F69E1B87FBAB5DAD2FB3501D303078754
SHA-512:	1D6A24A3096F6651D34F2688435714E924E8185CC4DA9EF2C855C12CE28A2F4E922410B0BE7BEC5FADC0AD28E85CD5DF51200420A05FAED807FE4F5AB34C6501
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class LentaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lenta\.ru/[^/]+/\d+/\d+/\d+/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://lenta.ru/news/2018/03/22/savshenko_go/',. 'info_dict': {. 'id': '964400',. 'ext': 'mp4',. 'title': '....... ........ .........',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 61,. 'view_count': int,. },. 'params': {. 'skip_download': True,. },. }, {. # EaglePlatform iframe embed. 'url': 'http://lenta.ru/news/2015/03/06/navalny/',. 'info_dict': {. 'id': '227304',. 'ext': 'mp4',. 'title': '......... ..... .. .......',. 'description': 'md5:d97861ac9ae77377f3f20eaf9d04b4f5',. 'thumbnail': r're:^https?://.\.jpg$',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-2V85G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	13646
Entropy (8bit):	5.07143618173297
Encrypted:	false
SSDEEP:	384:Fbi4fJ3wM4VTwTU6NUnTlQZq6MUZIogeTQaY6M:DJ3FyTwTU8UnRx6MU2ec6M
MD5:	D1136FAD1994DBA07C10220AAAF4452B
SHA1:	BB9758F9754BAA87483B9332A47E85BDA8E4EA88
SHA-256:	18967696D4D5F72F1CCBE1112EF92D8BDC3F4AD9E8B3E282CE8AF2C82B21353F
SHA-512:	8430BBEEE9E6C082AE24316641A989DEB7E0B65F16F2CAD8A84F6B17E13586830743567EF11C109C25A06973DB5C2A437508AC60F344B381EB426CFA0A0B92F2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random.import re.import time..from .common import InfoExtractor.from ..utils import (. clean_html,. ExtractorError,. strip_jsonp,. unescapeHTML,.)...class QQMusicIE(InfoExtractor):. IE_NAME = 'qqmusic'. IE_DESC = 'QQ..'. _VALID_URL = r'https?://y\.qq\.com/n/yqq/song/(?P<id>[0-9A-Za-z]+)\.html'. _TESTS = [{. 'url': 'https://y.qq.com/n/yqq/song/004295Et37taLD.html',. 'md5': '5f1e6cea39e182857da7ffc5ef5e6bb8',. 'info_dict': {. 'id': '004295Et37taLD',. 'ext': 'mp3',. 'title': '.....',. 'release_date': '20141227',. 'creator': '...',. 'description': 'md5:d85afb3051952ecc50a1ee8a286d1eac',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }, {. 'note': 'There is no mp3-320 version of this song.',. 'url': 'https://y.qq.com/n/yqq/song/004MsGEo3DdNxV.html',. 'md5': 'fa

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-31JUR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9267
Entropy (8bit):	4.645796849216703
Encrypted:	false
SSDEEP:	192:FuoC9nc+qco5ZdFnTAz6N0jjmvG7vzAo0pBWZ8koTGoA6No:Fuo6nc+Zo5ZdFnTU6N0jj8Gbzj0pBWZV
MD5:	824399BA2BC0B8453C825625A5898131
SHA1:	D04671DFEF347E4A13159D3970CC1ECFB7B0FFA6
SHA-256:	F7CF7EB6BE0C1B01209DC9AE24DA943EF95DCD7C62DCE14BA59E38DEF3BF0148
SHA-512:	42755D8A91E90FEB15EB0E970A83EBF85D788978CEE2F204B65BD157D21A770CCF54B0FBB3603C50CEFC113769C61A6BDAE93CF18EB19B5EB1DBAEA5C6382B43
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_kwargs,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,.)...class ViuBaseIE(InfoExtractor):. def _real_initialize(self):. viu_auth_res = self._request_webpage(. 'https://www.viu.com/api/apps/v2/authenticate', None,. 'Requesting Viu auth', query={. 'acct': 'test',. 'appid': 'viu_desktop',. 'fmt': 'json',. 'iid': 'guest',. 'languageid': 'default',. 'platform': 'desktop',. 'userid': 'guest',. 'useridtype': 'guest',. 'ver': '1.0'. }, headers=self.geo_verification_headers()). self._auth_token = viu_auth_res.info()['X-VIU-AUTH'].. def _call_api(self, path, args, *kwargs):. headers = self.geo_verification_headers(). headers.update

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-31UBB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2020
Entropy (8bit):	4.87001094018862
Encrypted:	false
SSDEEP:	48:PupXCfF67YXeXB99lGXEF40tfVpGWZnr28n4zjlDTly80svw:wX8G6eXB9nG0CKfyvb1DxF0sY
MD5:	0E156C3E7E7EF83B2FBB79BF1134295C
SHA1:	CA6BDED4C3631CCCD60B0D90164C88B38CB39F52
SHA-256:	95C55929668DC8EA860F97EA331CBACEE0890A36CB4E6DB4FA2222BCA89DBFAF
SHA-512:	50E667F37906DD13402717B2D00EA66AC7BB9D5FFF8FADADD01D008435B6ABCE5BD6E78E4CBFD27A21041391F14E8B4538CBDE565293534627566BAF64EBC70F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..utils import (. int_or_none,. str_to_int,. unified_strdate,.).from .keezmovies import KeezMoviesIE...class MofosexIE(KeezMoviesIE):. _VALID_URL = r'https?://(?:www\.)?mofosex\.com/videos/(?P<id>\d+)/(?P<display_id>[^/?#&.]+)\.html'. _TESTS = [{. 'url': 'http://www.mofosex.com/videos/318131/amateur-teen-playing-and-masturbating-318131.html',. 'md5': '558fcdafbb63a87c019218d6e49daf8a',. 'info_dict': {. 'id': '318131',. 'display_id': 'amateur-teen-playing-and-masturbating-318131',. 'ext': 'mp4',. 'title': 'amateur teen playing and masturbating',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20121114',. 'view_count': int,. 'like_count': int,. 'dislike_count': int,. 'age_limit': 18,. }. }, {. # This video is no longer available. 'url': 'http://www.mofosex.com/videos

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-33N6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	4.860110414173715
Encrypted:	false
SSDEEP:	24:1R8lFvbBcuKa6uhwUA+4P/LdlejGglqxqpaeIXhgtmGBnttMhDcehDCehDU5aBxn:PuzfKhuhz/4nLCGxqpajXhk/nttMVzVd
MD5:	2802024D21B3CC69437C21ACC30527F3
SHA1:	2978F6AB20F6AC56419B7DF875D537753493399E
SHA-256:	ECCA7664EBBB69B05B3FECEDF41B7C92E9A3FC52F1789C4169214EBF90BAFC16
SHA-512:	423727B6134065AE1B2828905E1751D0427001523FC9747A24C00A6F3EF264E311375FE369234248F87DB77E13DB15D1C0252AD7D5016A62891DD89A679E99B4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote...class Ro220IE(InfoExtractor):. IE_NAME = '220.ro'. _VALID_URL = r'(?x)(?:https?://)?(?:www\.)?220\.ro/(?P<category>[^/]+)/(?P<shorttitle>[^/]+)/(?P<id>[^/]+)'. _TEST = {. 'url': 'http://www.220.ro/sport/Luati-Le-Banii-Sez-4-Ep-1/LYV6doKo7f/',. 'md5': '03af18b73a07b4088753930db7a34add',. 'info_dict': {. 'id': 'LYV6doKo7f',. 'ext': 'mp4',. 'title': 'Luati-le Banii sez 4 ep 1',. 'description': r're:^Iata-ne reveniti dupa o binemeritata vacanta\. +Va astept si pe Facebook cu pareri si comentarii.$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). url = compat_urllib_parse_unquote(self._search_regex(. r'(?s)clip\s:\s{.?url\s:\s*\'([^\']+)\'', webpage, 'url')). title =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-38DHG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2937
Entropy (8bit):	5.059480778407889
Encrypted:	false
SSDEEP:	48:+uOjnEYOSvaOtIajXjlkqXwdx6oGYiuGYkKWxYsmj4wewhlOrXnlYDO2Bo+iND0k:ajE/aaOtIaqhdsVnKYmj4XwAjAOH+i+k
MD5:	58FF1F687778E043B420515EBF1B58B2
SHA1:	5645997A85D496539C8A64A2B72281E75A3BE560
SHA-256:	601B0696278D3D717E19F0E25305DAC1B4859E9D55744DF014FF66B0B1BCC1F7
SHA-512:	78AFA1688C016A97C9800BC709239F4E2D20C31F149FF2094C73C072582B9D7EA75A187E76D80797FBC71784BC851D0BA287472DED0005431C069D7B3D6FB142
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time..from .common import InfoExtractor.from ..compat import (. compat_ord,.).from ..utils import (. int_or_none,. parse_duration,.)...class XMinusIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?x-minus\.org/track/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://x-minus.org/track/4542/%D0%BF%D0%B5%D1%81%D0%B5%D0%BD%D0%BA%D0%B0-%D1%88%D0%BE%D1%84%D0%B5%D1%80%D0%B0.html',. 'md5': '401a15f2d2dcf6d592cb95528d72a2a8',. 'info_dict': {. 'id': '4542',. 'ext': 'mp3',. 'title': '...... ......-....... ......',. 'duration': 156,. 'tbr': 320,. 'filesize_approx': 5900000,. 'view_count': int,. 'description': 'md5:03238c5b663810bc79cf42ef3c03e371',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-38KR6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2255
Entropy (8bit):	4.737086000642958
Encrypted:	false
SSDEEP:	48:Pu+WFrzOf0XdOBdTntPpJulfFIifIkkAfL5UAaURdDU5iqS8OlTJBTSgCWh6Ng:bk/OsXdOBdbtPpJueCL5xIiqS8OllBTb
MD5:	F34961F879EC667081C745CDA8216713
SHA1:	B3B1C44F62C841572CC96F85D33DDDEA582A08EE
SHA-256:	F61F1B74F1CFBEF5A87656565B6110184331D544725DC40479A953FFD8534FD1
SHA-512:	5F8FDE223A1D6651A05CEE568688B4EE678B72A15C0B892D3DD5A92D3BD70B601C2AA84ADEF8DDA9052B294DA2181A7DF1C620D23447601CCC954CCB130BE4E2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import unified_strdate...class DFBIE(InfoExtractor):. IE_NAME = 'tv.dfb.de'. _VALID_URL = r'https?://tv\.dfb\.de/video/(?P<display_id>[^/]+)/(?P<id>\d+)'.. _TEST = {. 'url': 'http://tv.dfb.de/video/u-19-em-stimmen-zum-spiel-gegen-russland/11633/',. 'md5': 'ac0f98a52a330f700b4b3034ad240649',. 'info_dict': {. 'id': '11633',. 'display_id': 'u-19-em-stimmen-zum-spiel-gegen-russland',. 'ext': 'mp4',. 'title': 'U 19-EM: Stimmen zum Spiel gegen Russland',. 'upload_date': '20150714',. },. }.. def _real_extract(self, url):. display_id, video_id = re.match(self._VALID_URL, url).groups().. player_info = self._download_xml(. 'http://tv.dfb.de/server/hd_video.php?play=%s' % video_id,. display_id). video_info = player_info.find('video'). stream_access_url =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-39FCG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1275
Entropy (8bit):	4.826499270175673
Encrypted:	false
SSDEEP:	24:zi8lFv6GDlgwa3K6/5ddlgtZGcQCgaeIXjlgt9BgeJaGhDceqeBgeYMORlLSARLc:+uEolgb5dTcXgajXjlk9BgpGVzqeBgGn
MD5:	8AF204D3B251E4D2B8E0DAE6B62AAD1C
SHA1:	E35DB97D4C1A70C6FF746208D13189C9C81F5436
SHA-256:	AE2A399AEDBBDF2A45C232311EE8AE69467829B227B934B7D1020577FDC3D3C5
SHA-512:	6FE968EDFCC5E3A919BEF942EA9755C899A59B0FD0766208E5F4CA78F1E752D37074B1E0B57E51DC8957D744D94DFCA7C8CC12FEED88F21BC9C43AD0B02C4C89
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class CriterionIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?criterion\.com/films/(?P<id>[0-9]+)-.+'. _TEST = {. 'url': 'http://www.criterion.com/films/184-le-samourai',. 'md5': 'bc51beba55685509883a9a7830919ec3',. 'info_dict': {. 'id': '184',. 'ext': 'mp4',. 'title': 'Le Samoura.',. 'description': 'md5:a2b4b116326558149bef81f76dcbb93f',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. final_url = self._search_regex(. r'so\.addVariable$"videoURL", "(.+?)"$\;', webpage, 'video url'). title = self._og_search_title(webpage). description = self._html_search_meta('description', webpage). thumbnail = self._search_regex(. r'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3AP7M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4501
Entropy (8bit):	4.740393500544283
Encrypted:	false
SSDEEP:	96:2mbDsNd96PR17DXDMc9m9dTsyrc31nqPI/sKkH6oO1cW1tj/uBTKxtJ6Ng:2rd9q1DM0m/sygqPtKkvO1P1tj/6TKPF
MD5:	D85CBBA238EC135DEBE9249A631B4D4B
SHA1:	D7622E833D27988012FA4CCCB01DFB68163168D8
SHA-256:	CB33A93161B5DA5BDBDBFF4AA66442C71249513AAD840CC57938BBF2284D603A
SHA-512:	59CF91100016C22447080DAC0DB907916A4A0D9ED94D1B4B2D8583800AC236F1902D3241E3F2F5AB24CF54E76A7E3DC0C6DD67824B0CBC18B4B3E7335C8A175E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. dict_get,. int_or_none,. unescapeHTML,. parse_iso8601,.)...class PikselIE(InfoExtractor):. _VALID_URL = r'https?://player\.piksel\.com/v/(?P<id>[a-z0-9]+)'. _TESTS = [. {. 'url': 'http://player.piksel.com/v/nv60p12f',. 'md5': 'd9c17bbe9c3386344f9cfd32fad8d235',. 'info_dict': {. 'id': 'nv60p12f',. 'ext': 'mp4',. 'title': '.. ...... - ...... 1',. 'description': '.... ..... ....... ........ " ..... .... " .. ..... 2016... ...... ...',. 'timestamp': 1465231790,. 'upload_date': '20160606',. }. },. {. # Original source: http://www.uscourts.gov/cameras-courts/state-washing

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3ECV5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2374
Entropy (8bit):	4.677806775147921
Encrypted:	false
SSDEEP:	48:+usPm5W9N8CJ5rD1fJoXjlhn0P9Y08uQ4ufYv8ORH:wPm5WHr5rVJsn0FzbbTB
MD5:	21E1DEFA9606B84CE44F6CBE70D61B3E
SHA1:	F2DEFEF81022DCC4F9BB198987C103B3DF24E230
SHA-256:	59CB0A1CEA74746A24108739F75D6CB2B5398374DF2695545A91A1F7BC1C2B17
SHA-512:	9B753615ED26D918920A58112E7D6DDF78B5C35448A1F6AA3A96DCB7757134AA05CCD14E81884B40E3E867DC2BFD0C81021C043101E7B6A3F5300662BE7FA71A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .turner import TurnerBaseIE.from ..utils import int_or_none...class CartoonNetworkIE(TurnerBaseIE):. _VALID_URL = r'https?://(?:www\.)?cartoonnetwork\.com/video/(?:[^/]+/)+(?P<id>[^/?#]+)-(?:clip\|episode)\.html'. _TEST = {. 'url': 'https://www.cartoonnetwork.com/video/ben-10/how-to-draw-upgrade-episode.html',. 'info_dict': {. 'id': '6e3375097f63874ebccec7ef677c1c3845fa850e',. 'ext': 'mp4',. 'title': 'How to Draw Upgrade',. 'description': 'md5:2061d83776db7e8be4879684eefe8c0f',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id).. def find_field(global_re, name, content_re=None, value_re='[^"]+', fatal=False):. metadata_re = ''. if content_re:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3FD16.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2587
Entropy (8bit):	4.784928682084195
Encrypted:	false
SSDEEP:	48:PuufmaT2dGYLfEajXkPy99xUFy9CXw6XkMaHEe4X3dNLI0aO4gEBHBKTqt/8cI6u:hmaadLLfEa19nUU9X7MCEeKdNk0aO4gv
MD5:	CAF8086329AF11F681475ABD9A063CE2
SHA1:	798212796C0F64B0CF2965465475F35DFF8E08DB
SHA-256:	93103E648CFDF506570A05D0ED52896F76F7BE52C39FE3FC413E8C52BA4EA9F0
SHA-512:	B4847C4F78E8027F6DA1A80DA457C2AE821767432FDBFB3FB50D8BDEBD59F9C0E40635C837031852FEED68A8EF0ECF5A0DE46FE198B874FF103874ED6BD7841F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_duration,.)...class NuvidIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\|m)\.nuvid\.com/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://m.nuvid.com/video/1310741/',. 'md5': 'eab207b7ac4fccfb4e23c86201f11277',. 'info_dict': {. 'id': '1310741',. 'ext': 'mp4',. 'title': 'Horny babes show their awesome bodeis and',. 'duration': 129,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. page_url = 'http://m.nuvid.com/video/%s' % video_id. webpage = self._download_webpage(. page_url, video_id, 'Downloading video page'). # When dwnld_speed exists and has a value larger than the MP4 file's. # bitrate, Nuvid returns the MP4 URL. # It's unit is 100bytes/millisecond, see mobile-nuvid-min.js for t

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3FHU0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3098
Entropy (8bit):	4.633622597409986
Encrypted:	false
SSDEEP:	96:7K9epBnVOyBEN8aJ6d6vj0zcazjKGXF6Ng:m9MVtaCaJ6d8Pa6w6Ng
MD5:	FCBB875C9B04D9D3F8B8DA09A305FD90
SHA1:	99A1E46A8090044C70E5D403932DBA213D123C8B
SHA-256:	073D8231E9DEF43C058C4B3E083C89F039EE3944526ACBA7E00A986D55298E8B
SHA-512:	1BB0F26E1AF5F6FC6494A115B2CDF860276F225C098008EC3B286F1307F634297F729F998A13CF4F66D0EF7E9DCDB41330EC989445E9A03F0DC2927D3B3E67B9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class TwentyThreeVideoIE(InfoExtractor):. IE_NAME = '23video'. _VALID_URL = r'https?://video\.(?P<domain>twentythree\.net\|23video\.com\|filmweb\.no)/v\.ihtml/player\.html\?(?P<query>.?\bphoto(?:_\|%5f)id=(?P<id>\d+).)'. _TEST = {. 'url': 'https://video.twentythree.net/v.ihtml/player.html?showDescriptions=0&source=site&photo%5fid=20448876&autoPlay=1',. 'md5': '75fcf216303eb1dae9920d651f85ced4',. 'info_dict': {. 'id': '20448876',. 'ext': 'mp4',. 'title': 'Video Marketing Minute: Personalized Video',. 'timestamp': 1513855354,. 'upload_date': '20171221',. 'uploader_id': '12258964',. 'uploader': 'Rasmus Bysted',. }. }.. def _real_extract(self, url):. domain, query, photo_id = re.match(self._VALID_URL, url).groups(). base_url = 'https://video

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3GO7A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6668
Entropy (8bit):	4.877495923013117
Encrypted:	false
SSDEEP:	192:UEz2G/DQlsOA3T2rExmlW3GwCxex50dOqb:UNG/Ds1ST2rExmo3GwCxyof
MD5:	18E7C7D681C563AC9873A5EA8BCDE154
SHA1:	E97FC8D74A3231953E5054A49233C6A60B03871A
SHA-256:	8316C2D7CE8B13C5D443C9BBF05FA3C4AB38D6BD746D0AC1BF2C58BC39571054
SHA-512:	B6BCEC918167BB1C1901F59270F49B9DCEAFEA44CB727E5148551E5FCCAB7EE046A6F428671F2EC4C4460A187AD74C322EE3CBFFA4F11F2925DC295A54F7B466
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urllib_parse_unquote,. compat_urlparse.).from ..utils import (. extract_attributes,. int_or_none,. strip_or_none,. unified_timestamp,.)...class PolskieRadioIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?polskieradio\.pl/\d+/\d+/Artykul/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.polskieradio.pl/7/5102/Artykul/1587943,Prof-Andrzej-Nowak-o-historii-nie-da-sie-myslec-beznamietnie',. 'info_dict': {. 'id': '1587943',. 'title': 'Prof. Andrzej Nowak: o historii nie da si. my.le. beznami.tnie',. 'description': 'md5:12f954edbf3120c5e7075e17bf9fc5c5',. },. 'playlist': [{. 'md5': '2984ee6ce9046d91fc233bc1a864a09a',. 'info_dict': {. 'id': '1540576',. 'ext': 'mp3',. 'tit

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3J59I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3121
Entropy (8bit):	4.727577587786278
Encrypted:	false
SSDEEP:	96:YOEx7IeIjzjt5BIfaUm1GwVzNTt9v7d1396yXXU6Ng:t6eHx5Qa/B7d1396KE6Ng
MD5:	672267FAF262712C551554B088EDC915
SHA1:	7892DB8DDD7858D33C4D9A5B571E17C304422F12
SHA-256:	4855903D83AB286550E2CC3D94ABEFC945BE1CDB971B7D26514298ECABF8B2B9
SHA-512:	BF61E3FFE4D38488F7758A9CE7174924C289B591555501D0BF5A45DC28766A2737B24589DBC491FAC593B8C531069A064018A88E2490EE88793842E2C818E320
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. str_to_int,. urlencode_postdata,.)...class ManyVidsIE(InfoExtractor):. _VALID_URL = r'(?i)https?://(?:www\.)?manyvids\.com/video/(?P<id>\d+)'. _TESTS = [{. # preview video. 'url': 'https://www.manyvids.com/Video/133957/everthing-about-me/',. 'md5': '03f11bb21c52dd12a05be21a5c7dcc97',. 'info_dict': {. 'id': '133957',. 'ext': 'mp4',. 'title': 'everthing about me (Preview)',. 'view_count': int,. 'like_count': int,. },. }, {. # full video. 'url': 'https://www.manyvids.com/Video/935718/MY-FACE-REVEAL/',. 'md5': 'f3e8f7086409e9b470e2643edb96bdcc',. 'info_dict': {. 'id': '935718',. 'ext': 'mp4',. 'title': 'MY FACE REVEAL',. 'view_count': int,. 'like_count': int

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3JHJD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2406
Entropy (8bit):	4.796070748253367
Encrypted:	false
SSDEEP:	48:Puef1FGKRxKNWN+/JSHIdfFk9El1NuX+HAxxqszknaXxaTyjbef23NlIcAt/8cSL:jFGKRwWN+/QIyioxxGnAaTyjby23NlIk
MD5:	2BC6E6EF84ADFE7CD5F076B750AF99F4
SHA1:	3C5789A3B1D18BACCCD93CEDBC53360DAA11A0BC
SHA-256:	2FA3EB6A72C1D35CFAA26154A2D80E094C9F67174EE505726B82851CB9D46346
SHA-512:	B7A289564CAE2D0D779F055D4136505FE547B9B5A4583A651E4D574D5817375E5A23DB6A0DC63CE632E5F014B84E7A5CC303200B7C53A123B675EE751ACB6F50
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. clean_html,. int_or_none,. unified_timestamp,. update_url_query,.)...class RBMARadioIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:rbmaradio\|redbullradio)\.com/shows/(?P<show_id>[^/]+)/episodes/(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'https://www.rbmaradio.com/shows/main-stage/episodes/ford-lopatin-live-at-primavera-sound-2011',. 'md5': '6bc6f9bcb18994b4c983bc3bf4384d95',. 'info_dict': {. 'id': 'ford-lopatin-live-at-primavera-sound-2011',. 'ext': 'mp3',. 'title': 'Main Stage - Ford & Lopatin at Primavera Sound',. 'description': 'md5:d41d8cd98f00b204e9800998ecf8427e',. 'thumbnail': r're:^https?://.*\.jpg',. 'duration': 2452,. 'timestamp': 1307103164,. 'upload_date': '20110603',. },. }.. def _real_extract

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3OPHV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	4.992110595966
Encrypted:	false
SSDEEP:	48:Pu61CjM5o/Vw0vh5jXjlkdBMgfF2f6Z9o5B+szIBoWzvBo0z1Borz+CbLi:CjP/VJqwZA9oWszszFz4z+CPi
MD5:	FC15EEFA339582E5E4514C4660512810
SHA1:	147EAFBCDB47571B8EC157075995BCB513A53EFA
SHA-256:	9130303BE01466D7944A13DAAF0444C340723FF99EB3DA300E9689CC66F0D538
SHA-512:	24EB8C02856C87415F2B38E6DBAE45AE94C8180D14B43063BA84A46DB05C5CC87D73ACB0E4A0338DB3B83CD8584CA901A0E21322AEE3EAF4EC66AEC292AF5FD5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import hashlib..from .common import InfoExtractor.._md5 = lambda s: hashlib.md5(s.encode('utf-8')).hexdigest()...class KankanIE(InfoExtractor):. _VALID_URL = r'https?://(?:.*?\.)?kankan\.com/.+?/(?P<id>\d+)\.shtml'.. _TEST = {. 'url': 'http://yinyue.kankan.com/vod/48/48863.shtml',. 'md5': '29aca1e47ae68fc28804aca89f29507e',. 'info_dict': {. 'id': '48863',. 'ext': 'flv',. 'title': 'Ready To Go',. },. 'skip': 'Only available from China',. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._search_regex(r'(?:G_TITLE=\|G_MOVIE_TITLE = )[\'"](.+?)[\'"]', webpage, 'video title'). surls = re.search(r'surls:\[\'.+?\'\]\|lurl:\'.+?\.flv\'', webpage).group(0). gcids = re.findall(r'http://.+?/.+?/(.+?)/', surls). gcid = gcids[-1].. info_url = '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3OQP2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6717
Entropy (8bit):	4.543051955670404
Encrypted:	false
SSDEEP:	192:lq949SfGYiN9sgO+24TE6NXm7JmPacU8xmv:lG49SKtO+24TE6NXmtmXU8xk
MD5:	15A880DDE99C58737E5D779786A16BFF
SHA1:	0177E099260016B08C37C5E217DAE5B73EF8C48E
SHA-256:	C896634FCABA3168D69F725CA18B41CCAD9E50A737F6AE58A8622965B8B0A827
SHA-512:	629E18735CE16C074A3D39FF0F6E90B02A95C1A3772F0059CE6E03EC4BBA2F4D9593629194958C463E6C0846097C41545A7E48A64443FC22DDAD110BDB7CCC78
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_iso8601,. unescapeHTML,. qualities,.)...class Revision3EmbedIE(InfoExtractor):. IE_NAME = 'revision3:embed'. _VALID_URL = r'(?:revision3:(?:(?P<playlist_type>[^:]+):)?\|https?://(?:(?:(?:www\|embed)\.)?(?:revision3\|animalist)\|(?:(?:api\|embed)\.)?seekernetwork)\.com/player/embed\?videoId=)(?P<playlist_id>\d+)'. _TEST = {. 'url': 'http://api.seekernetwork.com/player/embed?videoId=67558',. 'md5': '83bcd157cab89ad7318dd7b8c9cf1306',. 'info_dict': {. 'id': '67558',. 'ext': 'mp4',. 'title': 'The Pros & Cons Of Zoos',. 'description': 'Zoos are often depicted as a terrible place for animals to live, but is there any truth to this?',. 'uploader_id': 'dnews',. 'uploader': 'DNews',. }. }. _API_KEY = 'ba9c7

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3QH8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4152
Entropy (8bit):	4.627310513812594
Encrypted:	false
SSDEEP:	96:POEoLOz4I03tgRdpMDa5yjujGt1nHzoZc1d9BTu7bTC0e5KTJ1tB8hwP6Ng:2kz4jtgRp5+j1nHKsVTqf4hwP6Ng
MD5:	A7D86388DF37A5B8401F16601BBF85D5
SHA1:	B6C8356C0D24CAF19807E22E3F9CEF03FD94C4E1
SHA-256:	643F83A30F0A8AE662D21BDF37257DCE93C9BAF2210EC46D2A2EE9C34BE1F576
SHA-512:	28451949BA61FBAED19D25C7553E1FB70E8DA2CFF56B7695317CC2CBEB0E625332C126D523E93876895214029EEEF1BBC42A6476B86B8C033FD7E9FF8F3E569E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urllib_parse_unquote,.).from ..utils import (. determine_ext,. float_or_none,. get_element_by_id,. int_or_none,. parse_iso8601,. str_to_int,.)...class IzleseneIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://(?:(?:www\|m)\.)?izlesene\.com/. (?:video\|embedplayer)/(?:[^/]+/)?(?P<id>[0-9]+). '''. _TESTS = [. {. 'url': 'http://www.izlesene.com/video/sevincten-cildirtan-dogum-gunu-hediyesi/7599694',. 'md5': '4384f9f0ea65086734b881085ee05ac2',. 'info_dict': {. 'id': '7599694',. 'ext': 'mp4',. 'title': 'Sevin.ten ..ld.rtan Do.um G.n. Hediyesi',. 'description': 'md5:253753e2655dde93f59f74b572454f6d',. 'thumbnail': r're:^https?://.*\.jpg',. 'uploader_id': 'pelikzzle',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3RB9R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1280
Entropy (8bit):	4.755556836186609
Encrypted:	false
SSDEEP:	24:1R8lFvbinPZmwOJGjcAcwPEtA8kk/JlRaeIXjl+twl4zAhXRpuYkXnZv5UPlvi:Pu6cAcos5ajXjlCTWXWPXnrUU
MD5:	D66F125C0AA7DE3F67A76E55DF92F962
SHA1:	9FFC042B5A742BFCEF01AAA44ACDD44A336E1030
SHA-256:	237D350194EF99475BD71F401E14D8DA695587AAF37A620C0F445DFD6FAC876E
SHA-512:	0CA2E178426BB9F463660E5FCFEF58C8A633314EDBF65A43C1BB55EEAC1FD91E65F30C14A516628204976B9D6FDEF6BB0AEEF22122E000446F3143A480B8DB41
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import ExtractorError...class MacGameStoreIE(InfoExtractor):. IE_NAME = 'macgamestore'. IE_DESC = 'MacGameStore trailers'. _VALID_URL = r'https?://(?:www\.)?macgamestore\.com/mediaviewer\.php\?trailer=(?P<id>\d+)'.. _TEST = {. 'url': 'http://www.macgamestore.com/mediaviewer.php?trailer=2450',. 'md5': '8649b8ea684b6666b4c5be736ecddc61',. 'info_dict': {. 'id': '2450',. 'ext': 'm4v',. 'title': 'Crow',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. url, video_id, 'Downloading trailer page').. if '>Missing Media<' in webpage:. raise ExtractorError(. 'Trailer %s does not exist' % video_id, expected=True).. video_title = self._html_search_regex(. r'<title>MacGameStore: (.*?) Trailer</title>', web

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3RMU0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1957
Entropy (8bit):	4.930576872793063
Encrypted:	false
SSDEEP:	48:+umQb7FUIQfAk47HERajXhke9P5VzVgL/NlQTUjTZ5AAt/8cLTi:19UIQ4vTERaaIGbNl9B5Ht/8F
MD5:	2AFD08EBC7D566281571FCFC2F66D13E
SHA1:	C1B2F5104F315E4F221DFE37E7D1A5AA37F16474
SHA-256:	EC48BAFF430E61D323D597D56DF5292080FA26BA7747A99A2449BB7C3B9CE15F
SHA-512:	94916797027A2AEE0F844D7D45C0E18DEE4470F91B030DF8DBDCB5458424E310D7382788B9D97F57618FD74B861517A0C37A8188962CA23F5067E9F3109C4A22
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import (. int_or_none,. js_to_json,.)...class KrasViewIE(InfoExtractor):. IE_DESC = '.......'. _VALID_URL = r'https?://krasview\.ru/(?:video\|embed)/(?P<id>\d+)'.. _TEST = {. 'url': 'http://krasview.ru/video/512228',. 'md5': '3b91003cf85fc5db277870c8ebd98eae',. 'info_dict': {. 'id': '512228',. 'ext': 'mp4',. 'title': '...., ..., ......',. 'description': '..... . ...... ......, . .....-.......... .......... .......',. 'duration': 27,. 'thumbnail': r're:^https?://.*\.jpg',. },. 'params': {. 'skip_download': 'Not accessible from Travis CI server',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3RO5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2917
Entropy (8bit):	4.721926255573714
Encrypted:	false
SSDEEP:	48:Pu5UqiojL7f3t6VnhxcigqBavStfjXhXD1wnVTU+LSZdcxlzDUvD9snqzgm4P/cI:MU7ojLj3tenhxcizBavQfhD8VKmpDi96
MD5:	D53EE1A8E9772EA3741F4612514B7894
SHA1:	60082C851C7AEB1E31DA34787448040FE236CBD2
SHA-256:	E378EDCE3729C5F84F1C95B6175DB1A862A0FE2209C15E5109A2E14894200F83
SHA-512:	81A21B8DF5982B2ADC73D90ECF20BD18E401BDF085FB1D15E6086E99950196B5378FC2C09ABC6CB91FFB8E796BCD77DEEA005F61D744F9EF3C0D59D0DD67C1C3
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. js_to_json,. remove_end,. unified_strdate,.)...class VidbitIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vidbit\.co/(?:watch\|embed)\?.?\bv=(?P<id>[\da-zA-Z]+)'. _TESTS = [{. 'url': 'http://www.vidbit.co/watch?v=jkL2yDOEq2',. 'md5': '1a34b7f14defe3b8fafca9796892924d',. 'info_dict': {. 'id': 'jkL2yDOEq2',. 'ext': 'mp4',. 'title': 'Intro to VidBit',. 'description': 'md5:5e0d6142eec00b766cbf114bfd3d16b7',. 'thumbnail': r're:https?://.\.jpg$',. 'upload_date': '20160618',. 'view_count': int,. 'comment_count': int,. }. }, {. 'url': 'http://www.vidbit.co/embed?v=jkL2yDOEq2&auto=0&water=0',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-3VO6R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	4.822426668714733
Encrypted:	false
SSDEEP:	24:1R8lFvbMxGKwQZg3H59kZe/hWdl4UyuaeIXjlgtdXIqL8QUKOZtdtoiz0duPl5Ru:Puix9tmHT14yuajXjlkdXIqLZUKOv7oX
MD5:	371FD1275AED8A4B136969A8C2D8E891
SHA1:	FFAA97AD0223DF12D6393F64EAEC972457FF75DE
SHA-256:	F3A93F09E2FA715541831035F6331B2BF9CDB5CA837F829EB987A85127D48C36
SHA-512:	9ACA52B220E935AB5E83E3DFAC4F44F19544ADB319337BC04C245F40A682FD09236A0B7734E48F06994313D8030D3FA8D98EB69BA0752E37002DF7177ACCAC5D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote...class XBefIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?xbef\.com/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://xbef.com/video/5119-glamourous-lesbians-smoking-drinking-and-fucking',. 'md5': 'a478b565baff61634a98f5e5338be995',. 'info_dict': {. 'id': '5119',. 'ext': 'mp4',. 'title': 'md5:7358a9faef8b7b57acda7c04816f170e',. 'age_limit': 18,. 'thumbnail': r're:^http://.\.jpg',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._html_search_regex(. r'<h1[^>]>(.*?)</h1>', webpage, 'title').. config_url_enc = self._download_webpage(. 'http://xbef.com/Main/GetVideoURLEncoded/%s' % video_id, video_id,. note='Retrieving con

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-41AG4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11802
Entropy (8bit):	5.028129119841808
Encrypted:	false
SSDEEP:	192:3E1n/lY2knbZHNn6F1YSQthU4FFzhtTP6Ns8HsOWv9vw+5oJUeJUGdBw1BTXIZMs:3E1/lunbZHNn41tQthUkFzhtTP6NRHsW
MD5:	D07FC78709C42273AAFBA0FF189B8897
SHA1:	090873E544FD26209CD1892CD7154910AE373801
SHA-256:	59176873821BC02B33499DC7C857B02A32C87928669E7A1935489A2D6920EB79
SHA-512:	4AFCCE183CE739D9286D116C211104E5836B21D4281CB70D4C42E587E894C38BC2BB3B6D9427743C26A037486478364584B30770E23AFDEDEC6F6B0C73023DCB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse_unquote,. compat_urllib_parse_urlencode,. compat_urlparse,.).from ..utils import (. int_or_none,. str_to_int,. xpath_text,. unescapeHTML,.)...class DaumIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:m\.)?tvpot\.daum\.net/v/\|videofarm\.daum\.net/controller/player/VodPlayer\.swf\?vid=)(?P<id>[^?#&]+)'. IE_NAME = 'daum.net'.. _TESTS = [{. 'url': 'http://tvpot.daum.net/v/vab4dyeDBysyBssyukBUjBz',. 'info_dict': {. 'id': 'vab4dyeDBysyBssyukBUjBz',. 'ext': 'mp4',. 'title': '.. .. vs .... ..',. 'description': 'Mark Hunt vs Antonio Silva',. 'upload_date': '20131217',. 'thumbnail': r're:^https?://.*\.(?:jpg\|png)',. 'duration': 2117,. 'view_count': int,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-42G6E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	5.034032934196812
Encrypted:	false
SSDEEP:	24:zi8lFv7B1T/vwifm2U/zjdlDFk7w8v+DnPZoWKaeIXjlgtoqB6W+vF8s5g:+u1XT/v8x/ChInUajXjlkoqB7+esa
MD5:	46E78B7F1393F4A2C7457A965AD96E2B
SHA1:	CC7186C13FC994B0D5E99543722F4A4ED260969A
SHA-256:	B4E3AB5D2D900B53C11EE78A7F69BE9C3108A9D7987ADC8DACA1BAE7E03A5E61
SHA-512:	F6881D1C73E28D203FDC2853D44DAA9B2EF7D47BC432792D2AF1267DA6D5E5E6B7D9D42482A8D411044C5018D9CABE7DB3D7B0EC302CE8EE99480B38DF50000E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class MakerTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.)?maker\.tv/(?:[^/]+/)*video\|makerplayer\.com/embed/maker)/(?P<id>[a-zA-Z0-9]{12})'. _TEST = {. 'url': 'http://www.maker.tv/video/Fh3QgymL9gsc',. 'md5': 'ca237a53a8eb20b6dc5bd60564d4ab3e',. 'info_dict': {. 'id': 'Fh3QgymL9gsc',. 'ext': 'mp4',. 'title': 'Maze Runner: The Scorch Trials Official Movie Review',. 'description': 'md5:11ff3362d7ef1d679fdb649f6413975a',. 'upload_date': '20150918',. 'timestamp': 1442549540,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). jwplatform_id = self._search_regex(r'jw_?id="([^"]+)"', webpage, 'jwplatform id').. return {. '_type': 'url_transparent',. 'id': video_id,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-43BSB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	4.721732721674062
Encrypted:	false
SSDEEP:	96:i0/7AbgAmvbKn6KFmvbBnXv279bmvb4+mvO0fqSpipAmKyE8OA9QZ9Htc:iU7AbevbKMvbtv2hKvb4vOiq0kA1I
MD5:	FD192CAF230496E27928E9AB147E004B
SHA1:	3B2F20F9CF3D12AC0987C90AC615FD115B9D6026
SHA-256:	D6E5712B2D7D9388A1702417AD6D1C82355ACEADDD42E65035F5B281FE5986F5
SHA-512:	F4B7DA62B8686DEF6CF6685C0E7BD9C3FD9932E65FF9E77B060837739E64D61196BC97CF90E41F10B0A70EE6BA147CB85A7D3680841A7CD6A6524B0AE00B95CB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_request,.).from ..utils import (. ExtractorError,.)...class ScreencastIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?screencast\.com/t/(?P<id>[a-zA-Z0-9]+)'. _TESTS = [{. 'url': 'http://www.screencast.com/t/3ZEjQXlT',. 'md5': '917df1c13798a3e96211dd1561fded83',. 'info_dict': {. 'id': '3ZEjQXlT',. 'ext': 'm4v',. 'title': 'Color Measurement with Ocean Optics Spectrometers',. 'description': 'md5:240369cde69d8bed61349a199c5fb153',. 'thumbnail': r're:^https?://.*\.(?:gif\|jpg)$',. }. }, {. 'url': 'http://www.screencast.com/t/V2uXehPJa1ZI',. 'md5': 'e8e4b375a7660a9e7e35c33973410d34',. 'info_dict': {. 'id': 'V2uXehPJa1ZI',. 'ext': 'mov',. 'title': 'The Amadeus Spectrometer',. 'de

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-45G0U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2826
Entropy (8bit):	4.582019896042155
Encrypted:	false
SSDEEP:	48:+uny4rxygrD1qaJoXjlhlgsLh7BrwPBYUJLwBAgz3yI5NxouVYjhrqGQBTq6NYK:jy4rxnrgaJshLhVwKwL5gz3fVYjldQBT
MD5:	14E26C2E70F698ABE70B57F7F9EB735D
SHA1:	78F1148184C1E5AE20B9DA279BF90DF38B10F51D
SHA-256:	56C71D8BC00498627FF3558BA4AE059D14D20A9EA91366F8C8C0EBFA60CD2B79
SHA-512:	832D6A115A9D80DBB4D994D396C409FD3C4AD3745998CB2AC253144D66EBA319D1C6EE33C40EA458D57CA8E5D33F733EA0634373301D4770E9377E403FA72A56
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. extract_attributes,. try_get,. urlencode_postdata,. ExtractorError,.)...class TVPlayerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?tvplayer\.com/watch/(?P<id>[^/?#]+)'. _TEST = {. 'url': 'http://tvplayer.com/watch/bbcone',. 'info_dict': {. 'id': '89',. 'ext': 'mp4',. 'title': r're:^BBC One [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id).. current_channel = extract_attributes(self._search_regex(. r'(<div[^>]+class="[^"]current-channel[^"]"[^>]*>)',. webpage, 'channel ele

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-4CSR6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1948
Entropy (8bit):	4.936761499111041
Encrypted:	false
SSDEEP:	48:+uci7ttqn7jGytfajXhkQXYmXOS6zjpyAdkJK/u7j035L8cK:P7ttqn7jGytfaavxS65yCeKm7j0398J
MD5:	5E98021F9457790EBC23CE541C5D503C
SHA1:	C6B018189EBD6A92DF3B468BC38B1DAA90EECB06
SHA-256:	6AABAC0F770FA5CB8857B4AA1CD2227A896CF2B288BF6269724DAE1B5D6FDC91
SHA-512:	F40A28A4C210615D216F89CE6DB7F0804999521C341059792211D756E34D13D91A56C2EEE8F9610516766FD26E34DC83FAA2C6C64C0F40C117D013F238BB9ABE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_filesize,. unified_strdate,.)...class XboxClipsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?xboxclips\.com/(?:video\.php\?.*vid=\|[^/]+/)(?P<id>[\w-]{36})'. _TEST = {. 'url': 'http://xboxclips.com/video.php?uid=2533274823424419&gamertag=Iabdulelah&vid=074a69a9-5faf-46aa-b93b-9909c1720325',. 'md5': 'fbe1ec805e920aeb8eced3c3e657df5d',. 'info_dict': {. 'id': '074a69a9-5faf-46aa-b93b-9909c1720325',. 'ext': 'mp4',. 'title': 'Iabdulelah playing Titanfall',. 'filesize_approx': 26800000,. 'upload_date': '20140807',. 'duration': 56,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. video_url = self._html_search_regex(. r'>(?:Link\|Download):

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-4DFD0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3704
Entropy (8bit):	4.469510778254176
Encrypted:	false
SSDEEP:	96:9HosTE3JHvp57jSJAVfBb0RfqBTGOJS7/8ya8Hd6Ng:li3Bv7PwAVBYRmTY96Ng
MD5:	22E4667BBA2F85F518CD15EF9BE61DA2
SHA1:	FFAB5FECA0C1CDB718577E80AA7E92D97B9EF44A
SHA-256:	56F3AD47C60FE3A70E10FDC12DF0EFE10E91E68600603F261230CFB48601914C
SHA-512:	5554D120470A4C8749532E0FCF6D836D74F4467084EDF0250F196374048A09AE9F1FF051075C717341F579737F03F799D38DD624603756EBE453D51D37F7644D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. parse_duration,. parse_iso8601,. parse_resolution,. url_or_none,.)...class CCMAIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ccma\.cat/(?:[^/]+/)*?(?P<type>video\|audio)/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.ccma.cat/tv3/alacarta/lespot-de-la-marato-de-tv3/lespot-de-la-marato-de-tv3/video/5630208/',. 'md5': '7296ca43977c8ea4469e719c609b0871',. 'info_dict': {. 'id': '5630208',. 'ext': 'mp4',. 'title': 'L\'espot de La Marat. de TV3',. 'description': 'md5:f12987f320e2f6e988e9908e4fe97765',. 'timestamp': 1470918540,. 'upload_date': '20160811',. }. }, {. 'url': 'http://www.ccma.cat/catradio/alacarta/programa/el-consell-de-savis-analitza-el-derbi/audio/943685/',. 'md5': 'fa3e38f269329a278271276

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-4DUO5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	4.785866819223239
Encrypted:	false
SSDEEP:	48:PusJhxaANfwG/F+ZyoqwVXwx7tKmw5jXjlD3R3Pp56A3YakvBeOeUiveb:x/xaEBF+ZypECvu/3xMPaCBeOen4
MD5:	1BBE42310BF3904FEE05D7168A8A0B44
SHA1:	52BB0ADC7294C4CB54F4341C41BD7F9E353004A5
SHA-256:	06E7ABFF1948D39AE28EC61B52C81ED6C605AC39398603D183A67B941B385009
SHA-512:	AA9AF2D6CF4464342E05D7BAA48635DE8ED4E47B4D9975C9623137B47D4CA4770E415FFBBD684D846982ED45232659E300AF6D8D86A0E0D1BCD65C0CDD6E02BD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import remove_end...class CharlieRoseIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?charlierose\.com/(?:video\|episode)(?:s\|/player)/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://charlierose.com/videos/27996',. 'md5': 'fda41d49e67d4ce7c2411fd2c4702e09',. 'info_dict': {. 'id': '27996',. 'ext': 'mp4',. 'title': 'Remembering Zaha Hadid',. 'thumbnail': r're:^https?://.*\.jpg\?\d+',. 'description': 'We revisit past conversations with Zaha Hadid, in memory of the world renowned Iraqi architect.',. 'subtitles': {. 'en': [{. 'ext': 'vtt',. }],. },. },. }, {. 'url': 'https://charlierose.com/videos/27996',. 'only_matching': True,. }, {. 'url': 'https://charlierose.com/episodes/30887?autoplay=true',. 'only_matching':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-4HC9G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5583
Entropy (8bit):	4.714426107106111
Encrypted:	false
SSDEEP:	96:KTJnw+kTAYMX35PhxqfSrQSeuCQTTkBT42NMc5Krb5qS8V6NlUYDIcKq4Il/fO07:uPG4XpJmHS0QTTsTbvgb5qtV6NOC53XP
MD5:	373066E145C6FBA903E7F863F3EA7E48
SHA1:	7DD8368BF8C4E7B699288F11F2218054BF276220
SHA-256:	A2F50650D359AA026779989E03D581638304B9B713B1BC3C9C329366C2526E89
SHA-512:	CB74FD05F0DE0113427C1AE2240D2413657C99141018A5653D9487A6327AC436694DDC2B4FC8F5E47A73806CADD09313E34175E72CA19075C1ABB2F63833B2D2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,. int_or_none,. parse_duration,. parse_filesize,. unified_timestamp,.)...class NewgroundsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?newgrounds\.com/(?:audio/listen\|portal/view)/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://www.newgrounds.com/audio/listen/549479',. 'md5': 'fe6033d297591288fa1c1f780386f07a',. 'info_dict': {. 'id': '549479',. 'ext': 'mp3',. 'title': 'B7 - BusMode',. 'uploader': 'Burn7',. 'timestamp': 1378878540,. 'upload_date': '20130911',. 'duration': 143,. },. }, {. 'url': 'https://www.newgrounds.com/portal/view/673111',. 'md5': '3394735822aab2478c31b1004fe5e5bc',. 'info_dict': {. 'id': '673111',. 'ext': 'mp4',. 'title': 'Dancin',. 'uploader':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-4M171.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	4.5021494142335525
Encrypted:	false
SSDEEP:	96:ZTBHu1D/nB7K5B8rrisjEm7m52AiRNFAtRxc6do0+bdiGdfGH3JuSK2nI50avDSn:GD/B7MVUAO3G5uS9n4vDWJJdtnfuFY1
MD5:	ABC81AD027A3A3B900CE965F0F9A76B1
SHA1:	388F97A11301A2B517BFAD3E22B05F3431956128
SHA-256:	CBC9323EB964CA9B3210FED91F3192BB825F5E2DBB59540C66B1890D830F085B
SHA-512:	8DD9BC7214451BFC2F3ED6D875FF8F2785178BBD9EEA37A2F2B3792BD562DCE9A26A5C2CBABBFD5F159C10D00D38CB06B04935728D38B9C68A0F96710D77719E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. js_to_json,. parse_duration,. parse_iso8601,.)...class ViideaIE(InfoExtractor):. _VALID_URL = r'''(?x)https?://(?:www\.)?(?:. videolectures\.net\|. flexilearn\.viidea\.net\|. presentations\.ocwconsortium\.org\|. video\.travel-zoom\.si\|. video\.pomp-forum\.si\|. tv\.nil\.si\|. video\.hekovnik.com\|. video\.szko\.si\|. kpk\.viidea\.com\|. inside\.viidea\.net\|. video\.kiberpipa\.org\|. bvvideo\.si\|. kongres\.viidea\.net\|. edemokracija\.viidea\.com. )(?:/lecture)?/(?P<id>[^/]+)(?:/video/(?P<part>\d+))?/(?:[#?].)?$'''.. _TESTS = [{. 'url': 'http://videolectures.net/promogram_igor_mekjavic_eng/',. 'info

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-4N35A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6753
Entropy (8bit):	4.623831830397464
Encrypted:	false
SSDEEP:	192:glX2gWBcQ27tAZ7yLVnLgROOeczTtH6NBLZmNUsxe:glGgWBcQ27k7inLgROOeczTtH6NB8Usw
MD5:	D0F2C8F69906CBC64734500DC8547881
SHA1:	BFF4840F504DB9E9DDF1FBE290F7CFD10F4FFFD3
SHA-256:	5A31F3F69C5E59703E215F76D32B377E233E08024043E6C6B52C4F43C8DD54F7
SHA-512:	21FD73B5D1F01C1DDF1FBCC8424E35A29C389A0C751F51EC85B703F82E49BB113ECD6FAEDE54AE853AF11242C6628A2E54DED010A1FC2800915729EDDD374402
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. urlencode_postdata,. urljoin,.)...class LinkedInLearningBaseIE(InfoExtractor):. _NETRC_MACHINE = 'linkedin'. _LOGIN_URL = 'https://www.linkedin.com/uas/login?trk=learning'.. def _call_api(self, course_slug, fields, video_slug=None, resolution=None):. query = {. 'courseSlug': course_slug,. 'fields': fields,. 'q': 'slugs',. }. sub = ''. if video_slug:. query.update({. 'videoSlug': video_slug,. 'resolution': '_%s' % resolution,. }). sub = ' %dp' % resolution. api_url = 'https://www.linkedin.com/learning-api/detailedCourses'. return self._download_json(. api_url, video_slug, 'Downloading%s JSON metadata' % sub, headers={. 'Csrf-Token':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-4Q1GM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	4.900787707351976
Encrypted:	false
SSDEEP:	24:1R8lFvBn0wWFJzv/XedlCOJOaUXjlxTIBG4h+WapvfSwpZPlc:PuTn0LFhXe2OgaUXjlx0B/cWyvrZG
MD5:	C28DB9606EEBAB1CC95ED264A6861006
SHA1:	52396D330EC1C7A9FEBEA7857075E9E7C130FDE6
SHA-256:	88EFC6BB8F9D992C9539DE0505B92140A9C66373446D5B943C75E57E002B3ADC
SHA-512:	5837620804CF15B8DF9E46DDFF51176C1EC1F602A881808B315F55BEAA8598A2E673C37879049C99357A7CE536349F4F16F1F69E4B258E2735B8252643989AFE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class DefenseGouvFrIE(InfoExtractor):. IE_NAME = 'defense.gouv.fr'. _VALID_URL = r'https?://.?\.defense\.gouv\.fr/layout/set/ligthboxvideo/base-de-medias/webtv/(?P<id>[^/?#])'.. _TEST = {. 'url': 'http://www.defense.gouv.fr/layout/set/ligthboxvideo/base-de-medias/webtv/attaque-chimique-syrienne-du-21-aout-2013-1',. 'md5': '75bba6124da7e63d2d60b5244ec9430c',. 'info_dict': {. 'id': '11213',. 'ext': 'mp4',. 'title': 'attaque-chimique-syrienne-du-21-aout-2013-1'. }. }.. def _real_extract(self, url):. title = self._match_id(url). webpage = self._download_webpage(url, title).. video_id = self._search_regex(. r"flashvars.pvg_id=\"(\d+)\";",. webpage, 'ID').. json_url = (. 'http://static.videos.gouv.fr/brightcovehub/export/json/%s' %. video_id). info = self._downl

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-4ST41.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4383
Entropy (8bit):	4.735688610978787
Encrypted:	false
SSDEEP:	96:QYujvtkYKVhO7utrc91HK7uBNzC/67u65tzX/7unhOG/Nnn7JHT4zr2anyO:WCYKV9lcbXzCnmsUG/Nd0zrhV
MD5:	D935CA4F51384EC83265B8591F5DB5B2
SHA1:	ACD4E58E405EA855C7631ED695E09BA88A26E49A
SHA-256:	8F3EFBA744B2732CAF52A81E235B7F7B494267791DF594563C22481BA3534F75
SHA-512:	112FF3A1ACEDD90654D82F7AC565131609056432499F40F3976F0DBB3F4D4614DEE4947BD245F65D40AD836D27A310FC358AE4C468580C5797AB33FAD2557D92
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import ExtractorError.from .rutv import RUTVIE...class VestiIE(InfoExtractor):. IE_DESC = '......Ru'. _VALID_URL = r'https?://(?:.+?\.)?vesti\.ru/(?P<id>.+)'.. _TESTS = [. {. 'url': 'http://www.vesti.ru/videos?vid=575582&cid=1',. 'info_dict': {. 'id': '765035',. 'ext': 'mp4',. 'title': '......net: ........ . ...... .. ........ .........',. 'description': 'md5:d4bb3859dc1177b28a94c5014c35a36b',. 'duration': 302,. },. 'params': {. # m3u8 download. 'skip_download': True,. },. },. {. 'url': 'http://www.vesti.ru/doc.html?id=1349233',. 'info_dict': {. 'id': '773865',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-51M8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3460
Entropy (8bit):	4.679435564493168
Encrypted:	false
SSDEEP:	96:19dWmMKsQHzavRfJsaNG5BGF05Si4S+wqmXaT:NhzsC+vZJsp5BjSJyXE
MD5:	259C700CF3899181C1F6F610120D4D32
SHA1:	D62A51041006034A5FBF68710B9988FCAEEBCC33
SHA-256:	75FA2D85F07DC5401246B06F84FFF3F4F9D8249CCC90A836B081B08FB96DEF58
SHA-512:	EC3FF7F59BB7B696A74F335250C82D447204859A7B518BD864BB664930F9B246F98B358D0DE913A56EF2E96E09C6B8FCB613360C4512C4BA0D7A9F30974F7141
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .adobepass import AdobePassIE.from ..utils import (. smuggle_url,. update_url_query,. int_or_none,.)...class BravoTVIE(AdobePassIE):. _VALID_URL = r'https?://(?:www\.)?bravotv\.com/(?:[^/]+/)+(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'https://www.bravotv.com/top-chef/season-16/episode-15/videos/the-top-chef-season-16-winner-is',. 'md5': 'e34684cfea2a96cd2ee1ef3a60909de9',. 'info_dict': {. 'id': 'epL0pmK1kQlT',. 'ext': 'mp4',. 'title': 'The Top Chef Season 16 Winner Is...',. 'description': 'Find out who takes the title of Top Chef!',. 'uploader': 'NBCU-BRAV',. 'upload_date': '20190314',. 'timestamp': 1552591860,. }. }, {. 'url': 'http://www.bravotv.com/below-deck/season-3/ep-14-reunion-part-1',. 'only_matching': True,. }].. def _real_extract(self, url):. display_id = self

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-53DCT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8015
Entropy (8bit):	4.744861811142839
Encrypted:	false
SSDEEP:	192:1cJuv3gN48ASo75U7sfwV2OytFJPYHqRDuW4f8TlelApODgzwIaWw:1cJ23r8Q75UYfyytPYKRDuW4f8TleUOX
MD5:	3BFF28441E10439C3B42D39F57FCF930
SHA1:	CB78B632997E48DBA20B447CED88BD6BA620FDC3
SHA-256:	787E5C459FAA10AD3704A6D84FB13229E38AF57D1425C21F2507644D0037A93F
SHA-512:	BD59EF13B3C382C1A58ECF2142B3331DF25F7F018DD41C6CF5AE2BCD98E52238B51EDB4B645CB133F0C1E343BE1F8CCD6FF513601185596F42D24288FF9AB184
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class LiveLeakIE(InfoExtractor):. _VALID_URL = r'https?://(?:\w+\.)?liveleak\.com/view\?.?\b[it]=(?P<id>[\w_]+)'. _TESTS = [{. 'url': 'http://www.liveleak.com/view?i=757_1364311680',. 'md5': '0813c2430bea7a46bf13acf3406992f4',. 'info_dict': {. 'id': '757_1364311680',. 'ext': 'mp4',. 'description': 'extremely bad day for this guy..!',. 'uploader': 'ljfriel2',. 'title': 'Most unlucky car accident',. 'thumbnail': r're:^https?://.\.jpg$'. }. }, {. 'url': 'http://www.liveleak.com/view?i=f93_1390833151',. 'md5': 'd3f1367d14cc3c15bf24fbfbe04b9abf',. 'info_dict': {. 'id': 'f93_1390833151',. 'ext': 'mp4',. 'description': 'German Television Channel NDR does an exclusive interview with Edward Snowden.\r\nUploaded on LiveLe

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-53TL7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	992
Entropy (8bit):	4.969679676025222
Encrypted:	false
SSDEEP:	24:1R8lFvBwIp3DedVDW/cdVdlzLaeIXjlgtdXAWuIp3QrAx3kClO:PuPbp3DedVycdV3LajXjlkdXAWpp3BxI
MD5:	58E754205D5AD62F7CBF1085EA8FC645
SHA1:	14374F07A3E752F1BEC58F847CC3DC11737E1B3A
SHA-256:	CAA0502AFCF9BD2D415A1D3BB74DE6569241D327605F6D2309C4A8D5BF582D9A
SHA-512:	BB5280E71A546E76C9E3072AA8D50B924A435C8E7AE26EBD854CC7EF525D494A388653D881E30D8A1E824F6FCBA0AD2B8EC8E93B5D2470E1B152AB53FADF3AEE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class Ku6IE(InfoExtractor):. _VALID_URL = r'https?://v\.ku6\.com/show/(?P<id>[a-zA-Z0-9\-\_]+)(?:\.)html'. _TEST = {. 'url': 'http://v.ku6.com/show/JG-8yS14xzBr4bCn1pu0xw...html',. 'md5': '01203549b9efbb45f4b87d55bdea1ed1',. 'info_dict': {. 'id': 'JG-8yS14xzBr4bCn1pu0xw',. 'ext': 'f4v',. 'title': 'techniques test',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._html_search_regex(. r'<h1 title=.>(.*?)</h1>', webpage, 'title'). dataUrl = 'http://v.ku6.com/fetchVideo4Player/%s.html' % video_id. jsonData = self._download_json(dataUrl, video_id). downloadUrl = jsonData['data']['f'].. return {. 'id': video_id,. 'title': title,. 'url': downloadUrl. }.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-561CD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3981
Entropy (8bit):	4.420707149233207
Encrypted:	false
SSDEEP:	96:EuKLfwBekLffapjfbzl7PchtOJMj0mtBTWbw1y6NWRXE:wLaLMjDzxFmjzTWbgy6NYXE
MD5:	9F5E4A3869B57CCC4CEFE6DE9325E096
SHA1:	9070B85194F46AF3237E5E1AFECB682C1C07A4A2
SHA-256:	4344988D3B081E323FAAC0E40E524CD7BDB23AB343E2FD85107958E64B7DBD24
SHA-512:	B2676E335D0CD13E3AB98AD25A372EB1A67B558692E43EB93AC001C32123A4E7958F68E49CD59E655C90F6A971A0C3EE24DAFB5006E7D906D1BB583290D034E8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,. xpath_with_ns,. xpath_text,. find_xpath_attr,.)...class XstreamIE(InfoExtractor):. _VALID_URL = r'''(?x). (?:. xstream:\|. https?://frontend\.xstream\.(?:dk\|net)/. ). (?P<partner_id>[^/]+). (?:. :\|. /feed/video/\?.*?\bid=. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://frontend.xstream.dk/btno/feed/video/?platform=web&id=86588',. 'md5': 'd7d17e3337dc80de6d3a540aefbe441b',. 'info_dict': {. 'id': '86588',. 'ext': 'mov',. 'title': 'Otto Wollertsen',. 'description': 'Vestlendingen Otto Fredrik Wollertsen',. 'timestamp':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-573CB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.941775822932339
Encrypted:	false
SSDEEP:	96:LHk8zmbTzHagt0dWM7g3uzPW+HVs+BTrlU6ETU8eKdE8fUuqKwdGBTeka8x6N0ES:jkOMzHkWXuzPW+Hq+s6ET/eKdEqUuqHA
MD5:	53F14190B03D7D91F855C2AF0F44FA0E
SHA1:	5CC05F18F4AF358CDB10015E827141CAAC0BEA75
SHA-256:	6403B69D919F35F5B0079B410D88C205B454D94E48EFD68F8FC7A1B7D9150248
SHA-512:	78BD5A7501E69AB192B2CD862ADAD895DA47BE62D5790882AD708A708ADFBA29A58CF9654993D78094B3EA73EA5E3932DB21B1993DFD187966A52A7F78466E86
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,.)...class RtlNlIE(InfoExtractor):. IE_NAME = 'rtl.nl'. IE_DESC = 'rtl.nl and rtlxl.nl'. _VALID_URL = r'''(?x). https?://(?:(?:www\|static)\.)?. (?:. rtlxl\.nl/[^\#]*\#!/[^/]+/\|. rtl\.nl/(?:(?:system/videoplayer/(?:[^/]+/)+(?:video_)?embed\.html\|embed)\b.+?\buuid=\|video/). ). (?P<id>[0-9a-f-]+)'''.. _TESTS = [{. 'url': 'http://www.rtlxl.nl/#!/rtl-nieuws-132237/82b1aad1-4a14-3d7b-b554-b0aed1b2c416',. 'md5': '473d1946c1fdd050b2c0161a4b13c373',. 'info_dict': {. 'id': '82b1aad1-4a14-3d7b-b554-b0aed1b2c416',. 'ext': 'mp4',. 'title': 'RTL Nieuws',. 'description': 'md5:d41d8cd98f00b204e9800998ecf8427e',. 'timestamp': 1461951000,. 'upload_date': '20160429',. 'duration': 1167.96,. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-57IV0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	46969
Entropy (8bit):	4.6212498069928705
Encrypted:	false
SSDEEP:	768:Fot22Wv5ST/bHROtKf1PPYj3W8vifFlPtwkmzdyOfJnSaGtF/CN0h6H6RUMNTTTw:Fot/Wv5ST/bHROtKf1PPYj3W8vifFl1+
MD5:	ACF1442C2DA54DC9FCE40A6F016DC933
SHA1:	7596C627E4CDDA6B8C6E3E54E526D8E15101D2A0
SHA-256:	747B21F2A5B7D64E2F14F6355E9677CDB8B80041E7405ED46FBE372D2982E241
SHA-512:	9F40CF3BCC0E5AF32C9153061D8355BDB2BD9930DD6B178929FD294FE0EB6037A38FA5FE223828369EC45713FF0FEF1377F960DA63E0F728578410B23D67A3C1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import functools.import json.import re.import itertools..from .common import InfoExtractor.from ..compat import (. compat_kwargs,. compat_HTTPError,. compat_str,. compat_urlparse,.).from ..utils import (. determine_ext,. ExtractorError,. js_to_json,. int_or_none,. merge_dicts,. NO_DEFAULT,. OnDemandPagedList,. parse_filesize,. RegexNotFoundError,. sanitized_Request,. smuggle_url,. std_headers,. try_get,. unified_timestamp,. unsmuggle_url,. urlencode_postdata,. unescapeHTML,.)...class VimeoBaseInfoExtractor(InfoExtractor):. _NETRC_MACHINE = 'vimeo'. _LOGIN_REQUIRED = False. _LOGIN_URL = 'https://vimeo.com/log_in'.. def _login(self):. username, password = self._get_login_info(). if username is None:. if self._LOGIN_REQUIRED:. raise ExtractorError('No login info available, needed for using %s.' % self.IE_N

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-59FMO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3923
Entropy (8bit):	4.615988227346997
Encrypted:	false
SSDEEP:	96:YOZPwGe7OyKxEvvu7fJfZfNl7WdgUU6WdrBTecNt/896Ng:tZPBA/vQJxbq+TY96Ng
MD5:	A97947BAD79B85BB39B5D56B7D663607
SHA1:	A4C3C22C9F0FE1D748E1EF9616154F36E73D6D00
SHA-256:	3E7781D523CFE097C37DDF5463E248C9230EE840BAA2FEC4E7DEB8899E3AF8F8
SHA-512:	A9F4BFA6EA2EAEFEC30E1F9A183D82B006C8F9B33007948CB215A68B4319469D8146305F8A4E81BCFCF7188A6FC8FAE6CE6531B07B94B01A1FB6B1C8B73D6009
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. determine_ext,. int_or_none,. sanitized_Request,.)...class VoiceRepublicIE(InfoExtractor):. _VALID_URL = r'https?://voicerepublic\.com/(?:talks\|embed)/(?P<id>[0-9a-z-]+)'. _TESTS = [{. 'url': 'http://voicerepublic.com/talks/watching-the-watchers-building-a-sousveillance-state',. 'md5': 'b9174d651323f17783000876347116e3',. 'info_dict': {. 'id': '2296',. 'display_id': 'watching-the-watchers-building-a-sousveillance-state',. 'ext': 'm4a',. 'title': 'Watching the Watchers: Building a Sousveillance State',. 'description': 'Secret surveillance programs have metadata too. The people and companies that operate secret surveillance programs can be surveilled.',. 'thumbnail': r're:^https?://.*\.(?:png\|jpg)$',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5B00F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5333
Entropy (8bit):	4.762736336467127
Encrypted:	false
SSDEEP:	96:PQ7x8jrWKrgLQqsiegrgviAOumPhdb8fPmZrwrTO1UALOl6Z2aatWBTAdNNd4EUL:iorKLWvviZuChdbqPLvO1pLOlq2aatyt
MD5:	16A1878A60026B969F278EAE00FA50EF
SHA1:	6B45320710263F4C15B32BB5CAE01A3293CF0166
SHA-256:	4513B3CF315537C0EEC7F169D0031EEEB0E00A723C5AB8B1C2DBF59FB9D9EB69
SHA-512:	60B4726CBC769467C0697EDEBE974FAA14B3152A052C9A35486E446CE0EA084EEA8CF15DAE9B44E598EDEDAF94717D83A658FC7AF7BD93507853141D22349412
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. url_or_none,.)...class AolIE(InfoExtractor):. IE_NAME = 'aol.com'. _VALID_URL = r'(?:aol-video:\|https?://(?:www\.)?aol\.(?:com\|ca\|co\.uk\|de\|jp)/video/(?:[^/]+/)*)(?P<id>[0-9a-f]+)'.. _TESTS = [{. # video with 5min ID. 'url': 'https://www.aol.com/video/view/u-s--official-warns-of-largest-ever-irs-phone-scam/518167793/',. 'md5': '18ef68f48740e86ae94b98da815eec42',. 'info_dict': {. 'id': '518167793',. 'ext': 'mp4',. 'title': 'U.S. Official Warns Of \'Largest Ever\' IRS Phone Scam',. 'description': 'A major phone scam has cost thousands of taxpayers more than $1 million, with less than a month until income tax returns are due to the IRS.',. 'timestamp': 13954

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5D8EA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5336
Entropy (8bit):	4.671623676147143
Encrypted:	false
SSDEEP:	96:YOXVbSh3wRdLxs5lI8hVVMKq98c3inlX295nMSZXhOYMiYsoYH95pCNBTSbc9kgp:tXhSh3+LxuIeVmKHlGjnMaROYMiYsoYm
MD5:	B0B9ADFA762FB84D3D92C345D37A36F7
SHA1:	112665F1F3FD64FD602C7A879F14BF791D644BDD
SHA-256:	0A4C2B8D889FF026E0ABAE1E914BB3EE8096E2A80D66DFA5765C1BBE65B0B75E
SHA-512:	46F9DF6D599944F64ED58A87E269C6F319A84103B810C47B604FDA0AF53A7DDD7CCE626E56E786B255791F9FA08F592D598632E339EA4835D29D341D9FD26BD7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. determine_ext,. ExtractorError,. float_or_none,. int_or_none,. mimetype2ext,. parse_iso8601,. strip_jsonp,.)...class ArkenaIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. video\.arkena\.com/play2/embed/player\?\|. play\.arkena\.com/(?:config\|embed)/avp/v\d/player/media/(?P<id>[^/]+)/[^/]+/(?P<account_id>\d+). ). '''. _TESTS = [{. 'url': 'https://play.arkena.com/embed/avp/v2/player/media/b41dda37-d8e7-4d3f-b1b5-9a9db578bdfe/1/129411',. 'md5': 'b96f2f71b359a8ecd05ce4e1daa72365',. 'info_dict': {. 'id': 'b41dda37-d8e7-4d3f-b1b5-9a9db578bdfe',. 'ext': 'mp4',. 'title': 'Big Buck Bunny

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5F90G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	16598
Entropy (8bit):	4.52371239431554
Encrypted:	false
SSDEEP:	384:yMUKNuSkdT+OVknL0g8Qe2ZUNzoa4OZ+YX8Q58rRdqo4sqoN10m9SVy/FhPqjdBo:wKfnL0g8Qe2ZUNzoa4OZJX8Q6Rdqo4s7
MD5:	679137AEFF204AEA569F1BA9D32508AA
SHA1:	47E19FFF838172ECBA07AFB6B321954EC389E2CE
SHA-256:	8D58E871A66591CAC0FA6D5A4C17DBE105BB5CC8E78EBB16B39051CEDB1FBB8D
SHA-512:	B1F112554B3D0FE030A255F0CDF9152D311BB440ECB08AE7A674583DD4DC64D38B03EE4116A4435DAAABC5C9CEEEB38C937792D198D40874CB58F23008D26ABC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import random.import re.import time..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. parse_duration,. try_get,. urlencode_postdata,.)...class NexxIE(InfoExtractor):. _VALID_URL = r'''(?x). (?:. https?://api\.nexx(?:\.cloud\|cdn\.com)/v3/(?P<domain_id>\d+)/videos/byid/\|. nexx:(?:(?P<domain_id_s>\d+):)?\|. https?://arc\.nexx\.cloud/api/video/. ). (?P<id>\d+). '''. _TESTS = [{. # movie. 'url': 'https://api.nexx.cloud/v3/748/videos/byid/128907',. 'md5': '31899fd683de49ad46f4ee67e53e83fe',. 'info_dict': {. 'id': '128907',. 'ext': 'mp4',. 'title': 'Stiftung Warentest',. 'alt_title': 'Wie ein Tes

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5HEE2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7292
Entropy (8bit):	5.073712094736978
Encrypted:	false
SSDEEP:	192:xJ6tedv2ezHVr+kjjaoxtw3ZJs2ovB0xypN+lJWEq:T6tQv2wr+kjjxWHoJi8Eq
MD5:	55FA43B24FFA088897116F1DDCFB5D1F
SHA1:	F3FCD3B82CDB8C5797BEE0ACA45D4E507BF88A8C
SHA-256:	0D63E2F6777E16C4C270D5C9B26F2C65C86E9BA0C8CB32A130B7BA66C3B5777A
SHA-512:	5D0C1C2DB929BF996E2AA193A846C832622706D1CC89F41EE5D1951C62E0D9DB86E37C36328694E16B758B06194C06D4FA0A28E95D93CF0447A3FE7ECE530462
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. ExtractorError,. NO_DEFAULT,. sanitized_Request,. urlencode_postdata,.)...class NovaMovIE(InfoExtractor):. IE_NAME = 'novamov'. IE_DESC = 'NovaMov'.. _VALID_URL_TEMPLATE = r'''(?x). http://. (?:. (?:www\.)?%(host)s/(?:file\|video\|mobile/\#/videos)/\|. (?:(?:embed\|www)\.)%(host)s/embed(?:\.php\|/)?\?(?:.*?&)?\bv=. ). (?P<id>[a-z\d]{13}). '''. _VALID_URL = _VALID_URL_TEMPLATE % {'host': r'novamov\.com'}.. _HOST = 'www.novamov.com'.. _FILE_DELETED_REGEX = r'This file no longer exists on our servers!</h2>'. _FILEKEY_REGEX = r'flashvars\.filekey=(?P<filekey>"?[^"]+"?);'. _TITLE_REGEX = r'(?s)<div class

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5HT0U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6169
Entropy (8bit):	4.409613398479906
Encrypted:	false
SSDEEP:	96:7chYhD8SSHMxHVCJtor1YL8cbYlxZ/pgSVBDtXtvwQppLb4ZRuQUngN6cuK5yRYl:j8rsnrhx5pg/SL8iTq8yrYV97c
MD5:	FC0E9039044FEE8A0AA42205F82D847C
SHA1:	728021A97C1BB6DE077063F9FADF7A7B28A91791
SHA-256:	45841C68FA63D229B575BC9CF90B04DB1869D65C4A5E06A59AA82F7064BD4F21
SHA-512:	2BF1632095BAB5388987F82E9AA26ED69A5C3FD59EBFFCE333C97824025D142D57B32E1A7857363A1019ADDEE5715D88CFD22BF8E9076371AE4D15419555CC09
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .vimeo import VimeoIE.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. merge_dicts,. try_get,. unescapeHTML,. unified_timestamp,. urljoin,.)...class RayWenderlichIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. videos\.raywenderlich\.com/courses\|. (?:www\.)?raywenderlich\.com. )/. (?P<course_id>[^/]+)/lessons/(?P<id>\d+). '''.. _TESTS = [{. 'url': 'https://www.raywenderlich.com/3530-testing-in-ios/lessons/1',. 'info_dict': {. 'id': '248377018',. 'ext': 'mp4',. 'title': 'Introduction',. 'description': 'md5:804d031b3efa9fcb49777d512d74f722',. 'timestamp': 1513906277,. 'upload_date': '20171

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5IDMG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (346)
Category:	dropped
Size (bytes):	2261
Entropy (8bit):	5.030497986852434
Encrypted:	false
SSDEEP:	48:+uIhfM7eN7CvRtfjXhkuBAvQEVSuvl8PgW7wkM9wToHRKU0QVGMAAtc:0pM7eN7CvffatvQab9dKPIHtc
MD5:	345A692209044A295038A651B9ACAAE0
SHA1:	20DBDC5811772C6E0042625D808B425C32B2AA10
SHA-256:	440E9541E72C0A0CB3D63006842B0F74F967A652F1FF5391621DE1EA62088256
SHA-512:	4825E79EA68CA4A77A86E6E7BD8799CBBA0D48A41A6F3A906F932DC18EC73C59B4B4B69BAEFF414B88135BF15C89B2D833DF79AB69BC931662613B3AFED92DAB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor..from ..utils import (. sanitized_Request,. xpath_text,. xpath_with_ns,.)...class RegioTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?regio-tv\.de/video/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.regio-tv.de/video/395808.html',. 'info_dict': {. 'id': '395808',. 'ext': 'mp4',. 'title': 'Wir in Ludwigsburg',. 'description': 'Mit unseren zuckers..en Adventskindern, au.erdem besuchen wir die Abendsterne!',. }. }, {. 'url': 'http://www.regio-tv.de/video/395808',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. key = self._search_regex(. r'key\s:\s(["\'])(?P<key>.+?)\1', webpage, 'key', group='key'). title = self._og_search_title(webpage).. SO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5IOQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4661
Entropy (8bit):	4.64184070203181
Encrypted:	false
SSDEEP:	96:oUl8XqP0A3kDnDuh5mgbyVOyhe8V7+Iav4s1RKV13AUml26Ax1agoSTag98vhJUV:oUUA3kX25FyIYSIav4rV13All26AjagN
MD5:	9E86B9CCF55B65D048CEFD071F64F87A
SHA1:	133FB68C70F12DDC2A10B8B48020AC1E657C45D4
SHA-256:	E0165544D9F140D007E041874B9BFC9EFB660CA9E7FA0A75F8224293A137A180
SHA-512:	33CAE96E4B089A18F49F7596ECBA0CE25D642563D82C9DCC3F6A7788B18463EEADFC6DB9888B12BC2DD6D2773D86723B1FC746CDB3D6E0760D2EC1AC6A9F5840
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. remove_end,. xpath_element,. xpath_text,.)...class DigitallySpeakingIE(InfoExtractor):. _VALID_URL = r'https?://(?:s?evt\.dispeak\|events\.digitallyspeaking)\.com/(?:[^/]+/)+xml/(?P<id>[^.]+)\.xml'.. _TESTS = [{. # From http://gdcvault.com/play/1023460/Tenacious-Design-and-The-Interface. 'url': 'http://evt.dispeak.com/ubm/gdc/sf16/xml/840376_BQRC.xml',. 'md5': 'a8efb6c31ed06ca8739294960b2dbabd',. 'info_dict': {. 'id': '840376_BQRC',. 'ext': 'mp4',. 'title': 'Tenacious Design and The Interface of \'Destiny\'',. },. }, {. # From http://www.gdcvault.com/play/1014631/Classic-Game-Postmortem-PAC. 'url': 'http://events.digitallyspeaking.com/gdc/sf11/xml/12396_1299111843500GMPX.xml',. 'only_matching': True,. }, {. # From http://www.gdc

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5L3N6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1894
Entropy (8bit):	4.75852148720034
Encrypted:	false
SSDEEP:	48:+uj2wqHLFWrD1qii/WS5jXjMBDl74VzEKR8oxJr4sD/TE:X2wqHLFWrgilS52lVoxJr4szTE
MD5:	419EA0836984EAB1E7FD260E73D09ADA
SHA1:	2AC8BAA4E3BC8DBBA3011FC7235EC140A0A2B920
SHA-256:	1630A290AB4D32B667C3AA0A6ED7BCC66884EED86EAAF31545BF87D0EEA911BB
SHA-512:	D6AFF57FCF66CCBB09D154D76C328EDCA509D1B80091319A1F42C5A120FF495EB4879C8E95DB2E4978EFCBA7404FC0CFDABE355307E4A7F7F11E2EAE88318F1F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. float_or_none,. smuggle_url,.)...class TVAIE(InfoExtractor):. _VALID_URL = r'https?://videos\.tva\.ca/details/_(?P<id>\d+)'. _TEST = {. 'url': 'https://videos.tva.ca/details/_5596811470001',. 'info_dict': {. 'id': '5596811470001',. 'ext': 'mp4',. 'title': 'Un extrait de l\'.pisode du dimanche 8 octobre 2017 !',. 'uploader_id': '5481942443001',. 'upload_date': '20171003',. 'timestamp': 1507064617,. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/5481942443001/default_default/index.html?videoId=%s'.. def _real_extract(self, url):. video_id = self._match_id(url). video_data = self._download_json(. 'https://videos.tva.ca/proxy/item/_' + vi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5MRCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	4.91845409845491
Encrypted:	false
SSDEEP:	48:Pu4Qx97apfcVVfCvV0r5uQNv1tfjXjloawvapvFqbsBCnDTWk:OxIxcXavV0r5pvTfKVaVFCVnDTWk
MD5:	14C76EE1A1BF0CB17D57DF161522156F
SHA1:	8F09184BDB41F0509262DA4056F1A135D4E1D800
SHA-256:	F64FCF6844693F96F72B10BD7324EA6F96179A244311985FC85A5914F6A608DE
SHA-512:	B0E654B91265A4B5E2A7D194D9509AEAE0DABE83FC455A1EAEA0EC3A873B724CD791817F1D459303CD61617E65E849B734BBFA8B4E551BDB15E6ABB13F116C95
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. unified_strdate,. clean_html,.)...class ArchiveOrgIE(InfoExtractor):. IE_NAME = 'archive.org'. IE_DESC = 'archive.org videos'. _VALID_URL = r'https?://(?:www\.)?archive\.org/(?:details\|embed)/(?P<id>[^/?#]+)(?:[?].*)?$'. _TESTS = [{. 'url': 'http://archive.org/details/XD300-23_68HighlightsAResearchCntAugHumanIntellect',. 'md5': '8af1d4cf447933ed3c7f4871162602db',. 'info_dict': {. 'id': 'XD300-23_68HighlightsAResearchCntAugHumanIntellect',. 'ext': 'ogg',. 'title': '1968 Demo - FJCC Conference Presentation Reel #1',. 'description': 'md5:da45c349df039f1cc8075268eb1b5c25',. 'upload_date': '19681210',. 'uploader': 'SRI International'. }. }, {. 'url': 'https://archive.org/details/Cops1922',. 'md5': '0869000b4ce265e8ca62738b336b268a',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5OV6O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4681
Entropy (8bit):	4.684194376036062
Encrypted:	false
SSDEEP:	96:anO5NbKdbxvJ6mVeY8GG2PETT9fb1zvdYggtm/J8Adr3DC1rExjwAvMeZ51oGBTD:j7WdFEgeY8GGEETTdb17ibtc8Adr3DCw
MD5:	C00881874D96CEC6ED42E3F650333A6E
SHA1:	5CEDDA775B42CF10AA50DEAF7A94B613EE2E0BAB
SHA-256:	3D80DB8571890F8EC77D359299126302C50704B0619279722A063A7754DD6993
SHA-512:	B44298DD9066FA6FD2DA9B1BA1655D0CD1F90F02AD777DF4CAAF6AB9B1FC4A6A600A9A85B70AA8954C5E177C3F76DC0B6D6E152F6285E77876A657C00E099C60
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time..from .common import InfoExtractor.from ..utils import (. determine_ext,. js_to_json,.)...class IPrimaIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+)\.iprima\.cz/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _GEO_BYPASS = False.. _TESTS = [{. 'url': 'http://play.iprima.cz/gondici-s-r-o-33',. 'info_dict': {. 'id': 'p136534',. 'ext': 'mp4',. 'title': 'Gond.ci s. r. o. (34)',. 'description': 'md5:16577c629d006aa91f59ca8d8e7f99bd',. },. 'params': {. 'skip_download': True, # m3u8 download. },. }, {. 'url': 'http://play.iprima.cz/particka/particka-92',. 'only_matching': True,. }, {. # geo restricted. 'url': 'http://play.iprima.cz/closer-nove-pripady/closer-nove-pripady-iv-1',. 'only_matching': True,. }, {. # iframe api.play-backend.iprima.cz. 'url': 'https://pri

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5QDME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4444
Entropy (8bit):	4.682099036312254
Encrypted:	false
SSDEEP:	96:W8GjbJqLgj0FvsLCEgj5NFgfxBc3YybFvIy2NwEFjRp8a3Bk:KVqDFkLUF2+YyzEWSk
MD5:	9C3C743673D317F1A34D670760EA873A
SHA1:	E9F3D76129AB7FA1F6C109F7A4CC79AAE2C29EE9
SHA-256:	615DE94DE170D35F2AD485DA2BFCF62D63C08BD28BD8E40FEF3BB9C8FD5CA796
SHA-512:	FCAB26206ADB8FA2CA6ED38B761909B5A2353BFF0AC5B13C736E6730D0A20595358D500416C5F0F901E98418973C2EE08A21ED14DC0D0C2E4D5DDDD5346BB453
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. smuggle_url,. parse_duration,.)...class MiTeleIE(InfoExtractor):. IE_DESC = 'mitele.es'. _VALID_URL = r'https?://(?:www\.)?mitele\.es/(?:[^/]+/)+(?P<id>[^/]+)/player'.. _TESTS = [{. 'url': 'http://www.mitele.es/programas-tv/diario-de/57b0dfb9c715da65618b4afa/player',. 'info_dict': {. 'id': 'FhYW1iNTE6J6H7NkQRIEzfne6t2quqPg',. 'ext': 'mp4',. 'title': 'Tor, la web invisible',. 'description': 'md5:3b6fce7eaa41b2d97358726378d9369f',. 'series': 'Diario de',. 'season': 'La redacci.n',. 'season_number': 14,. 'season_id': 'diario_de_t14_11981',. 'episode': 'Programa 144',. 'episode_number': 3,. 'thumbnail': r're:(?i)^https?://.*\.jpg$',. 'duration': 2913,. },. 'add_ie': ['Ooyala'],. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5SLS5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	4.814613342416339
Encrypted:	false
SSDEEP:	24:zi8lzvRGOw5w/pdl0lMyOZHdfFs1lgtzitYVd4aBxsioBrHdbTllPMvjP5mTe6K0:+uFPwwpIl6ZHdfFklkzVr4aPsJBrHBTJ
MD5:	4379A3953F0BECC16383D89D8493F507
SHA1:	387ABE35D0DC28D2C0CC027F5473571B728568F5
SHA-256:	C651D149F26437668A7145944EC7A1014F4FE186311D28DF71317C189FD8C205
SHA-512:	A1710F5140B9641F75626B54704433637592FDBE2C18F06A61CC210633E637A8810B468BF69BCCD434AD2A5D0C3D61800D6543BFAF6A8D375D276CAB8911AEAC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class MoviezineIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?moviezine\.se/video/(?P<id>[^?#]+)'.. _TEST = {. 'url': 'http://www.moviezine.se/video/205866',. 'info_dict': {. 'id': '205866',. 'ext': 'mp4',. 'title': 'Oculus - Trailer 1',. 'description': 'md5:40cc6790fc81d931850ca9249b40e8a4',. 'thumbnail': r're:http://.*\.jpg',. },. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id').. webpage = self._download_webpage(url, video_id). jsplayer = self._download_webpage('http://www.moviezine.se/api/player.js?video=%s' % video_id, video_id, 'Downloading js api player').. formats = [{. 'format_id': 'sd',. 'url': self._html_search_regex(r'file: "(.+?)",', jsplayer, 'file'),. 'qual

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5SMJ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4321
Entropy (8bit):	4.560798616238806
Encrypted:	false
SSDEEP:	96:a8EfaoHN5kjXUbXGAMpggAABYEVsSXBTNh6/6NQ:a8X8N5gyWAMueTVsSxT46NQ
MD5:	9A20619DAF9A088F467DCC611AF06113
SHA1:	958C74BFA1AA7F330B4DFEDB61F19528FE41BB66
SHA-256:	42D19321B09226B49D869D91DBE99B42FCB164954A9DFC62EB96BD1A82FE60DF
SHA-512:	B1C116FE640D88F122FDDCD522555349614289EBFD82E7F6EFD08FF7ED489B3B199D7399B4774F96600A82E01038572BB06FD689EC9C460CA3474B25B9057CDC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. HEADRequest,. ExtractorError,. int_or_none,. update_url_query,. qualities,. get_element_by_attribute,. clean_html,.)...class SinaIE(InfoExtractor):. _VALID_URL = r'''(?x)https?://(?:.?\.)?video\.sina\.com\.cn/. (?:. (?:view/\|.\#)(?P<video_id>\d+)\|. .+?/(?P<pseudo_id>[^/?#]+)(?:\.s?html)\|. # This is used by external sites like Weibo. api/sinawebApi/outplay.php/(?P<token>.+?)\.swf. ). '''.. _TESTS = [. {. 'url': 'http://video.sina.com.cn/news/spj/topvideoes20160504/?opsubject_id=top1#250576622',. 'md5': 'd38433e2fc886007729735650ae4b3e9',. 'info_dict': {. 'id': '250576622',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5UIA1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	4.858136988026474
Encrypted:	false
SSDEEP:	24:1R8lFvQGmDOw8tV/X1Ldl5k8e7QCVeIXjlgthZBx+tnVw5FHwI8W5DhmXblDDc4:PuSitPX1L68eXVjXjlkhZBGnVw3b8W52
MD5:	57FEA2570FB58190EB10AA23FEC2996B
SHA1:	47991A2F256761302A132770DF4F333B76F1DD4B
SHA-256:	133ED8F58CEB2F5A8DD618DEDAB3207CFF7EC7E0707917EDE522151AF5298F33
SHA-512:	46AF63AE577F27D9424FABB28654922529E1C39507350C6F88AA31D3DF6E1796EA84CB6357F8BD12DA6A9181533E9997C6D6246E73CB4DB4424ADCC4781E8EBC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .internetvideoarchive import InternetVideoArchiveIE...class RottenTomatoesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rottentomatoes\.com/m/[^/]+/trailers/(?P<id>\d+)'.. _TEST = {. 'url': 'http://www.rottentomatoes.com/m/toy_story_3/trailers/11028566/',. 'info_dict': {. 'id': '11028566',. 'ext': 'mp4',. 'title': 'Toy Story 3',. 'description': 'From the creators of the beloved TOY STORY films, comes a story that will reunite the gang in a whole new way.',. 'thumbnail': r're:^https?://.*\.jpg$',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). iva_id = self._search_regex(r'publishedid=(\d+)', webpage, 'internet video archive id').. return {. '_type': 'url_transparent',. 'url': 'http://video.in

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-5UL13.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10609
Entropy (8bit):	4.577486889401732
Encrypted:	false
SSDEEP:	192:Satp5eyGuZKVt+eF0J8ypSH58HnEQQhXOb+e3/fEjYhIuHImwiK0JmRH027mmuyV:Saj5eyGuZct+eF0J8YK5SDQhOb+e3XEh
MD5:	882BA40B68097C62D60BE9F5C456A9D9
SHA1:	EF1EA1656C1ECDB1DF83469952C132980C51B659
SHA-256:	00BF455F3CFBF83D54925951BC5162D168FEBDA5DAA3C210DE1CECB5C137B3E2
SHA-512:	4859C3EC14DA32A8DC95CBE8F0EFB8D9F5483E4C7C271749037C006BF7D807D6E556031D42511F4CADF3BF329CA642BAC514809E1B266B328E12E12D85DB68A9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .xstream import XstreamIE.from ..utils import (. ExtractorError,. float_or_none,. try_get,.)...class VGTVIE(XstreamIE):. IE_DESC = 'VGTV, BTTV, FTV, Aftenposten and Aftonbladet'. _GEO_BYPASS = False.. _HOST_TO_APPNAME = {. 'vgtv.no': 'vgtv',. 'bt.no/tv': 'bttv',. 'aftenbladet.no/tv': 'satv',. 'fvn.no/fvntv': 'fvntv',. 'aftenposten.no/webtv': 'aptv',. 'ap.vgtv.no/webtv': 'aptv',. 'tv.aftonbladet.se/abtv': 'abtv',. 'www.aftonbladet.se/tv': 'abtv',. }.. _APP_NAME_TO_VENDOR = {. 'vgtv': 'vgtv',. 'bttv': 'bt',. 'satv': 'sa',. 'fvntv': 'fvn',. 'aptv': 'ap',. 'abtv': 'ab',. }.. _VALID_URL = r'''(?x). (?:https?://(?:www\.)?. (?P<host>. %s. ). /?.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-601K9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	4.67415478693249
Encrypted:	false
SSDEEP:	96:5GxjXXUsn2PUPPV0n2VfauSrv13VSN8hJxGZvRftN8B:CHgPUPPBVaPdNEUB
MD5:	7A5DAD524033DF11658FB53746F42F0D
SHA1:	91E7B30ED5974E64C3D474C17C52B99E3DCF0ED4
SHA-256:	E389EF9282E9F8E9D52E1F8795CD86A33CFEDE601D870BA9E6F97626835D1744
SHA-512:	4D4CB17A1E29CA693C8665F4A05078FCD2279B1BFFC1A540B00D536AE6B34122DA155207ACDA8E4DBECDF65908A292A1FF6A5B19B38A1477F7D0A8C5895A5949
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. fix_xml_ampersands,. float_or_none,. xpath_with_ns,. xpath_text,.)...class KarriereVideosIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?karrierevideos\.at(?:/[^/]+)+/(?P<id>[^/]+)'. _TESTS = [{. 'url': 'http://www.karrierevideos.at/berufsvideos/mittlere-hoehere-schulen/altenpflegerin',. 'info_dict': {. 'id': '32c91',. 'ext': 'flv',. 'title': 'AltenpflegerIn',. 'description': 'md5:dbadd1259fde2159a9b28667cb664ae2',. 'thumbnail': r're:^http://.*\.png',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }, {. # broken ampersands. 'url': 'http://www.karrierevideos.at/orientierung/vaeterkarenz-und-neue-chancen-fuer-muetter-baby-was-nun',. 'info_dict': {. 'id': '5

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-60Q6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (484)
Category:	dropped
Size (bytes):	35338
Entropy (8bit):	4.667598241947362
Encrypted:	false
SSDEEP:	768:K0dqlDzkG4jbI1qLWgttpi3gOtN1YkiTTkewtb+/tiyzHfGOGVoGRQ3ivOoTw/nk:AZ4OqLWgtts3gOtN1YkiTTkewtb+/tib
MD5:	88B65F1E124F635E0CDCE3955EC21717
SHA1:	6521F0D692F1DAABF085B46FC240E2D8CA9BEE50
SHA-256:	A10859E41A73227EAF618B51C44CFF8588C4720259D40735DFBDA80A9D8F6529
SHA-512:	E359A71D3F09D2E63AC124A768A3C4BA8401BAC76C07F87C6B48B64CEA463DE60A9ACC0762A0D41171CABF2C6472ACCE68195B90A13718A5B3A1BD215A00CB77
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import json.import re.import struct..from .common import InfoExtractor.from .adobepass import AdobePassIE.from ..compat import (. compat_etree_fromstring,. compat_parse_qs,. compat_str,. compat_urllib_parse_urlparse,. compat_urlparse,. compat_xml_parse_error,. compat_HTTPError,.).from ..utils import (. determine_ext,. ExtractorError,. extract_attributes,. find_xpath_attr,. fix_xml_ampersands,. float_or_none,. js_to_json,. int_or_none,. parse_iso8601,. unescapeHTML,. unsmuggle_url,. update_url_query,. clean_html,. mimetype2ext,.)...class BrightcoveLegacyIE(InfoExtractor):. IE_NAME = 'brightcove:legacy'. _VALID_URL = r'(?:https?://.brightcove\.com/(services\|viewer).?\?\|brightcove:)(?P<query>.*)'. _FEDERATED_URL = 'http://c.brightcove.com/services/viewer/htmlFederated'.. _TESTS = [. {. # From http://www.8tv.cat/8aldia/videos/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-61475.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4987
Entropy (8bit):	4.834925795529843
Encrypted:	false
SSDEEP:	96:TOGPsNeWJ5vDqDEdYTOt9xtu8Xa/P6gPyTaiB8CPN668K1a/4bpQ3bfqJTEcctRa:iG6l0DEyTypQ4t2qidtRRNRTk6Ng
MD5:	69FA3D752783AD7326CCA46C23972281
SHA1:	9F03C26F4066EE4229373C73440887949631EE52
SHA-256:	C1E499D37566A5605DE921A4F1114DDD6969F757FC83A66ECBE1CB9B5F5421AA
SHA-512:	09F2BD177C6876A82A98EFCEDD5F062AC2021E544CA01B6C9008B048D5927CBFB94AF1C525634368EFAF8DEF8516FD1CB83EBD285E5E37B2B93B61D6E97CE0C1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..from ..compat import (. compat_b64decode,. compat_urllib_parse_unquote,. compat_urlparse,.).from ..utils import (. determine_ext,. update_url_query,.).from .bokecc import BokeCCBaseIE...class InfoQIE(BokeCCBaseIE):. _VALID_URL = r'https?://(?:www\.)?infoq\.com/(?:[^/]+/)+(?P<id>[^/]+)'.. _TESTS = [{. 'url': 'http://www.infoq.com/presentations/A-Few-of-My-Favorite-Python-Things',. 'md5': 'b5ca0e0a8c1fed93b0e65e48e462f9a2',. 'info_dict': {. 'id': 'A-Few-of-My-Favorite-Python-Things',. 'ext': 'mp4',. 'description': 'Mike Pirnat presents some tips and tricks, standard libraries and third party packages that make programming in Python a richer experience.',. 'title': 'A Few of My Favorite [Python] Things',. },. }, {. 'url': 'http://www.infoq.com/fr/presentations/changez-avis-sur-javascript',. 'only_matching': True,. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6353N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3424
Entropy (8bit):	4.747054901473744
Encrypted:	false
SSDEEP:	96:8nZnX5S7obfaah3e4kYJ7WXlbBP+Dj4Uty/7RO:kFpbaYOi7WP4
MD5:	FFCD579D64990DD0E61E107F4C065455
SHA1:	7404F01A77E53461A1BA088D08AFBB6A1539A06F
SHA-256:	84552FC9B65A4807A193E48A50703C578176389ED4D397F30BC8FA664757D1A1
SHA-512:	A2E04A5A0C19A1CF807CBEB2F2D77599559EE5E74AC3211C0625E4B9AFE8EE60E4242500000A389FB61A0006200AACFC7F098FFFAEFAFC5F7BACB9EFCD5CED52
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. try_get,. unified_strdate,.)...class AmericasTestKitchenIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?americastestkitchen\.com/(?:episode\|videos)/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.americastestkitchen.com/episode/548-summer-dinner-party',. 'md5': 'b861c3e365ac38ad319cfd509c30577f',. 'info_dict': {. 'id': '1_5g5zua6e',. 'title': 'Summer Dinner Party',. 'ext': 'mp4',. 'description': 'md5:858d986e73a4826979b6a5d9f8f6a1ec',. 'thumbnail': r're:^https?://.*\.jpg',. 'timestamp': 1497285541,. 'upload_date': '20170612',. 'uploader_id': 'roger.metcalf@americastestkitchen.com',. 'release_date': '20170617',. 'series': "America's Test Kitchen",. 'season_number': 17,. 'epis

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-64E1V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4090
Entropy (8bit):	4.823985934295519
Encrypted:	false
SSDEEP:	96:lOVlVjwK6HQnrMkZHcfG6tdV35h3C1BumNR34lGifBTYvgOmsxRjt3U6Ne:0bJwonIk0G6RgBuO34lzTYrx06Ne
MD5:	3C8D487145F094D705BBDFF488C754FF
SHA1:	B310EFE58E830C6564761AAB7BE2EAA69E022B89
SHA-256:	E9B2F88A5A76341F3EE50294ACFF58D54C678381F803F33EFA68764E28E055E8
SHA-512:	7856F9D81C21F97B23E5E3F082D4BCEC4F05EB2744746D50825BEB7251483AF4FCD2123683DFA55A998C31E96B42D2FAABC38BB47948992F67AFBD2237EDEED0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. js_to_json,. urljoin,.)...class PornHdIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pornhd\.com/(?:[a-z]{2,4}/)?videos/(?P<id>\d+)(?:/(?P<display_id>.+))?'. _TESTS = [{. 'url': 'http://www.pornhd.com/videos/9864/selfie-restroom-masturbation-fun-with-chubby-cutie-hd-porn-video',. 'md5': '87f1540746c1d32ec7a2305c12b96b25',. 'info_dict': {. 'id': '9864',. 'display_id': 'selfie-restroom-masturbation-fun-with-chubby-cutie-hd-porn-video',. 'ext': 'mp4',. 'title': 'Restroom selfie masturbation',. 'description': 'md5:3748420395e03e31ac96857a8f125b2b',. 'thumbnail': r're:^https?://.*\.jpg',. 'view_count': int,. 'like_count': int,. 'age_limit': 18,. }. }, {. # removed video.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-64SGL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13653
Entropy (8bit):	4.600209867299367
Encrypted:	false
SSDEEP:	384:pE4Xv12zUId0kcaJNnvtj9RDHjkkOdb+eFczP6tTveTK9yVUu3y:pE4Xv1W1n7jxOdbDFczP6tTveny
MD5:	CDC9AB43C73CDF6B55862F80F4494E34
SHA1:	EB58D354A23CC73846D76653601EDF511CE52928
SHA-256:	BE20F47A2A40372F5905F2814F0446F561356055D232E78CA600789D85EEFB08
SHA-512:	F34E579F3DD6E7F9C0771C83EC63D5D94BDDE156273EC070BE241497532EF59A45978F524A49F7344C8384BE5EA4C2C6457D9B031B573F954000630486F91651
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import hmac.import itertools.import json.import re.import time..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. parse_age_limit,. parse_iso8601,. sanitized_Request,.)...class VikiBaseIE(InfoExtractor):. _VALID_URL_BASE = r'https?://(?:www\.)?viki\.(?:com\|net\|mx\|jp\|fr)/'. _API_QUERY_TEMPLATE = '/v4/%sapp=%s&t=%s&site=www.viki.com'. _API_URL_TEMPLATE = 'https://api.viki.io%s&sig=%s'.. _APP = '100005a'. _APP_VERSION = '2.2.5.1428709186'. _APP_SECRET = 'MM_d*yP@`&1@]@!AVrXf_o-HVEnoTnm$O-ti4[G~$JDI/Dc-&piU&z&5.;:}95=Iad'.. _GEO_BYPASS = False. _NETRC_MACHINE = 'viki'.. _token = None.. _ERRORS = {. 'geo': 'Sorry, this content is not available in your region.',. 'upcoming': 'Sorry, this content is not yet available.',. # 'paywall': 'paywall',. }.. def _prepare_call(self, path, timestamp=None, post_data=None):.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-66K3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11895
Entropy (8bit):	5.083801452241362
Encrypted:	false
SSDEEP:	192:OBBQpey7t6V4D20bGUbGZibg4S++4Cl8oAi/6owTQ6NQ51hwNhXIh:OfQpeYtyz/fEbgg+IoAi/6owTQ6NohwE
MD5:	E03559279F7DC69D4A3BEED713B03CB2
SHA1:	06F76E09A310DC8CA0B22A41198B556FEE78804C
SHA-256:	13A684FEC7B08CE7312C5ACA621AE748FB9EEB75D73F03A40920B93C178AFAF5
SHA-512:	CE4FB3CA448112F89E373132CC76BFA2D1BE9ABCFDEC93B5B62AD98A934BD7C0630B90A3E59AD68817E55F801408E7A37B89F0E23B2AE38B268E5F8B87FC75DA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. parse_iso8601,. smuggle_url,. strip_jsonp,. unified_timestamp,. unsmuggle_url,. urlencode_postdata,.)...class BiliBiliIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.\|bangumi\.\|)bilibili\.(?:tv\|com)/(?:video/av\|anime/(?P<anime_id>\d+)/play#)(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.bilibili.tv/video/av1074402/',. 'md5': '5f7d29e1a2872f3df0cf76b1f87d3788',. 'info_dict': {. 'id': '1074402',. 'ext': 'flv',. 'title': '........',. 'description': 'md5:ce18c2a2d2193f0df2917d270f2e5923',. 'duration': 308.067,. 'timestamp': 1398012678,. 'upload_date': '20140420',. 'thumbnail': r're

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6E34R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4716
Entropy (8bit):	4.512419492433387
Encrypted:	false
SSDEEP:	96:wOBf07cH6o7Skv6amkeoxTHKkNTPPNl7Mit77OBT19t/8h6NYmBBw:F+7cao71vMToxvNTDpaTqh6NYmBi
MD5:	6BF06B0233C6D261DACBE768CF910537
SHA1:	40E6A323F5DC938BC925022ABD259F83EFC46D17
SHA-256:	0DE9764C62EA47AA6396F3267AB6E4EDBCDCC360A9BAB3C4FDB1485096B9FBD4
SHA-512:	7717C97A3B1212E5F08C62EA6F1AC3ADC2642E92B00FE4AC4E42501E5FAD0CB6E1E787EFF75552717F6963662E78768B1E325A1309597F6E4C1E5CCA9EB0EF12
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..aes import aes_decrypt_text.from ..compat import compat_urllib_parse_unquote.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. str_to_int,. strip_or_none,. url_or_none,.)...class KeezMoviesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?keezmovies\.com/video/(?:(?P<display_id>[^/]+)-)?(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.keezmovies.com/video/arab-wife-want-it-so-bad-i-see-she-thirsty-and-has-tiny-money-18070681',. 'md5': '2ac69cdb882055f71d82db4311732a1a',. 'info_dict': {. 'id': '18070681',. 'display_id': 'arab-wife-want-it-so-bad-i-see-she-thirsty-and-has-tiny-money',. 'ext': 'mp4',. 'title': 'Arab wife want it so bad I see she thirsty and has tiny money.',. 'thumbnail': None,. 'view_count': int,. 'age_limit': 18,. }. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6HP6M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5942
Entropy (8bit):	4.567516730825758
Encrypted:	false
SSDEEP:	96:y6BqRpCPF7Xjx8QyNpOPrvfViXjUqcQmpOVcfaUaIvjNbV6VELXOb3gog0+JBTGk:gRqFRUNWxqIlaU/RLXOb3gog0+nTmv9e
MD5:	660AA1713920B5D14C668C8DFBD580EF
SHA1:	9792FF18189AA1C3070D939999454FCD1F31D3B3
SHA-256:	893C479272EB4AEC2C4F1EA7449BB9F312219AF4A23A47890F4088DE4EC31735
SHA-512:	D8A3A28F121CC462BCDD961B8B2349A2B4035C4AE4D38C12395A0F7330804889BC0B54FB56A93430FB4FF02D4376FD1C2CE430F10356006B831AD65EFCD50635
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. js_to_json,. strip_or_none,. try_get,. unescapeHTML,. unified_timestamp,.)...class WatchBoxIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?watchbox\.de/(?P<kind>serien\|filme)/(?:[^/]+/)[^/]+-(?P<id>\d+)'. _TESTS = [{. # film. 'url': 'https://www.watchbox.de/filme/free-jimmy-12325.html',. 'info_dict': {. 'id': '341368',. 'ext': 'mp4',. 'title': 'Free Jimmy',. 'description': 'md5:bcd8bafbbf9dc0ef98063d344d7cc5f6',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 4890,. 'age_limit': 16,. 'release_year': 2009,. },. 'params': {. 'format': 'bestvideo',. 'skip_download': True,. },. 'expected_warnings': ['Failed to download m3u8 inform

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6IA6R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11470
Entropy (8bit):	4.9985669121899745
Encrypted:	false
SSDEEP:	192:ikDJzRnl1qoynLOr7irVCTs6860j4u5qd6QdJkJ5fb0GOUMKjfJJ2ILRTZep6Njt:VDznl1qoyLOr7irVCTs6860j4u5qd6QY
MD5:	DF671F8B3718FDA5615F822344FCE687
SHA1:	09BBEB52ED67C84CB9AE768B3110B0980069E4C5
SHA-256:	484DB6DC8967B0A29F5691307EC26853405D3ADBB305E43698B0DFE4FDA0DDD1
SHA-512:	E0273D033DB19CE90CE6B2D018497ED1CB0BA87D6088943FC2C517B4881C7D2B5A5EC8F8FB2D2DCACC0494AE291E988E4D1495B1A3B1FAFBEF3DC5560B7ACC8D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_parse_qs,. compat_urllib_parse_urlparse,.).from ..utils import (. determine_ext,. bool_or_none,. int_or_none,. try_get,. unified_timestamp,. url_or_none,.)...class RutubeBaseIE(InfoExtractor):. def _download_api_info(self, video_id, query=None):. if not query:. query = {}. query['format'] = 'json'. return self._download_json(. 'http://rutube.ru/api/video/%s/' % video_id,. video_id, 'Downloading video JSON',. 'Unable to download video JSON', query=query).. @staticmethod. def _extract_info(video, video_id=None, require_title=True):. title = video['title'] if require_title else video.get('title').. age_limit = video.get('is_adult'). if age_limit is not None:. age_limit = 18 if age_limit is True els

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6L4C1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1476
Entropy (8bit):	4.926123218003364
Encrypted:	false
SSDEEP:	24:zi8lFvS1Gm1YEwVhq/BFlEth/xHNqH1EwlHET/Ddlnqrh0gXHNqVfeIXhgtbQ7sI:+uQ1D1YEE6KtPNqVEhLD79uNqVfjXhkM
MD5:	33E8763FB550007B3DB12FBC1059744B
SHA1:	DA8CE47F7AAEF44218EE01C60040C2B90A27DC7C
SHA-256:	69488F800217FE7F87754BF86FEE8E573F16ABE5AF2D75C2A9898282099173D4
SHA-512:	C0A552F1BD1AC283AE4CEF58BC333FF3A9C1CC89F270B53DB9C87ED8753D9B9302D815CBE3871EC204760E0AB82099442B25083DEB81E1DE3E2E9A19F77726C9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class RTVSIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rtvs\.sk/(?:radio\|televizia)/archiv/\d+/(?P<id>\d+)'. _TESTS = [{. # radio archive. 'url': 'http://www.rtvs.sk/radio/archiv/11224/414872',. 'md5': '134d5d6debdeddf8a5d761cbc9edacb8',. 'info_dict': {. 'id': '414872',. 'ext': 'mp3',. 'title': 'Ostrov pokladov 1 .as..mp3'. },. 'params': {. 'skip_download': True,. }. }, {. # tv archive. 'url': 'http://www.rtvs.sk/televizia/archiv/8249/63118',. 'md5': '85e2c55cf988403b70cac24f5c086dc6',. 'info_dict': {. 'id': '63118',. 'ext': 'mp4',. 'title': 'Amaro D.ives - N.. de.',. 'description': 'Galave.er pri pr.le.itosti Medzin.rodn.ho d.a R.mov.'. },. 'params': {. 'skip_download': True,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6ON9P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2724
Entropy (8bit):	4.624524431299696
Encrypted:	false
SSDEEP:	48:PuiE0hjkf4RXxE4R8pu7gqKMvaJoXhh6BkXtBQX1ohBZZeyUv9dKNlKT3+RgZ4qE:+0hjkfaxEdEzKMvaJa962JZRUv9dKNlV
MD5:	B8065B3BDC0C890C1D60E72DA63057CD
SHA1:	B5704123C07B5F02A0F0FE77441CCB146E4535AB
SHA-256:	5CE1D6B492950061ED592D7F3E64D0DF464C2A8322589CDFD6583EC2E8F252C5
SHA-512:	2138081DC5A70F493DA174C1DFC9C3BAE6390ABA55FAC5B0B37A08440C73E3EE23417F085A0FB5343DCEE98929C1564DC98E9D0A8023740715D7CCD4C450FC8A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_iso8601,. parse_duration,. parse_filesize,. int_or_none,.)...class AlphaPornoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?alphaporno\.com/videos/(?P<id>[^/]+)'. _TEST = {. 'url': 'http://www.alphaporno.com/videos/sensual-striptease-porn-with-samantha-alexandra/',. 'md5': 'feb6d3bba8848cd54467a87ad34bd38e',. 'info_dict': {. 'id': '258807',. 'display_id': 'sensual-striptease-porn-with-samantha-alexandra',. 'ext': 'mp4',. 'title': 'Sensual striptease porn with Samantha Alexandra',. 'thumbnail': r're:https?://.*\.jpg$',. 'timestamp': 1418694611,. 'upload_date': '20141216',. 'duration': 387,. 'filesize_approx': 54120000,. 'tbr': 1145,. 'categories': list,. 'age_limit': 18,. }. }.. def _real_extract(

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6QO2H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4206
Entropy (8bit):	4.8087663260896685
Encrypted:	false
SSDEEP:	96:V89psWWqgZWF/dvtW8FotfXFFoGtKV8/tALXpfe:q9GPqgIFlvkFNTJ/Ke
MD5:	3E8421C2E7A40B4B0D15A3D43A3F6BEB
SHA1:	88CE9ED0C02EBCE22DFCAD2957FCD3AB5FD4FBF2
SHA-256:	3E2E227CF0BD23F6E1EF6D838C5AFD168FC568BB37E04EA2EB10AEADFE6B45D2
SHA-512:	F518BA46134BD4274D96E1CA2E808DEC2382A38301B36623266FF72A97ECC998EE7E45266AB7DDB818FDA5172303815143110C726E927A80F41358F7ACAA0560
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .amp import AMPIE.from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,.)...class BleacherReportIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bleacherreport\.com/articles/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://bleacherreport.com/articles/2496438-fsu-stat-projections-is-jalen-ramsey-best-defensive-player-in-college-football',. 'md5': 'a3ffc3dc73afdbc2010f02d98f990f20',. 'info_dict': {. 'id': '2496438',. 'ext': 'mp4',. 'title': 'FSU Stat Projections: Is Jalen Ramsey Best Defensive Player in College Football?',. 'uploader_id': 3992341,. 'description': 'CFB, ACC, Florida State',. 'timestamp': 1434380212,. 'upload_date': '20150615',. 'uploader': 'Team Stream Now ',. },. 'add_ie': ['Ooyala'],. }, {. 'url': 'http://bleacherrepo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6SPAV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (2320)
Category:	dropped
Size (bytes):	7621
Entropy (8bit):	5.545808950994674
Encrypted:	false
SSDEEP:	192:TQtcV5dFdbDOHD9xEYi40ij2ZETCJaACnOJK/enTUk6Ng:TQA3QzEb403ZiHnVenTb6Ng
MD5:	36E10DF6355E23E2FFA709A3814F7F98
SHA1:	063E5D69462FB82976F8DAB5C935C5F0FFCBEFCB
SHA-256:	98872EE7B726E8211D9FD0219EFF32EA601B2BD5716DD9CBE52300730927125D
SHA-512:	7835DABB3948DD02214CB2034103837E70E646B9E7F82DDEDFC06C813F3F7EE546BBB7E85AD3241D5E8C5CFE723F733B0A4835DA125296289C5C5BE125F5D6BC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import zlib..from .common import InfoExtractor.from .cbs import CBSIE.from ..compat import (. compat_b64decode,. compat_urllib_parse_unquote,.).from ..utils import (. parse_duration,.)...class CBSNewsEmbedIE(CBSIE):. IE_NAME = 'cbsnews:embed'. _VALID_URL = r'https?://(?:www\.)?cbsnews\.com/embed/video[^#]*#(?P<id>.+)'. _TESTS = [{. 'url': 'https://www.cbsnews.com/embed/video/?v=1.c9b5b61492913d6660db0b2f03579ef25e86307a#1Vb7b9s2EP5XBAHbT6Gt98PAMKTJ0se6LVjWYWtdGBR1stlIpEBSTtwi%2F%2FvuJNkNhmHdGxgM2NL57vjd6zt%2B8PngdN%2Fyg79qeGvhzN%2FLGrS%2F%2BuBLB531V28%2B%2BO7Qg7%2Fy97r2z3xZ42NW8yLhDbA0S0KWlHnIijwKWJBHZZnHBa8Cgbpdf%2F89NM9Hi9fXifhpr8sr%2FlP848tn%2BTdXycX25zh4cdX%2FvHl6PmmPqnWQv9w8Ed%2B9GjYRim07bFEqdG%2BZVHuwTm65A7bVRrYtR5lAyMox7pigF6W4k%2By91mjspGsJ%2BwVae4%2BsvdnaO1p73HkXs%2FVisUDTGm7R8IcdnOROeq%2B19qT1amhA1VJtPenoTUgrtfKc9m7Rq8dP7nnjwOB7wg7ADdNt7VX64DWAWlKhPtmDEq22g4GF99x6Dk9E8OSsankHXqPNKDxC%2

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6UABB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	4.881544501053117
Encrypted:	false
SSDEEP:	24:zi8lzvxGU+fwGyrMU/PTI5UP8BAuKyq0X/hifVXjleAl+cUDAgI0+:+u1ofpyg0bIoMnvhifVXjleAQb+
MD5:	3A8CFC97B44B18BA5F247BAFD8F8A7CB
SHA1:	7D650A50BE00D44794FD3A2806F87CA6D3117C32
SHA-256:	27A0694018399B486C969B232F436827D4F7CC334672B385507347359306CFC5
SHA-512:	38216C91D9C920E57ABED042FBF9D957958459B282A467C6A98FEE64ECE2CADA00F29A1D4504B6D14B6C3E4E5A6E35C79526702BDD290896A7D126B765EB5B36
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,.)...class NZZIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nzz\.ch/(?:[^/]+/)[^/?#]+-ld\.(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.nzz.ch/zuerich/gymizyte/gymizyte-schreiben-schueler-heute-noch-diktate-ld.9153',. 'info_dict': {. 'id': '9153',. },. 'playlist_mincount': 6,. }, {. 'url': 'https://www.nzz.ch/video/nzz-standpunkte/cvp-auf-der-suche-nach-dem-mass-der-mitte-ld.1368112',. 'info_dict': {. 'id': '1368112',. },. 'playlist_count': 1,. }].. def _real_extract(self, url):. page_id = self._match_id(url). webpage = self._download_webpage(url, page_id).. entries = []. for player_element in re.findall(. r'(<[^>]+class="kalturaPlayer[^"]"[^>]*>)', webpage):. player_params = extract_att

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6V3I1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	4.852101556807145
Encrypted:	false
SSDEEP:	48:Puh0yzbs+jfmXVjXhkiqGHiZDkQh5C2vllbeB4RXP6NeQ8cjtc:kzbs8fmXVaidCpJ3CSllbBNP6NH8atc
MD5:	FD92C0DE5547E29A80BDBA9DE7302010
SHA1:	723A7734B116955E1B088F68283138282F8409AB
SHA-256:	40AF44979A6F38D56CBCC4C9F2A2794B004A9A5CFF1143235A2FE25D98589516
SHA-512:	D751F990E1FEE061676865A8E193963B2589C699A74FD1CC653066F0876DEA45173C3BC14CFF81AF7194CFACCA70F286EA180204FD4C9C870583F9A37D644943
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. unescapeHTML,. parse_duration,.)...class MovingImageIE(InfoExtractor):. _VALID_URL = r'https?://movingimage\.nls\.uk/film/(?P<id>\d+)'. _TEST = {. 'url': 'http://movingimage.nls.uk/film/3561',. 'md5': '4caa05c2b38453e6f862197571a7be2f',. 'info_dict': {. 'id': '3561',. 'ext': 'mp4',. 'title': 'SHETLAND WOOL',. 'description': 'md5:c5afca6871ad59b4271e7704fe50ab04',. 'duration': 900,. 'thumbnail': r're:^https?://.\.jpg$',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. formats = self._extract_m3u8_formats(. self._html_search_regex(r'file\s:\s*"([^"]+)"', webpage, 'm3u8 manifest URL'),. video_id, ext='mp4', entry_protocol='m3u8_native').. def search_field(fie

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6VK6E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11903
Entropy (8bit):	4.453772305248068
Encrypted:	false
SSDEEP:	192:edLN0uVh+YrJy5GLnoxxTHF2vGieO8hPEoGTsoK7zua7XAV7qya+yaf6CqyaOy7M:qLN0uVh+YrqGMxVHkvGieO8h8oGTshz0
MD5:	265967D6B5CC1B539578B35771EF9374
SHA1:	6995093C2C98189DBEB0C309A576D645C3463669
SHA-256:	A25C956FCE90CE6536FE82C52EB2AF4A22E0F9CE3FFBCCBA4631FC3A4301CFF9
SHA-512:	97FB447BDF91E96F23C3D27B6B5FB0DA288D01AF1989E69CB7A7531846B50CDD12706CDE5491CF793A62481CCB576B6161EA112FA8B6DA1D2D12F91D5665A18B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_duration,. parse_iso8601,. xpath_element,. xpath_text,.)...class BRIE(InfoExtractor):. IE_DESC = 'Bayerischer Rundfunk'. _VALID_URL = r'(?P<base_url>https?://(?:www\.)?br(?:-klassik)?\.de)/(?:[a-z0-9\-_]+/)+(?P<id>[a-z0-9\-_]+)\.html'.. _TESTS = [. {. 'url': 'http://www.br.de/mediathek/video/sendungen/abendschau/betriebliche-altersvorsorge-104.html',. 'md5': '83a0477cf0b8451027eb566d88b51106',. 'info_dict': {. 'id': '48f656ef-287e-486f-be86-459122db22cc',. 'ext': 'mp4',. 'title': 'Die b.se .berraschung',. 'description': 'md5:ce9ac81b466ce775b8018f6801b48ac9',. 'duration': 180,. 'uploader': 'Reinhard Weber',. 'upload_date': '2

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-6VTCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2708
Entropy (8bit):	4.712333967038507
Encrypted:	false
SSDEEP:	48:+u4FQA4okcflnEkd/GQ2NluKXlhGSHMXsleEKyddRfjXjlkdXcI5fBxFu6oZzceL:ElPv6kd/GQ2xXFHMXsDKydzfqii/LIcq
MD5:	7C330FB0E091BC19D473E1CEE3DF69E8
SHA1:	0E93754633F16F049D939B17449871384027B6BB
SHA-256:	15BCACF9C9675AB9F12525B299172742604FBD2DFAF4CE453353EAEF8849AF35
SHA-512:	C9A44E1F4CB1B33ECBBF6D62BE4E1707BDB0B25F05703C6DF755C25587316BE700238B9F035216D113061B4326E07CDE1FEB5EFFE765CE49EB6B4D19E22CB439
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import smuggle_url...class KickStarterIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?kickstarter\.com/projects/(?P<id>[^/])/.'. _TESTS = [{. 'url': 'https://www.kickstarter.com/projects/1404461844/intersection-the-story-of-josh-grant/description',. 'md5': 'c81addca81327ffa66c642b5d8b08cab',. 'info_dict': {. 'id': '1404461844',. 'ext': 'mp4',. 'title': 'Intersection: The Story of Josh Grant by Kyle Cowling',. 'description': (. 'A unique motocross documentary that examines the '. 'life and mind of one of sports most elite athletes: Josh Grant.'. ),. },. }, {. 'note': 'Embedded video (not using the native kickstarter video service)',. 'url': 'https://www.kickstarter.com/projects/597507018/pebble-e-paper-watch-for-iphone-and-android/posts/659178

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-702BQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3586
Entropy (8bit):	4.483574204516098
Encrypted:	false
SSDEEP:	96:i9KUyHbhtBtpckuwfa1DVG7Ujx33MPRoBTUBxG5c9NdjP8mO6NK:Bptt7OkuGaRVxjx38poTUinmO6NK
MD5:	A2A2D4E6C98D1C1372C56BA599556A1E
SHA1:	B0E92B2C25845F4DA042462D93A429FE8EB6E766
SHA-256:	14E15111B80953F4311C43275F9156ACDF50E20E98A5A82D0A906BB371FF7BCE
SHA-512:	113DF935B5C88FF51675D8D2E06B9317EA719C1CBA8A046005FF9A9D25E852E1911FE6599FE4EBFF40AD54821AF783C2A9CD1733073CD166214E0F522F58088C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. int_or_none,. unified_timestamp,.)...class BeegIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?beeg\.(?:com\|porn(?:/video)?)/(?P<id>\d+)'. _TESTS = [{. # api/v6 v1. 'url': 'http://beeg.com/5416503',. 'md5': 'a1a1b1a8bc70a89e49ccfd113aed0820',. 'info_dict': {. 'id': '5416503',. 'ext': 'mp4',. 'title': 'Sultry Striptease',. 'description': 'md5:d22219c09da287c14bed3d6c37ce4bc2',. 'timestamp': 1391813355,. 'upload_date': '20140207',. 'duration': 383,. 'tags': list,. 'age_limit': 18,. }. }, {. # api/v6 v2. 'url': 'https://beeg.com/1941093077?t=911-1391',. 'only_matching': True,. }, {. # api/v6 v2 w/o t. 'url': 'https://beeg.com/1277207756',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-72QGT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	4.594931863602199
Encrypted:	false
SSDEEP:	48:Pu+UWa2h8/nDZEredlzjXhkDukazYUD7BTJPpdPaaDWZqgf9guUJ3Cb5wE9ZmHly:bUWa2h8/nDZEreHzarI7BTJxdPaaCri6
MD5:	50A501926D80861ECA8A4AE75C8D3180
SHA1:	A24A92311C752DDF779E5DDA891F24FFAAFD2769
SHA-256:	4CA09045F03B967DACD1C54E9BBC97DAB189BF6C853B10B7EB071DB0AE37C231
SHA-512:	8F9EB6DA0345EFC1DE1B15B4CFE8CED0CC3AEA16710DA8487515083C05D352720B1329C7DE7BA36D3E4CAE5D2AEF5EC71737A7A03BFA68CB81E13C18608FE9AF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. get_element_by_id,. remove_end,.)...class IconosquareIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:iconosquare\.com\|statigr\.am)/p/(?P<id>[^/]+)'. _TEST = {. 'url': 'http://statigr.am/p/522207370455279102_24101272',. 'md5': '6eb93b882a3ded7c378ee1d6884b1814',. 'info_dict': {. 'id': '522207370455279102_24101272',. 'ext': 'mp4',. 'title': 'Instagram photo by @aguynamedpatrick (Patrick Janelle)',. 'description': 'md5:644406a9ec27457ed7aa7a9ebcd4ce3d',. 'timestamp': 1376471991,. 'upload_date': '20130814',. 'uploader': 'aguynamedpatrick',. 'uploader_id': '24101272',. 'comment_count': int,. 'like_count': int,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._down

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-732FH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3511
Entropy (8bit):	4.912858627743909
Encrypted:	false
SSDEEP:	96:5U1aC8pYu3jXfOVHYMOav7Xa+h1OV1d2KL2RMebcYIYtcksKfaNfhxB1/A/QXtS:5U15YYO7cHYqvzLc1d2KRUcYIYSks4aI
MD5:	AB2B3A099849424B6CBF6E4A63E20308
SHA1:	50949B049124566FA112CAD255E40195228689FD
SHA-256:	29416CEFD81A957C48F223BBEFEF6F20C0F9C1E6F8AAB5F6B6A5729C3428EDAF
SHA-512:	325B7063DB01AD854FFE03EBCA4F7DD57ABA9E41A85448E751281F18ACC5DC0D7E9782937DB2CDBCA4BBE8DB96F89C0E18691D611ECD52CBF7A9E801F1D883AC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. remove_end,.)...class BioBioChileTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:tv\|www)\.biobiochile\.cl/(?:notas\|noticias)/(?:[^/]+/)+(?P<id>[^/]+)\.shtml'.. _TESTS = [{. 'url': 'http://tv.biobiochile.cl/notas/2015/10/21/sobre-camaras-y-camarillas-parlamentarias.shtml',. 'md5': '26f51f03cf580265defefb4518faec09',. 'info_dict': {. 'id': 'sobre-camaras-y-camarillas-parlamentarias',. 'ext': 'mp4',. 'title': 'Sobre C.maras y camarillas parlamentarias',. 'thumbnail': r're:^https?://.*\.jpg$',. 'uploader': 'Fernando Atria',. },. 'skip': 'URL expired and redirected to http://www.biobiochile.cl/portada/bbtv/index.html',. }, {. # different uploader layout. 'url': 'http://tv.biobiochile.cl/notas/2016/03/18/natalia-valdebenito-repasa-a-diputado-ha

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-73TS4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4471
Entropy (8bit):	4.541664990190913
Encrypted:	false
SSDEEP:	96:g76yDLmGC3IUq8ULEL18c3NkhhOo+WNTkk4AeBTVA6NWecNZ:dyDLTdhPLELdkhhOo+qT4LTVA6Ni
MD5:	2DECCAA1015F9F863E52EA9EAA709460
SHA1:	0AE9BDA1BA3181D940DE8B5684BC31AC2A3295DE
SHA-256:	48E1AFF9C4E5A3777ACE14C5478DABC7E492F61E3795143774004DC0D7FDFE2A
SHA-512:	ABAD5E9A97B3659160C004EA62CD099E6874A878FC8D697BB4B84646EB3E8159A209B4AED5369B17FDED023399808ABDAAF7ED72066EF0AFA0C5B888F5A6C244
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. unescapeHTML,.)...class WistiaIE(InfoExtractor):. _VALID_URL = r'(?:wistia:\|https?://(?:fast\.)?wistia\.(?:net\|com)/embed/(?:iframe\|medias)/)(?P<id>[a-z0-9]+)'. _API_URL = 'http://fast.wistia.com/embed/medias/%s.json'. _IFRAME_URL = 'http://fast.wistia.net/embed/iframe/%s'.. _TESTS = [{. 'url': 'http://fast.wistia.net/embed/iframe/sh7fpupwlt',. 'md5': 'cafeb56ec0c53c18c97405eecb3133df',. 'info_dict': {. 'id': 'sh7fpupwlt',. 'ext': 'mov',. 'title': 'Being Resourceful',. 'description': 'a Clients From Hell Video Series video from worldwidewebhosting',. 'upload_date': '20131204',. 'timestamp': 1386185018,. 'duration': 117,. },. }, {. 'url': 'wistia:sh7fpupwlt',. 'only_matching': True,. },

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-75JRK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	4.690380981888605
Encrypted:	false
SSDEEP:	48:+u2N9b/nZd3HXndKG/I8ajXTBs0sABsGfVxqGBg2hBTPlJ7bYV9Fsn6tN0E8c26k:M7nZd3XndKG/I8aZpDdu2hBT3Kzs6tNa
MD5:	EDEFEC98EAFE85F3B289FAB42F4BCCD1
SHA1:	87085656078121B23D74572B17432CA000902D3C
SHA-256:	A8E4CE8F5DFA4C5AE6256A74B16BCE5918F8BDB10D575329C4C85C68A4DC3517
SHA-512:	B929EBB86A29384E248BC127DD10B674F7B8831A7F2881E7F2D793F144F0F056298C63616704362008D1A20E66540DF36E920FC0275135D4AECA26C16FE46EDB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. urljoin,.)...class MelonVODIE(InfoExtractor):. _VALID_URL = r'https?://vod\.melon\.com/video/detail2\.html?\?.?mvId=(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://vod.melon.com/video/detail2.htm?mvId=50158734',. 'info_dict': {. 'id': '50158734',. 'ext': 'mp4',. 'title': "Jessica 'Wonderland' MV Making Film",. 'thumbnail': r're:^https?://.\.jpg$',. 'artist': 'Jessica (...)',. 'upload_date': '20161212',. 'duration': 203,. },. 'params': {. 'skip_download': 'm3u8 download',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. play_info = self._download_json(. 'http://vod.melon.com/video/playerInfo.json', video_id,. note='Downloading player info JSON', query={'mvId': v

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-75L7B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4392
Entropy (8bit):	4.7002393234979065
Encrypted:	false
SSDEEP:	96:ZpqIVMqUpXBq0gaTS8Gx/BTwHFx90MAr0d6N4MPhnncnKamnB8xLoBTeN0F3NN5A:WhqUS0gaTS8GxJTwlxd6N3ncKamnB815
MD5:	A2272FDE651199AE8879A8A2003E0A5D
SHA1:	2EB315058D13E666AF601530E4E11FEFFEA1423E
SHA-256:	ECF69976DBFD196CB87399A79E5A00E5810795EBFC51C1B060490ABC9527B048
SHA-512:	8028BA15B00C260490ED3A107D96826C24036ABC7D980193E00A221DB550E158F9B13028D792D29FB63871A56D303154B0E0C302627EEA8B28496CA9E5F92B3E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_strdate,. unescapeHTML,.)...class UstudioIE(InfoExtractor):. IE_NAME = 'ustudio'. _VALID_URL = r'https?://(?:(?:www\|v1)\.)?ustudio\.com/video/(?P<id>[^/]+)/(?P<display_id>[^/?#&]+)'. _TEST = {. 'url': 'http://ustudio.com/video/Uxu2my9bgSph/san_francisco_golden_gate_bridge',. 'md5': '58bbfca62125378742df01fc2abbdef6',. 'info_dict': {. 'id': 'Uxu2my9bgSph',. 'display_id': 'san_francisco_golden_gate_bridge',. 'ext': 'mp4',. 'title': 'San Francisco: Golden Gate Bridge',. 'description': 'md5:23925500697f2c6d4830e387ba51a9be',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20111107',. 'uploader': 'Tony Farley',. }. }.. def _real_extract(self, url):. video_id, display_id = re.match(self._VALID_URL, url).groups

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-77D1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13696
Entropy (8bit):	4.608815241099591
Encrypted:	false
SSDEEP:	384:23sc+rGLl6o6hWplwfexBO1oizATq6N2meuOfyTY6NSMzgdgZLfoj4W98F8jypl6:IX6o6hWplwfexBO1oizATq82meuOfyTM
MD5:	5786308E207794D0552378BCC217A96F
SHA1:	F22B96BE5F6ABEA863FE82E922A167DCC86DBDB7
SHA-256:	2517E26B34324E2713E34D3596E1247FA2DD6ED9A72380A4A5DF974E99D7F40C
SHA-512:	E7C9943ED4E84A866090D5AE4A12616CF221615DF07ECBF3A20D7446C31344497C3D0A255C141A96F4BB4ABD79633FB29139ACEEC70476787F0E0B5C8D3E4BEC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. find_xpath_attr,. xpath_attr,. xpath_with_ns,. xpath_text,. orderedSet,. update_url_query,. int_or_none,. float_or_none,. parse_iso8601,. determine_ext,.)...class LivestreamIE(InfoExtractor):. IE_NAME = 'livestream'. _VALID_URL = r'https?://(?:new\.)?livestream\.com/(?:accounts/(?P<account_id>\d+)\|(?P<account_name>[^/]+))/(?:events/(?P<event_id>\d+)\|(?P<event_name>[^/]+))(?:/videos/(?P<id>\d+))?'. _TESTS = [{. 'url': 'http://new.livestream.com/CoheedandCambria/WebsterHall/videos/4719370',. 'md5': '53274c76ba7754fb0e8d072716f2292b',. 'info_dict': {. 'id': '4719370',. 'ext': 'mp4',. 'title': 'Live from Webster Hall NYC',. 'timestamp': 1350008072,. 'upload_date': '20121012',. 'dur

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-78NFE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4555
Entropy (8bit):	4.533116987022292
Encrypted:	false
SSDEEP:	96:bbtIVHS/XjgdqSvf8zPf7qzzjLrz3OVafBTeLNlQJgHct/8ik6Ng:vu0EFEzn7qLPz+VapTSn6Ng
MD5:	0C7D8C8E27C0D832B14C17000D016EFC
SHA1:	C5A5DC17B5C879B24F87B459C7706B3AA9315D7A
SHA-256:	3DB33871D7C1940DE95F10B1017910C24310B2516E8D4084FBD5729D12513562
SHA-512:	C1A9E6444008BA8C48B071937D63EE3FE93008EAD03C268B610313110006600F2A6C2B65F201B3AC48435FFAE287921C053383F64C0699468B7195F8DD364F58
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. parse_iso8601,. qualities,.)...class CoubIE(InfoExtractor):. _VALID_URL = r'(?:coub:\|https?://(?:coub\.com/(?:view\|embed\|coubs)/\|c-cdn\.coub\.com/fb-player\.swf\?.\bcoub(?:ID\|id)=))(?P<id>[\da-z]+)'.. _TESTS = [{. 'url': 'http://coub.com/view/5u5n1',. 'info_dict': {. 'id': '5u5n1',. 'ext': 'mp4',. 'title': 'The Matrix Moonwalk',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 4.6,. 'timestamp': 1428527772,. 'upload_date': '20150408',. 'uploader': 'Artyom Loskutnikov',. 'uploader_id': 'artyom.loskutnikov',. 'view_count': int,. 'like_count': int,. 'repost_count': int,. 'age_limit': 0,. },. }, {. 'url': 'http://c-cdn.coub.com/fb-play

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7ASCD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2508
Entropy (8bit):	4.8144138324880235
Encrypted:	false
SSDEEP:	48:PuOrDQvXfySn3Po0XQrvyStfdfFkZVUKyNzadZBTVfNlofGyAk8csx:drDQvPySn3Po0XQrvyQfGmKyNedz1NlH
MD5:	3AAC8D3F4BE25B998F4C4F27EE5A4114
SHA1:	AC3B9E21EF4E326A73EA8B15AD91745B9D60B1CC
SHA-256:	01E4CA60934680AA257A27D5DD479FCDE1947D01419B2E9A636EB9FEF30A99DC
SHA-512:	68276076B513BAA566FC7781567BC870DC3FEA8EA70B41B11940567A2CCF38CBC6A4ED1D948B3F4F6A384327627C99E63691027EB411673D0AA77153A32A7311
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import time..from .common import InfoExtractor.from ..utils import (. int_or_none,. HEADRequest,.)...class CultureUnpluggedIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cultureunplugged\.com/documentary/watch-online/play/(?P<id>\d+)(?:/(?P<display_id>[^/]+))?'. _TESTS = [{. 'url': 'http://www.cultureunplugged.com/documentary/watch-online/play/53662/The-Next--Best-West',. 'md5': 'ac6c093b089f7d05e79934dcb3d228fc',. 'info_dict': {. 'id': '53662',. 'display_id': 'The-Next--Best-West',. 'ext': 'mp4',. 'title': 'The Next, Best West',. 'description': 'md5:0423cd00833dea1519cf014e9d0903b1',. 'thumbnail': r're:^https?://.*\.jpg$',. 'creator': 'Coldstream Creative',. 'duration': 2203,. 'view_count': int,. }. }, {. 'url': 'http://www.cultureunplugged.com/documentary/watch-online/play/53662',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7C2J0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3992
Entropy (8bit):	4.702976843202782
Encrypted:	false
SSDEEP:	96:4xNB5sz1aWVITbmW99h2JJUo1J4aNZxAO4H8Gj1FI7IqBTWWxt0edie6Nq:MNspaYIPl9Ohvrv4H8IXqI+TZ9ie6Nq
MD5:	B96A42ECD2D73EE7C0D07A5021DD97BC
SHA1:	C441475DB373BF18FE7E1915C5098628A7C6D4D0
SHA-256:	893D9CD4C3AF9727E57AC3E7DBC73545BE7719B3C6A2C1882321140C0E0CD6BB
SHA-512:	5A18220DFFD8EC2A07D66990687CE36FC20C7BB6E25539A0F76F41D6E10D458E95764922C78B20B1D28B6D45E535A5F0F5E2232685F59C5F76AB12307F514DC7
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. qualities,.)...class VeohIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?veoh\.com/(?:watch\|embed\|iphone/#_Watch)/(?P<id>(?:v\|e\|yapi-)[\da-zA-Z]+)'.. _TESTS = [{. 'url': 'http://www.veoh.com/watch/v56314296nk7Zdmz3',. 'md5': '9e7ecc0fd8bbee7a69fe38953aeebd30',. 'info_dict': {. 'id': 'v56314296nk7Zdmz3',. 'ext': 'mp4',. 'title': 'Straight Backs Are Stronger',. 'uploader': 'LUMOback',. 'description': 'At LUMOback, we believe straight backs are stronger. The LUMOback Posture & Movement Sensor: It gently vibrates when you slouch, inspiring improved posture and mobility. Use the app to track your data and improve your posture over time. ',. },. }, {. 'url': 'http://www.veoh.com/embed/v56314296nk7Zdmz3',. 'only_matching': True,. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7DIVP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1363
Entropy (8bit):	4.980660042121645
Encrypted:	false
SSDEEP:	24:zi8lFvahGo1iwVOSckT/VdlN3/yZl1QCjAaeIXSvBgoHlEOamkVZFl:+uqViLGLVpavXjAajXoBlHQFl
MD5:	78B136A8E558D253427D0F6C33E95A51
SHA1:	D37599DBCEA267E31DDF169C842D68692DC9A8A7
SHA-256:	0C5DC1F3A37109E2C8F3AF36235637CB137B6418CBA2BFA36F37CDA948D84B94
SHA-512:	FF1DA9B613FD00B92489CE3E8D65CFD7EC9DFBCA3A1BF785AB82ABDDAA6C926A67408089ADBD330D0A4F6867BFEF7E411BAC4A19CE8F32FEBBAC1085EE34024E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unescapeHTML,.)...class BildIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bild\.de/(?:[^/]+/)+(?P<display_id>[^/]+)-(?P<id>\d+)(?:,auto=true)?\.bild\.html'. IE_DESC = 'Bild.de'. _TEST = {. 'url': 'http://www.bild.de/video/clip/apple-ipad-air/das-koennen-die-neuen-ipads-38184146.bild.html',. 'md5': 'dd495cbd99f2413502a1713a1156ac8a',. 'info_dict': {. 'id': '38184146',. 'ext': 'mp4',. 'title': 'Das k.nnen die neuen iPads',. 'description': 'md5:a4058c4fa2a804ab59c00d7244bbf62f',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 196,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. video_data = self._download_json(. url.split('.bild.html')[0] + ',view=json.bild.html', video_id).. retu

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7GFB7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4522
Entropy (8bit):	4.943178669252323
Encrypted:	false
SSDEEP:	96:NV/DG7yLXjnDvHODQDwD4D79fLobF9dcDRO7mlXjboILDWjJemZhO/cX/UimUxB:373qE0EXdRD9qILDW9LTtUG
MD5:	16DFD2882AB8B9574B531814121241BD
SHA1:	2E343A5F6B55AC368010B99263590D3FA1CDABBF
SHA-256:	D92E300EF3B7F359C29C6E87F975839A0C6009396A3AADC796EE830F63A72731
SHA-512:	CD4BA3A5FD8F6FA0124D1EFEF4CC476CD2D83082D5E03C84CFC9847DB2DAD5C25441ED69B859EB64405CCFCEA62DD99B2CB27CC65040D3A3D64F4061311A3DAE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. orderedSet,. parse_duration,. try_get,.)...class MarkizaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?videoarchiv\.markiza\.sk/(?:video/(?:[^/]+/)\|embed/)(?P<id>\d+)(?:[_/]\|$)'. _TESTS = [{. 'url': 'http://videoarchiv.markiza.sk/video/oteckovia/84723_oteckovia-109',. 'md5': 'ada4e9fad038abeed971843aa028c7b0',. 'info_dict': {. 'id': '139078',. 'ext': 'mp4',. 'title': 'Oteckovia 109',. 'description': 'md5:d41d8cd98f00b204e9800998ecf8427e',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 2760,. },. }, {. 'url': 'http://videoarchiv.markiza.sk/video/televizne-noviny/televizne-noviny/85430_televizne-noviny',. 'info_dict': {. 'id': '85430',. 'title': 'Telev.zne noviny',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7I7AC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	4.571161613799875
Encrypted:	false
SSDEEP:	96:lQmo7zLTDfRmP1BoPACU6/+RZG2oBTA6NO:ZUHTDRmPAPACU6/+rzoTA6NO
MD5:	336B55A5EAF3D0E5D7A7930977497CF9
SHA1:	1CE3BDF3A0420B9106F7A3462C81068906FB5FCF
SHA-256:	2891EE0E3B511E502FB528DA104236CA107C992CB7F69E68C115C0EBB6D67279
SHA-512:	3EC738B93E2DF19EA96FFA45A5AA313DE9E8875DDDCFAE686D96FA092E5453649C14F37698DEC44876B82688FB339AF822E39ECF8D58A97939C1D6D5278ABDF1
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,. compat_urllib_parse_urlencode,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. qualities,.)...class AddAnimeIE(InfoExtractor):. _VALID_URL = r'https?://(?:\w+\.)?add-anime\.net/(?:watch_video\.php\?(?:.*?)v=\|video/)(?P<id>[\w_]+)'. _TESTS = [{. 'url': 'http://www.add-anime.net/watch_video.php?v=24MR3YO5SAS9',. 'md5': '72954ea10bc979ab5e2eb288b21425a0',. 'info_dict': {. 'id': '24MR3YO5SAS9',. 'ext': 'mp4',. 'description': 'One Piece 606',. 'title': 'One Piece 606',. },. 'skip': 'Video is gone',. }, {. 'url': 'http://add-anime.net/video/MDUGWYKNGBD8/One-Piece-687',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. try:. webpage = se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7K4G0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	4.93504684628155
Encrypted:	false
SSDEEP:	48:+udMg0A9ypl3cLNVF8aWfFI7mX3Nl3N/PYcqYx4V:5t0i0l3cL7F8a0ld/PFhxS
MD5:	36463FAED5B28F015E01303A83A73E3E
SHA1:	B80E48E58BF0E7FC8337FC4765AEEB89F29C2444
SHA-256:	B864DD48602D3B3EC2E637F32F3B7813F499E5AF114F54E532F0519423A816BA
SHA-512:	11C3FEBEC89293C143EBFC9EFCDF298C1DB2CE26A994AC0AF1BE7190DB32A0A1F5CEAA4B27492F082E669B401355996E57C320533A920284E894366E8C970FE8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class MyChannelsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mychannels\.com/.*(?P<id_type>video\|production)_id=(?P<id>[0-9]+)'. _TEST = {. 'url': 'https://mychannels.com/missholland/miss-holland?production_id=3416',. 'md5': 'b8993daad4262dd68d89d651c0c52c45',. 'info_dict': {. 'id': 'wUUDZZep6vQD',. 'ext': 'mp4',. 'title': 'Miss Holland joins VOTE LEAVE',. 'description': 'Miss Holland \| #13 Not a potato',. 'uploader': 'Miss Holland',. }. }.. def _real_extract(self, url):. id_type, url_id = re.match(self._VALID_URL, url).groups(). webpage = self._download_webpage(url, url_id). video_data = self._html_search_regex(r'<div([^>]+data-%s-id="%s"[^>]+)>' % (id_type, url_id), webpage, 'video data').. def extract_data_val(attr, fatal=False):. return se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7LGTS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1968
Entropy (8bit):	4.86058041324649
Encrypted:	false
SSDEEP:	48:PuchAKiODEZtNxaz43BTNt/8c26NocBiMZPfb4nB/tg/smAcXbNItfjXhCNKuX1y:BhcvbNxPBTNt/8V6No0i2qB/tLmAgxup
MD5:	329428198D11AE03EEC19D92691044E8
SHA1:	1A0767325C25BA35E82075FBCDD54920FDD2CE4B
SHA-256:	75F3FBEE1398EC4254454A0F454C9C574D8946F62BAF2199E0D98EE98E055452
SHA-512:	8AED3EDAD8953268B017B93ED988672B05A8574207C1946B7FF838279DA7F0031D277EC44CEA4402006EE460B638C67CDA6FD2AFA9D16870D5B2A507A109A220
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import int_or_none...class SprutoBaseIE(InfoExtractor):. def _extract_spruto(self, spruto, video_id):. playlist = spruto['playlist'][0]. title = playlist['title']. video_id = playlist.get('videoId') or video_id. thumbnail = playlist.get('posterUrl') or playlist.get('thumbnailUrl'). duration = int_or_none(playlist.get('duration')).. formats = [{. 'url': f['url'],. } for f in playlist['video']]. self._sort_formats(formats).. return {. 'id': video_id,. 'title': title,. 'thumbnail': thumbnail,. 'duration': duration,. 'formats': formats,. }...class VimpleIE(SprutoBaseIE):. IE_DESC = 'Vimple - one-click video hosting'. _VALID_URL = r'https?://(?:player\.vimple\.(?:ru\|co)/iframe\|vimple\.(?:ru\|co))/(?P<id>[\da-f-]{32,36})'. _TESTS = [{. 'url': 'http://vim

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7LU7P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2196
Entropy (8bit):	4.805030533701815
Encrypted:	false
SSDEEP:	48:+ucZx3B/PxMBTECoXgajXhkbVKVIVCeVUeSkiC3Jo1LcaPZ1F6NKktc:QDxB+ACoXgaaQYDJo1ceZ1F6Nhtc
MD5:	EECDACADBE3E4AF10E7202E2B19701E1
SHA1:	BA13B33FFA67D5868420E839C008AF6424AC928F
SHA-256:	BCA1884D3F3B51CCBB850DA3354BE0375559ED664188FE80F778EAD4B449B9D8
SHA-512:	6FA034663A7C81AA08FCE5DEEF762E7ED92786BF5F5DD819B64C85DC4854E04F0B94C6C67988EDFA22F91420CE6E28A6C78D54B1A90028261D3D5911B1925035
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. HEADRequest,. get_element_by_attribute,. parse_iso8601,.)...class YesJapanIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?yesjapan\.com/video/(?P<slug>[A-Za-z0-9\-])_(?P<id>[A-Za-z0-9]+)\.html'. _TEST = {. 'url': 'http://www.yesjapan.com/video/japanese-in-5-20-wa-and-ga-particle-usages_726497834.html',. 'md5': 'f0be416314e5be21a12b499b330c21cf',. 'info_dict': {. 'id': '726497834',. 'title': 'Japanese in 5! #20 - WA And GA Particle Usages',. 'description': 'This should clear up some issues most students of Japanese encounter with WA and GA....',. 'ext': 'mp4',. 'timestamp': 1416391590,. 'upload_date': '20141119',. 'thumbnail': r're:^https?://.\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7M073.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	4.7952958431026165
Encrypted:	false
SSDEEP:	24:1R8lFvqLG+IwS0k4xYn/KdlogthxZ7nxNHNPb0eIXhgtxoBDaytnRYHJFOgEZQSm:PuULNIQkV/KNvnxFNP4jXhk6BDztnHat
MD5:	11D4B197FB0C793FD705EEE297786BB4
SHA1:	1788C65AF3C957751490E9C8575E5B051850536A
SHA-256:	939F68DAB38E148963F3953C8B25263AC8C03E6270AA10192F0E713ACBFB5E07
SHA-512:	093DF1BC1C0790D74CD4BEAAB7A352D313AED060675B032FAD66D83628267545FECA4E7C9003EF48D5E02B870D9CAB6894D9D8F5FE42BBF9A70BCC39E902E7D8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import parse_iso8601...class HowcastIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?howcast\.com/videos/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.howcast.com/videos/390161-How-to-Tie-a-Square-Knot-Properly',. 'md5': '7d45932269a288149483144f01b99789',. 'info_dict': {. 'id': '390161',. 'ext': 'mp4',. 'title': 'How to Tie a Square Knot Properly',. 'description': 'md5:dbe792e5f6f1489027027bf2eba188a3',. 'timestamp': 1276081287,. 'upload_date': '20100609',. 'duration': 56.823,. },. 'params': {. 'skip_download': True,. },. 'add_ie': ['Ooyala'],. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. embed_code = self._search_regex(. r'<iframe[^>]+src="[^"]+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7O181.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1841
Entropy (8bit):	4.892048714440831
Encrypted:	false
SSDEEP:	48:+uM9ILfkeH25vqtfjXjlPc7urxmn6pqgP48VPbXDoBTEqjT6NL:A9EkeH25vIfmq9mS1P4wP3oBTX/6NL
MD5:	E82AE36C4BD9F43754310BC3B42FCE33
SHA1:	93B2C33A611340DC63791BF5D7A64B187BBE781F
SHA-256:	BB8509B5558E28A327BC9F06994A0A1BF026B55EFA59E059D07C7E4498DDC377
SHA-512:	4DF817724409ED3D0C4CCE11D579377535AD2812187874D7FF520D7D9BC7C39BECCD408EFA23FFEF9A061B4F8BC6E54471A5D1F003E0557522A574E791366F6E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class PlaysTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?plays\.tv/(?:video\|embeds)/(?P<id>[0-9a-f]{18})'. _TESTS = [{. 'url': 'https://plays.tv/video/56af17f56c95335490/when-you-outplay-the-azir-wall',. 'md5': 'dfeac1198506652b5257a62762cec7bc',. 'info_dict': {. 'id': '56af17f56c95335490',. 'ext': 'mp4',. 'title': 'Bjergsen - When you outplay the Azir wall',. 'description': 'Posted by Bjergsen',. }. }, {. 'url': 'https://plays.tv/embeds/56af17f56c95335490',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. 'https://plays.tv/video/%s' % video_id, video_id).. info = self._search_json_ld(webpage, video_id,).. mpd_url, sources = re

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7OS2B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3283
Entropy (8bit):	4.761530884034328
Encrypted:	false
SSDEEP:	96:/hfQyFLfzFFKup2vd2SKkkm0y8z8EHAuzZPwxC5o7AT0FBT6Rvt/8V6No:/hfBFDzFGvd2UVGz8EHAuzOM50bTgqVj
MD5:	4CA5D442050298B47778F22D5082CB72
SHA1:	A612069AD92E87C42AC262B83D66AEE5E23BB5FE
SHA-256:	4E5D8A6524199DF492F6F46A2BA8106F67AFA51E92C6E257977D1006038D650C
SHA-512:	EEBE771233115DE7FFB7AE062A8AE987921E842C8B591ECFF9EEFED3C3E90A61AD5CB3D579BD68EDDFFF683617BF065C054439371B4C105378788657012C4A5D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. srt_subtitles_timecode,.)...class KanalPlayIE(InfoExtractor):. IE_DESC = 'Kanal 5/9/11 Play'. _VALID_URL = r'https?://(?:www\.)?kanal(?P<channel_id>5\|9\|11)play\.se/(?:#!/)?(?:play/)?program/\d+/video/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.kanal5play.se/#!/play/program/3060212363/video/3270012277',. 'info_dict': {. 'id': '3270012277',. 'ext': 'flv',. 'title': 'Saknar b.de dusch och avlopp',. 'description': 'md5:6023a95832a06059832ae93bc3c7efb7',. 'duration': 2636.36,. },. 'params': {. # rtmp download. 'skip_download': True,. }. }, {. 'url': 'http://www.kanal9play.se/#!/play/program/335032/video/246042',. 'only_matching': True,. }, {. 'url': 'http://www.kanal11play.se/#!

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7PURB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2227
Entropy (8bit):	4.791767740971187
Encrypted:	false
SSDEEP:	48:+uupqAfg8aI/HX4s3X+8tfjXh4GruXH77WSqGR+kkYhBTMlbqNlSAt/8cxA6Ng:9ig8aI/HX4Y+yfyGUeSdR+k7hBTMlbqS
MD5:	63374E0B36650701439B2BB8814B7D55
SHA1:	9F51ADA60A7731F36F9E1E709A96F2DC60973868
SHA-256:	9BA1916311CDD7D060ED146706ED03714CC01E0234466F037EB526207D2CA84B
SHA-512:	92B5657D2E38D000A4C8F29E63A74B2F02FA5F5A473CEBEAFA24D00B0CE0A1590E02E94846481853F0546909F3F6E347AC60BF4D743A3D8F53D99A0458FB970D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. dict_get,. int_or_none,.)...class KinoPoiskIE(InfoExtractor):. _GEO_COUNTRIES = ['RU']. _VALID_URL = r'https?://(?:www\.)?kinopoisk\.ru/film/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.kinopoisk.ru/film/81041/watch/',. 'md5': '4f71c80baea10dfa54a837a46111d326',. 'info_dict': {. 'id': '81041',. 'ext': 'mp4',. 'title': '..... ....... . ....... ....',. 'description': 'md5:43787e673d68b805d0aa1df5a5aea701',. 'thumbnail': r're:^https?://.*',. 'duration': 4533,. 'age_limit': 12,. },. 'params': {. 'format': 'bestvideo',. },. }, {. 'url': 'https://www.kinopoisk.ru/film/81041',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7QIAC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3359
Entropy (8bit):	4.772934535029396
Encrypted:	false
SSDEEP:	96:YOfhq5+MnX/+7TVIVfX7u1HhHGIMfJa7mPsbm7dG39G2gRv6kC1t06Ng:t4rcJT1HhHGI6Jas7dG39GtcQ6Ng
MD5:	4FCEF9F897B2F3B06AC14F4C8E6E2D39
SHA1:	AF7BFAEE296A392D9A52712FB1C1AE7EDD506B18
SHA-256:	CC4FFC4C03030CACA7A6326DE7A82C77EE87EDDD707F2DC74328218DEFEB06E7
SHA-512:	7E04D0F68102F6A985DAE72540DFB8064EA16644261B25FBF9BD97C9926CD4560F5D73B1F78EFA5BEF19B5D9978E104EB16846C2A8BFE53973B8DDAA2AB1D5CD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. unified_timestamp,.)...class RuvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ruv\.is/(?:sarpurinn/[^/]+\|node)/(?P<id>[^/]+(?:/\d+)?)'. _TESTS = [{. # m3u8. 'url': 'http://ruv.is/sarpurinn/ruv-aukaras/fh-valur/20170516',. 'md5': '66347652f4e13e71936817102acc1724',. 'info_dict': {. 'id': '1144499',. 'display_id': 'fh-valur/20170516',. 'ext': 'mp4',. 'title': 'FH - Valur',. 'description': 'Bein .tsending fr. 3. leik FH og Vals . .rslitum Ol.sdeildar karla . handbolta.',. 'timestamp': 1494963600,. 'upload_date': '20170516',. },. }, {. # mp3. 'url': 'http://ruv.is/sarpurinn/ras-2/morgunutvarpid/20170619',. 'md5': '395ea250c8a13e5fdb39d4670ef85378',. 'info_dict': {. 'id': '1153630',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7QJPG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7476
Entropy (8bit):	4.608336674283991
Encrypted:	false
SSDEEP:	192:sMBdgoVKzyJ/zjGSi5sVTBfVuTw6N2JxP7tWrQVKnMKlLh:JBKosWJnGSi5sVTbuTw6N2JxjtWrJFLh
MD5:	44B725F053C07947D5D39888398ED2A6
SHA1:	E411859EEDA266D4DD9986F0694D127B6BCBE257
SHA-256:	C3CD65860999E6B474A347434F44E20E991BD674F8CE066841740322CAB7939D
SHA-512:	D09A43C6258F17C582906F7049F1AAF4F08591F2616FBEAED24B96E7DFEB091067921BB10690371378F381EFC902CD3EEA26BF614F8271DA9A05E97835E6D35B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_xpath,.).from ..utils import (. int_or_none,. parse_duration,. smuggle_url,. unsmuggle_url,. xpath_text,.)...class MicrosoftVirtualAcademyBaseIE(InfoExtractor):. def _extract_base_url(self, course_id, display_id):. return self._download_json(. 'https://api-mlxprod.microsoft.com/services/products/anonymous/%s' % course_id,. display_id, 'Downloading course base URL').. def _extract_chapter_and_title(self, title):. if not title:. return None, None. m = re.search(r'(?P<chapter>\d+)\s\\|\s(?P<title>.+)', title). return (int(m.group('chapter')), m.group('title')) if m else (None, title)...class MicrosoftVirtualAcademyIE(MicrosoftVirtualAcademyBaseIE):. IE_NAME = 'mva'. IE_DESC = 'Microsoft Virtual Academy videos'. _VALID_URL = r'(?:%s:\|https?://(?:mva\.microsoft\|(?:www\.)?microsoftvi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7VHJ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1486
Entropy (8bit):	5.042135665591633
Encrypted:	false
SSDEEP:	24:1R8ldnhGxviRofjmfW6/edlycAphhemBeZsMHTnD1qHP0v5taKwk3MJoXjlhPIBv:PudnhnofoReOcGfBerD1qv0BtaKHMJok
MD5:	8ECBACC29830595285165257720D5904
SHA1:	C5EB3085511B478513CBC56F3BC324222DEEB902
SHA-256:	4299FE16D3CD753797FE37F8A66A7E53C49B6D2051630A69F6F9E00E33254469
SHA-512:	AEB5B7636FB5869603CFD4C1967FBAC66785A6A3AEFE3EEA7DB49EDD813BC963C72FF128AB5A286E945517278FFC397922ED08BA8247B114A1B48C9573FF97F9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .cbs import CBSBaseIE...class CBSSportsIE(CBSBaseIE):. _VALID_URL = r'https?://(?:www\.)?cbssports\.com/[^/]+/(?:video\|news)/(?P<id>[^/?#&]+)'.. _TESTS = [{. 'url': 'https://www.cbssports.com/nba/video/donovan-mitchell-flashes-star-potential-in-game-2-victory-over-thunder/',. 'info_dict': {. 'id': '1214315075735',. 'ext': 'mp4',. 'title': 'Donovan Mitchell flashes star potential in Game 2 victory over Thunder',. 'description': 'md5:df6f48622612c2d6bd2e295ddef58def',. 'timestamp': 1524111457,. 'upload_date': '20180419',. 'uploader': 'CBSI-NEW',. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }, {. 'url': 'https://www.cbssports.com/nba/news/nba-playoffs-2018-watch-76ers-vs-heat-game-3-series-schedule-tv-channel-online-stream/',. 'only_matching': True,. }].. def _extrac

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-7VOM9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5781
Entropy (8bit):	4.678496260325426
Encrypted:	false
SSDEEP:	96:3XbXqCf4xCcUL00VtucOYNiOhtvephGfJsrMu5dshBTUdhGcFVh686NR9:blPtL02tCYk09egJMfdsvTIxt6Nz
MD5:	14E53367E81A7DB51DB30E2FA6C1369D
SHA1:	E115AB12FFF2DFBA32B597322598A395A1CEE1BA
SHA-256:	FF2F026D1DE50AEECE29A8CA342598B63A8778660B0FDFB4516321DD584FD4C9
SHA-512:	D06835764006A862599A1E22B46CBA9895898F12E3CE5922091C8B1281374AC3D0C244A1FE5F19A478CD52B9F2154EBE4C4D71CD4B6C5D3F93C60395426C4CCE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,. str_or_none,. urlencode_postdata,.)...class RoosterTeethIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?roosterteeth\.com/episode/(?P<id>[^/?#&]+)'. _LOGIN_URL = 'https://roosterteeth.com/login'. _NETRC_MACHINE = 'roosterteeth'. _TESTS = [{. 'url': 'http://roosterteeth.com/episode/million-dollars-but-season-2-million-dollars-but-the-game-announcement',. 'md5': 'e2bd7764732d785ef797700a2489f212',. 'info_dict': {. 'id': '9156',. 'display_id': 'million-dollars-but-season-2-million-dollars-but-the-game-announcement',. 'ext': 'mp4',. 'title': 'Million Dollars, But... The Game Announcement',. 'description': 'md5:168a54b40e228e79f4ddb141e89fe4f5',. 'thumbnail': r

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8299J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1081
Entropy (8bit):	4.96746081382743
Encrypted:	false
SSDEEP:	24:zi8lvveOlewXEtQHJmNw/Pdlnx8JYft8a6PHrqadfFss5Qw:+ueOAcE8uwP7xB6vWadfFB5Qw
MD5:	0254CF3F0C5897542BEEA4526D5F36F7
SHA1:	CDDAEBD4DA34631E5B68C3F7491D416C000247A8
SHA-256:	45DEF56907B1621A142A02B4D25954A6BD4377C35972640CD5C5D4201716529C
SHA-512:	79AA28F39D3E36D7DAF2FDA5B4A863F5555A00C04C03F52BE6AC279A3A2B08A7909BD8CF33FE93389E24B6C9827A176AAE81F08E7C452F6F781A005D5F422C01
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import os.path.import re..from .common import InfoExtractor...class SaveFromIE(InfoExtractor):. IE_NAME = 'savefrom.net'. _VALID_URL = r'https?://[^.]+\.savefrom\.net/\#url=(?P<url>.)$'.. _TEST = {. 'url': 'http://en.savefrom.net/#url=http://youtube.com/watch?v=UlVRAPW2WJY&utm_source=youtube.com&utm_medium=short_domains&utm_campaign=ssyoutube.com',. 'info_dict': {. 'id': 'UlVRAPW2WJY',. 'ext': 'mp4',. 'title': 'About Team Radical MMA \| MMA Fighting',. 'upload_date': '20120816',. 'uploader': 'Howcast',. 'uploader_id': 'Howcast',. 'description': r're:(?s). Hi, my name is Rene Dreifuss\. And I\'m here to show you some MMA.*',. },. 'params': {. 'skip_download': True. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = os.path.splitext(url.split('/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-837V4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1853
Entropy (8bit):	4.826779939073006
Encrypted:	false
SSDEEP:	48:PuhrE7rWXK/PytjXhk73Bii2xeQsw3Ar9GBwmIvGX1Xui4v8:YrE7rWX6PytaN2xetw3+9SIvMH4v8
MD5:	125DDD8B1DF42F588BC8A14587E4E620
SHA1:	02D35AC1F3C73D20967E42D3231E69DF723BFCA7
SHA-256:	FB0B744F39898AF120EFFFFF273AA0D9A12A500555761F0538B8C7DB0F938BF5
SHA-512:	C68BC75B668A9087CA6D6A78707FF213C91D3CDCDAE59D9A9D3812A662384A32839242DB192D9B383EB1FC2B189D920D0C459CDE8EAB7A9251B7C630D99203B6
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. sanitized_Request,. urlencode_postdata,.)...class PrimeShareTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?primeshare\.tv/download/(?P<id>[\da-zA-Z]+)'.. _TEST = {. 'url': 'http://primeshare.tv/download/238790B611',. 'md5': 'b92d9bf5461137c36228009f31533fbc',. 'info_dict': {. 'id': '238790B611',. 'ext': 'mp4',. 'title': 'Public Domain - 1960s Commercial - Crest Toothpaste-YKsuFona',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. if '>File not exist<' in webpage:. raise ExtractorError('Video %s does not exist' % video_id, expected=True).. fields = self._hidden_inputs(webpage).. headers = {. 'Referer': url,. 'Content-Type': 'application/x-www-f

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-886R8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3708
Entropy (8bit):	4.7629151835244254
Encrypted:	false
SSDEEP:	96:bfP0dlKtmXwmyCsWrTIP9nm5nTnCGIXSv/JbIm8itc:b8DvXzxsWrs+jCGICHumA
MD5:	E8B85E735491D230E250F233957E57E8
SHA1:	A567A5FE60A4CE89309364F5454B5FE42D12BE2B
SHA-256:	1FAA2970B43B381BD8CDA7D4288E1A35AA1A9D533ECE4C3D70AF6113302B529F
SHA-512:	E8F1B230C9F96106F4BB864CCB24FCAD243892883557D5662348EC31A83450AB68D540CE4342858D785053C050F04BE9C9EF1AA7BAC3D67C0A68414A72E3D62B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import str_to_int...class NineGagIE(InfoExtractor):. IE_NAME = '9gag'. _VALID_URL = r'https?://(?:www\.)?9gag(?:\.com/tv\|\.tv)/(?:p\|embed)/(?P<id>[a-zA-Z0-9]+)(?:/(?P<display_id>[^?#/]+))?'.. _TESTS = [{. 'url': 'http://9gag.com/tv/p/Kk2X5/people-are-awesome-2013-is-absolutely-awesome',. 'info_dict': {. 'id': 'kXzwOKyGlSA',. 'ext': 'mp4',. 'description': 'This 3-minute video will make you smile and then make you feel untalented and insignificant. Anyway, you should share this awesomeness. (Thanks, Dino!)',. 'title': '\"People Are Awesome 2013\" Is Absolutely Awesome',. 'uploader_id': 'UCdEH6EjDKwtTe-sO2f0_1XA',. 'uploader': 'CompilationChannel',. 'upload_date': '20131110',. 'view_count': int,. },. 'add_ie': ['Youtube'],. }, {. 'url': 'http://9gag.com/tv/p/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-89UGD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	5.000802156573237
Encrypted:	false
SSDEEP:	24:1R8lFvKiGnyZfOOzJ/ZadlKAigfT0VhKkHP+q1A3tfeIXjlgtgBLikMSw:Pu0irZfOOFsxr0V0kv+2A3tfjXjlkgBO
MD5:	15D0F3A714B4D6D4909BCD08B0EE0E89
SHA1:	AD701753DB4823DA107EAEAE4C9C400EFC5F26D9
SHA-256:	BC00A22092EF5471F373F3E9DBEA4FD88746CD7CCB8C440ACBEB3771BB005D8F
SHA-512:	6A8D0E26D5CC959DDBFF65A68F2C9AD1117EF3004C2A93F481D69962E925A207EC46E83B74EBCCB31840F6F291D172C436ED6A9C575B8B61B718AA59ECF7A6B4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .youtube import YoutubeIE...class UnityIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?unity3d\.com/learn/tutorials/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://unity3d.com/learn/tutorials/topics/animation/animate-anything-mecanim',. 'info_dict': {. 'id': 'jWuNtik0C8E',. 'ext': 'mp4',. 'title': 'Live Training 22nd September 2014 - Animate Anything',. 'description': 'md5:e54913114bd45a554c56cdde7669636e',. 'duration': 2893,. 'uploader': 'Unity',. 'uploader_id': 'Unity3D',. 'upload_date': '20140926',. }. }, {. 'url': 'https://unity3d.com/learn/tutorials/projects/2d-ufo-tutorial/following-player-camera?playlist=25844',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpa

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8CTVG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3695
Entropy (8bit):	4.765201532425252
Encrypted:	false
SSDEEP:	96:BybN4biPNSdoOgwEduy2ymyPy/yp1yrGyUy/WLWoWJ7O:kbC6NSdodwIZpq6p0rJ7/WLWor
MD5:	1841E8DD41AD803CC22D978467797DAE
SHA1:	1CA18A23AF1D3EEAB25CED9A8B548698BBC150A2
SHA-256:	18278EFA3AA47B12406F5C93D0256C0E6A93832B2C92D713DA7AEBF7C4CE2860
SHA-512:	251735169B12CEF5258B9EF9D2FE1C41F91CAD3B2E0067F001C1DF249B4EC232E8C33E1EDE7E5B93BFD7BBBD18FDFC9E1B90855D3102FA9F7F9D942DF5A647DE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .theplatform import ThePlatformFeedIE.from ..utils import int_or_none...class CorusIE(ThePlatformFeedIE):. _VALID_URL = r'''(?x). https?://. (?:www\.)?. (?P<domain>. (?:globaltv\|etcanada)\.com\|. (?:hgtv\|foodnetwork\|slice\|history\|showcase\|bigbrothercanada)\.ca. ). /(?:video/(?:[^/]+/)?\|(?:[^/]+/)+(?:videos/[a-z0-9-]+-\|video\.html\?.*?\bv=)). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://www.hgtv.ca/shows/bryan-inc/videos/movie-night-popcorn-with-bryan-870923331648/',. 'md5': '05dcbca777bf1e58c2acbb57168ad3a6',. 'info_dict': {. 'id': '870923331648',. 'ext': 'mp4',. 'title': 'Movie Night Popcorn with Bryan',. 'description': 'Bryan whips up home

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8DD7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2116
Entropy (8bit):	5.186038717986418
Encrypted:	false
SSDEEP:	48:+ug4ZXv1SVfmajXj3j0Us4rBkaBbdOPfE6DbBRIKzmj98cI:xXv1mfmaT0d42IdOn3DbcK298t
MD5:	060931E027990242A7B91FF835AF5D09
SHA1:	49AB178019BED00C4AA086BEE5D0728077629A6D
SHA-256:	DE8D6DCC9CBA7B170ED1043EEC1364743D29B146C7051614034E70B7E39B813C
SHA-512:	FC942F079DA0767F3931EBC01170F158C928036378E88E65175BDDC2267FA113D102A4E4A4EF2376BF36FA8D59111A378D281B3ABF5A706FA4E1BAB4044B2164
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_duration,. int_or_none,. ExtractorError,.)...class Porn91IE(InfoExtractor):. IE_NAME = '91porn'. _VALID_URL = r'(?:https?://)(?:www\.\|)91porn\.com/.+?\?viewkey=(?P<id>[\w\d]+)'.. _TEST = {. 'url': 'http://91porn.com/view_video.php?viewkey=7e42283b4f5ab36da134',. 'md5': '7fcdb5349354f40d41689bd0fa8db05a',. 'info_dict': {. 'id': '7e42283b4f5ab36da134',. 'title': '18..................',. 'ext': 'mp4',. 'duration': 431,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). self._set_cookie('91porn.com', 'language', 'cn_CN').. webpage = self._download_webpage(. 'http://91porn.com/view_video.php?viewkey=%s' % video_id, video_id).. if '.........

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8EAS5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (552)
Category:	dropped
Size (bytes):	9238
Entropy (8bit):	4.847754913960245
Encrypted:	false
SSDEEP:	192:agOYmbcz9EXG3MpS3t10c24V/3GbW5NH6xfThm5O1OCRSCfnO1y5jMTGeP:agOYmbIEXG3wS3t10l4V/3esNH6xfThs
MD5:	D9BA8D2366338E09EB3B6BC10FB2D082
SHA1:	ABC83C2A9476E8CB84E94807CF1C1EE2CE58741D
SHA-256:	2863065928F835FC9BA7E0B75EB21C596F780F83AE7394662A3DA822AD9F1D74
SHA-512:	2AE43E759F2500264FC93F339A53425648AA28B87F2665180497A5CF38BD1795BEF711A7DDD06C61F90D93200F15488983C7C45F146425EA3DC3DC452E3287D4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_etree_fromstring,. compat_parse_qs,. compat_urllib_parse_unquote,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. unified_strdate,. int_or_none,. qualities,. unescapeHTML,. urlencode_postdata,.)...class OdnoklassnikiIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:(?:www\|m\|mobile)\.)?. (?:odnoklassniki\|ok)\.ru/. (?:. video(?:embed)?/\|. web-api/video/moviePlayer/\|. live/\|. dk\?.*?st\.mvId=. ). (?P<id>[\d-]+). '''. _TESTS = [{. # metadata in JSON. 'url': 'http://ok.ru/video/20079905452',. 'md5': '0b62089b479e06681abaaca9d204f152',. 'info_dict': {. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8EH9J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	5.114780571646612
Encrypted:	false
SSDEEP:	24:zi8llDzDxKVG3lT3KdPxCGlHKbtKt7a34/tjlt4eI5ZPtKNy/Dodl/MVpmAZ3HN/:+ul/lS4lTmPcGlHStuRI/t1sYVIkN2qz
MD5:	B426403B3AE3877E010DC6A983F44B36
SHA1:	9F32C2A5937BF081453D741A2B0E11B4DB7C4061
SHA-256:	7C06FFC2038789BBA738742D133BF6CF5C0C4A60C394C016F77D34171D203BE6
SHA-512:	861248036465948841003AD363F35AFA68D4869EB4EB88EF6FC1F16D40EAC59D1899813C32D5D827A7AB62FB49E238A37E15ECCD7F54FB89899F966085D06A74
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .spike import ParamountNetworkIE...class TVLandIE(ParamountNetworkIE):. IE_NAME = 'tvland.com'. _VALID_URL = r'https?://(?:www\.)?tvland\.com/(?:video-clips\|(?:full-)?episodes)/(?P<id>[^/?#.]+)'. _FEED_URL = 'http://www.tvland.com/feeds/mrss/'. _TESTS = [{. # Geo-restricted. Without a proxy metadata are still there. With a. # proxy it redirects to http://m.tvland.com/app/. 'url': 'https://www.tvland.com/episodes/s04pzf/everybody-loves-raymond-the-dog-season-1-ep-19',. 'info_dict': {. 'description': 'md5:84928e7a8ad6649371fbf5da5e1ad75a',. 'title': 'The Dog',. },. 'playlist_mincount': 5,. }, {. 'url': 'https://www.tvland.com/video-clips/4n87f2/younger-a-first-look-at-younger-season-6',. 'md5': 'e2c6389401cf485df26c79c247b08713',. 'info_dict': {. 'id': '891f7d3c-5b5b-4753-b879-b7ba1a601757',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8FCUL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2878
Entropy (8bit):	4.105232459574208
Encrypted:	false
SSDEEP:	48:+uiKFmGfHCztm0GN23+7o+dfFJZZvcPEvRqyaiwmlB9WD8zET:MAiztm0Go3p++c5qyaidhWQET
MD5:	DC44A725094BA9DC70DCBF21DD7B4229
SHA1:	62505585A113BA81133EE84F8B5F57BB79D6CED7
SHA-256:	5252E8BA5998515B53B1CD7355B7F17EE3219886C2C172E737D50D3F77E1FAED
SHA-512:	3EA021DD25AA51203E9BC7D8FA3BDACC6459D5F803294626FE728354EBBD6089238CF4F49F558438E1E6BBC388671CD48DB58FDBC3743D9BB2077BE22FFA54E1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from .kaltura import KalturaIE...class AZMedienIE(InfoExtractor):. IE_DESC = 'AZ Medien videos'. _VALID_URL = r'''(?x). https?://. (?:www\.)?. (?P<host>. telezueri\.ch\|. telebaern\.tv\|. telem1\.ch. )/. [^/]+/. (?P<id>. [^/]+-(?P<article_id>\d+). ). (?:. \#video=. (?P<kaltura_id>. [_0-9a-z]+. ). )?. '''.. _TESTS = [{. 'url': 'https://www.telezueri.ch/sonntalk/bundesrats-vakanzen-eu-rahmenabkommen-133214569',. 'info_dic

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8FKMK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4606
Entropy (8bit):	4.892708408289217
Encrypted:	false
SSDEEP:	96:RUUqSHbRHldUaIAUm7u6tNH9uoI5O89gLfVvXLL784A6qndMK3o5uqdYHs860f:RUNSVcAR7ZtN45OQgLfVvXLL784A6qq2
MD5:	0F2FA187BE73BD6A9022FEAEDE9DFD90
SHA1:	D85F72438B3170CB8DF7C8E6DB4FAAB9C7FE9900
SHA-256:	3333BA44E82DA43F2AFF45DF902CC408AE0065C4E0F65BACE05A20D2EF998549
SHA-512:	46DC296D5BE936762E1E1EE09CFD7B8BCABD057E1247FD7492720B9A872AD35A880786862D579828B1BEC801CC4CDD2CED317544D7D9D78FAFDC421EDFC61452
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote_plus.).from ..utils import (. parse_duration,. remove_end,. unified_strdate,. urljoin.)...class NDTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?ndtv\.com/(?:[^/]+/)videos?/?(?:[^/]+/)[^/?^&]+-(?P<id>\d+)'.. _TESTS = [. {. 'url': 'https://khabar.ndtv.com/video/show/prime-time/prime-time-ill-system-and-poor-education-468818',. 'md5': '78efcf3880ef3fd9b83d405ca94a38eb',. 'info_dict': {. 'id': '468818',. 'ext': 'mp4',. 'title': "...... ....: ...... ....., ..... .....",. 'description': 'md5:f410512f1b49672e5695dea16ef2731d',. 'upload_date': '20170928',. 'duration': 2218,. 'thumbnail': r're:https?://.*\.jpg',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8FLF3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10066
Entropy (8bit):	4.81219604303769
Encrypted:	false
SSDEEP:	192:DhUUED1FY3ypJTMpK5UqMDie6VD+WlAUJ7O11oi13sTY6Ne2+5jA983ifNNCDV1a:CvY3sJTMpcUqGiNh+OO1qi13sTY6Ne2X
MD5:	DE7D5463492E8276EE3309D80D72FB54
SHA1:	85E3EDB2151F5F46024C5A91E15088B9C3FCF19B
SHA-256:	F79A2CBF661207D17FE7048B4A6F46F8820FE2A359366E884D6F1BA30544F119
SHA-512:	487B493E542001354B34ABED203F527457EBBCD30AFA3C60D6EDD2E552C3F04A5654B7928568CF5F429EC8603AF8F148A9A880F75EE7E81DD29315A8DC3A2832
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import re.import time..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_struct_unpack,.).from ..utils import (. determine_ext,. ExtractorError,. float_or_none,. remove_end,. remove_start,. sanitized_Request,. std_headers,.)...def _decrypt_url(png):. encrypted_data = compat_b64decode(png). text_index = encrypted_data.find(b'tEXt'). text_chunk = encrypted_data[text_index - 4:]. length = compat_struct_unpack('!I', text_chunk[:4])[0]. # Use bytearray to get integers when iterating in both python 2.x and 3.x. data = bytearray(text_chunk[8:8 + length]). data = [chr(b) for b in data if b != 0]. hash_index = data.index('#'). alphabet_data = data[:hash_index]. url_data = data[hash_index + 1:]. if url_data[0] == 'H' and url_data[3] == '%':. # remove useless HQ%% at the start. url_data = url_data[4:].. alphabet = [].

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8H5UI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1955
Entropy (8bit):	4.934639221531389
Encrypted:	false
SSDEEP:	48:+uhGIlbCf9ifkIXSgwWE1ziXwCt8cy38IdJulfFIxgT:FGIlQ9ifkIC5WE1zSn8cysIdJuQG
MD5:	3D218F47E31BA6B64A4450A3B33CEE78
SHA1:	E03630DEDF2CBFB8988F237C81BF74FF089B79C1
SHA-256:	FF5C7A1E6DC6A9AED46BEF85FDCD998EEFEB8EDD0421FC4E85E622837E834C3F
SHA-512:	BB18A5AB7ED369EB3D8919C590C9F099BEB681A72159A038BB4D25F86EA478A8ECE2E7B01D035F20FFC08FA7C456FD32B42DFFE6F29DD4D06822032BDDB1FF38
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class DBTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?dagbladet\.no/video/(?:(?:embed\|(?P<display_id>[^/]+))/)?(?P<id>[0-9A-Za-z_-]{11}\|[a-zA-Z0-9]{8})'. _TESTS = [{. 'url': 'https://www.dagbladet.no/video/PynxJnNWChE/',. 'md5': 'b8f850ba1860adbda668d367f9b77699',. 'info_dict': {. 'id': 'PynxJnNWChE',. 'ext': 'mp4',. 'title': 'Skulle teste ut forn.yelsespark, men kollegaen var bare opptatt av bikinikroppen',. 'description': 'md5:49cc8370e7d66e8a2ef15c3b4631fd3f',. 'thumbnail': r're:https?://.*\.jpg',. 'upload_date': '20160916',. 'duration': 69,. 'uploader_id': 'UCk5pvsyZJoYJBd7_oFPTlRQ',. 'uploader': 'Dagbladet',. },. 'add_ie': ['Youtube']. }, {. 'url': 'https://www.dagbladet.no/video/embed/xlGmyIeN9Jo/?autoplay=false',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8KJ9K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	4.905607536668045
Encrypted:	false
SSDEEP:	48:+uckfllg1GEXjtlqwh3tfdfFGlhrVSAnuVDlIOUsytCqGMkrBTkP9pNlb4uUbRVn:Y2TIGEXj3qgfKPQlIOU9CdMaBTupNlbK
MD5:	2F3421591492F8D28FEBA151E59A60CA
SHA1:	6F609A2F707D167C405708B96EAD5D18DCB05867
SHA-256:	DD26D81AE3159D712F836322EAA48DA084BBF541267123294C5102EF1D90B879
SHA-512:	18195188DEAD2B9CF8AAB6E44D9A226DB234E51B7DC8ECF31E7BFA40F0EBD2A15C88AFEF49FFFA1CAFCE7AA0AA5798B2D86E3173F8A3B0600B8F3D0C8A5D3576
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class VidioIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vidio\.com/watch/(?P<id>\d+)-(?P<display_id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://www.vidio.com/watch/165683-dj_ambred-booyah-live-2015',. 'md5': 'cd2801394afc164e9775db6a140b91fe',. 'info_dict': {. 'id': '165683',. 'display_id': 'dj_ambred-booyah-live-2015',. 'ext': 'mp4',. 'title': 'DJ_AMBRED - Booyah (Live 2015)',. 'description': 'md5:27dc15f819b6a78a626490881adbadf8',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 149,. 'like_count': int,. },. }, {. 'url': 'https://www.vidio.com/watch/77949-south-korea-test-fires-missile-that-can-strike-all-of-the-north',. 'only_matching': True,. }].. def _real_extract(self, url):. mobj = re.ma

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8KPCT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1927
Entropy (8bit):	4.444792237670257
Encrypted:	false
SSDEEP:	48:+u3CdEdfFwFZK8sjKmtXqDMBNAm9U2BTVobjxpEA6Ng:DCdEA4jKmtXBNAmDBTVobjxpEA6Ng
MD5:	899C1B3ABE008862A62FC36512AEA0C4
SHA1:	DAE2EA1C4FA30B180D0CF229414B132C2D45B5E0
SHA-256:	6A36CC3328C1DDEE9C9E24244A07321C163E3BA49E6ED478723976DE2578A4C3
SHA-512:	B7ACA2917A865865C812AE3A468E42AD26B8E11F049A0FA16480664F4AAF999AAAA0CC091E2D7EE490F6B608F3A62E783FEDAA29DF870AA154A5FA33B92D1096
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_codecs,.)...class MinotoIE(InfoExtractor):. _VALID_URL = r'(?:minoto:\|https?://(?:play\|iframe\|embed)\.minoto-video\.com/(?P<player_id>[0-9]+)/)(?P<id>[a-zA-Z0-9]+)'.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). player_id = mobj.group('player_id') or '1'. video_id = mobj.group('id'). video_data = self._download_json('http://play.minoto-video.com/%s/%s.js' % (player_id, video_id), video_id). video_metadata = video_data['video-metadata']. formats = []. for fmt in video_data['video-files']:. fmt_url = fmt.get('url'). if not fmt_url:. continue. container = fmt.get('container'). if container == 'hls':. formats.extend(fmt_url, video_id, 'mp4', m3u8_id='hls', fatal=False). else:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8PE7B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15414
Entropy (8bit):	4.398217858651354
Encrypted:	false
SSDEEP:	384:4+Mbl+JKxogLAqgpT7Z6NbYKja5t6Iw/wAO60/ug2MC9oTjX6Nq:45+JKxogLAqgpT7Z8/Iw/ZMuoTjX8q
MD5:	A1EB9C163EE8F6790C0846DF3E242441
SHA1:	447F42CB9D1358F363ACE70CA05D2C4CB76DD50E
SHA-256:	69A3D8503FE0F429E51E06F257422D56CF5A5B14576F56D38F50382A2F9B858D
SHA-512:	DF1AECE6D04C05F4B4BA0D483F388046A63E55BBBA4135E62F4A14CF2D10CC3A0F1902A2E6FDE82D63BE0E8F1EAA3846A3AE03C56691FE5AB25CAA6D69F00DE2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import random.import re.import time..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. KNOWN_EXTENSIONS,. parse_filesize,. str_or_none,. try_get,. unescapeHTML,. update_url_query,. unified_strdate,. unified_timestamp,. url_or_none,.)...class BandcampIE(InfoExtractor):. _VALID_URL = r'https?://[^/]+\.bandcamp\.com/track/(?P<title>[^/?#&]+)'. _TESTS = [{. 'url': 'http://youtube-dl.bandcamp.com/track/youtube-dl-test-song',. 'md5': 'c557841d5e50261777a6585648adf439',. 'info_dict': {. 'id': '1812978515',. 'ext': 'mp3',. 'title': "youtube-dl \"'/\\\u00e4\u21ad - youtube-dl test song \"'/\\\u00e4\u21ad",. 'duration': 9.8485,. },. '_skip': 'There is a limit of 200 free downloads / month for the test song'. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8R1NT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7359
Entropy (8bit):	4.863821217071368
Encrypted:	false
SSDEEP:	192:Q+mOiJSrwToQLjt6NRMQI0UD9IdanAxhmua0U3IoEqKijTJfOF6NHQZZ:Npi0wTVp6NRMa7Wc3aNIo3KijTZC6NIZ
MD5:	55E262EFD2F2981E5F21EE876810DBA6
SHA1:	9690C94E4040FD316028C158DD778B7ECFA4ACB9
SHA-256:	F7AA277ED164D4CB0D14528E498AFECA0A79FEB80C2391F936581D3C3E523FA7
SHA-512:	03E03EB5AB443A5EAA81F2E11BAE9A430405DD847296449B65D290EB7FA21207805D3B0B8658C4B19E5CAD76455B561BC4845A69FB1CE0EEBE26A421DDB4F60E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. parse_duration,. unified_strdate,. str_to_int,. int_or_none,. float_or_none,. ISO639Utils,. determine_ext,.)...class AdobeTVBaseIE(InfoExtractor):. _API_BASE_URL = 'http://tv.adobe.com/api/v4/'...class AdobeTVIE(AdobeTVBaseIE):. _VALID_URL = r'https?://tv\.adobe\.com/(?:(?P<language>fr\|de\|es\|jp)/)?watch/(?P<show_urlname>[^/]+)/(?P<id>[^/]+)'.. _TEST = {. 'url': 'http://tv.adobe.com/watch/the-complete-picture-with-julieanne-kost/quick-tip-how-to-draw-a-circle-around-an-object-in-photoshop/',. 'md5': '9bc5727bcdd55251f35ad311ca74fa1e',. 'info_dict': {. 'id': '10981',. 'ext': 'mp4',. 'title': 'Quick Tip - How to Draw a Circle Around an Object in Photoshop',. 'description': 'md5:99ec318dc909d7ba2a1f2b038f7d2311',. 'thumbnail': r're:https?://.*\.jp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8T178.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2123
Entropy (8bit):	4.5569693822152555
Encrypted:	false
SSDEEP:	48:+usWOYcY8j/Frz7/ajXjlk5wng+aDyW04dELOW41iYq89BThRTNs6Ng:zO/Yqlz7/aqgg+VW7dELOWEi389BThRC
MD5:	ECD986C4E9F5FB16E3A4586FFDCBA036
SHA1:	1093DC3BC6C86255C85765D41A599E84362FFE56
SHA-256:	3B57BA8A3134AF0CED06A6FB045EA7D0BA9C7B65301CD57DB55C51F74F442525
SHA-512:	E333C3ED4D1755D978202AE0655772574818823BEB2E466F9785EDC2E51187CFAC5357837345D8AC661FDC462360C7F51EFBDCDE58B65E0D0DA0AC1E111DE6AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. js_to_json,. mimetype2ext,. determine_ext,. update_url_query,. get_element_by_attribute,. int_or_none,.)...class NobelPrizeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nobelprize\.org/mediaplayer.?\bid=(?P<id>\d+)'. _TEST = {. 'url': 'http://www.nobelprize.org/mediaplayer/?id=2636',. 'md5': '04c81e5714bb36cc4e2232fee1d8157f',. 'info_dict': {. 'id': '2636',. 'ext': 'mp4',. 'title': 'Announcement of the 2016 Nobel Prize in Physics',. 'description': 'md5:05beba57f4f5a4bbd4cf2ef28fcff739',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). media = self._parse_json(self._search_regex(. r'(?s)var\sconfig\s=\s({.+?});', webpage,. 'config'), video_id, js_to_j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8T2N6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	5.244844071771739
Encrypted:	false
SSDEEP:	48:+uuHcfQHlXYNbOOAZJXgvhXYNbOOCtfjXjlk6b8B4uvFeBgNJbjtc:yOSeOOAZJXgvVeOOAfqAcvFTJbjtc
MD5:	B85D411B67711345BEC5A382CA88321E
SHA1:	9BC44BC372F225F6A3F12E14ED1A83961E58B215
SHA-256:	8420D0CD478815B615CA6F9E5AE9162B88DADE467CC695681CDEC2098831DCDC
SHA-512:	7C84E9E667F0780F96FF1A864569FA2EA1FB9F06FF2D9334765C3047A00F44832BD40F94A823B0AC1A0423743B514D88D96EFBFAC9B288484012700EBC927661
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import remove_start...class Ir90TvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?90tv\.ir/video/(?P<id>[0-9]+)/.'. _TESTS = [{. 'url': 'http://90tv.ir/video/95719/%D8%B4%D8%A7%DB%8C%D8%B9%D8%A7%D8%AA-%D9%86%D9%82%D9%84-%D9%88-%D8%A7%D9%86%D8%AA%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%85%D9%87%D9%85-%D9%81%D9%88%D8%AA%D8%A8%D8%A7%D9%84-%D8%A7%D8%B1%D9%88%D9%BE%D8%A7-940218',. 'md5': '411dbd94891381960cb9e13daa47a869',. 'info_dict': {. 'id': '95719',. 'ext': 'mp4',. 'title': '...... ... . ........ ... ...... ..... 94/02/18',. 'thumbnail': r're:^https?://.\.jpg$',. }. }, {. 'url': 'http://www.90tv.ir/video/95719/%D8%B4%D8%A7%DB%8C%D8%B9%D8%A7%D8%AA-%D9%86%D9%82%D9%84-%D9%88-%D8%A7%D9%86%D8%AA%D9%82%D8%A7%D9%84%D8%A7%D8%AA-%D9%85%D9%87%D9%85-%D9%81%D9%88%D8%AA%D8%A8%

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8TPIL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	12517
Entropy (8bit):	4.833619919801253
Encrypted:	false
SSDEEP:	384:8lgUPjnNMOHi0Ph2WbkxGlJL2+BPZLT8AHwtpEp:ATh2Wb8GlJ3wtpEp
MD5:	82677D99C64DB708D6161E348E03464F
SHA1:	4D60CC7DDD3639B375AF8DE1049F38FB55BAAA9E
SHA-256:	252DE590AF2D2BA0CF6AB1B6D3F9621DF5F756B8AD26A59169DA7CD2031D8CA8
SHA-512:	8CFCE4F5A7204126611B17F7FA5EC321E5F547CFDE857163F55F896E83E1EE4FFD1781B08E4C65E89B92C6D004BC442A8621340F436A15BAD9E4EBCFE3A15AF6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time.import hashlib.import json.import random..from .adobepass import AdobePassIE.from .youtube import YoutubeIE.from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,. parse_age_limit,. str_or_none,. try_get,.)...class ViceIE(AdobePassIE):. IE_NAME = 'vice'. _VALID_URL = r'https?://(?:(?:video\|vms)\.vice\|(?:www\.)?viceland)\.com/(?P<locale>[^/]+)/(?:video/[^/]+\|embed)/(?P<id>[\da-f]+)'. _TESTS = [{. 'url': 'https://video.vice.com/en_us/video/pet-cremator/58c69e38a55424f1227dc3f7',. 'info_dict': {. 'id': '5e647f0125e145c9aef2069412c0cbde',. 'ext': 'mp4',. 'title': '10 Questions You Always Wanted To Ask: Pet Cremator',. 'description': 'md5:fe856caacf61fe0e74fab15ce2b07ca5',. 'uploader': 'vice',. 'uploader_id': '57a2040

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8TVN8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3921
Entropy (8bit):	4.721578359197039
Encrypted:	false
SSDEEP:	96:VBlYaMlSjeX3vI/0jPGX3vIYJ9uDGFxGnLIMk8VuHkrVCmcSweBT+6N6ms0f:rl14TI8cIYJxaJCiwqT+6Nl
MD5:	337484CC328918F05FAABEC88927CEDE
SHA1:	E73BB1BA4CF827171EBEFAADF585493573D0DF64
SHA-256:	3FF9C5082756547AE7CD186D6576FFB1200908097A54C42DF7574F323B5FE6B0
SHA-512:	E96D47202D7051AB5DB958AF32D5CDF20F4C512AA5F64AB8636A40279512536D5D9A2DCC03251ACAE73E38EC62991255B5F784AF2ECB551B63FDB4099D0F0FFC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_strdate,.)...class LnkGoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lnkgo\.(?:alfa\.)?lt/visi-video/(?P<show>[^/]+)/ziurek-(?P<id>[A-Za-z0-9-]+)'. _TESTS = [{. 'url': 'http://lnkgo.alfa.lt/visi-video/yra-kaip-yra/ziurek-yra-kaip-yra-162',. 'info_dict': {. 'id': '46712',. 'ext': 'mp4',. 'title': 'Yra kaip yra',. 'upload_date': '20150107',. 'description': 'md5:d82a5e36b775b7048617f263a0e3475e',. 'age_limit': 7,. 'duration': 3019,. 'thumbnail': r're:^https?://.*\.jpg$'. },. 'params': {. 'skip_download': True, # HLS download. },. }, {. 'url': 'http://lnkgo.alfa.lt/visi-video/aktualai-pratesimas/ziurek-nerdas-taiso-kompiuteri-2',. 'info_dict': {. 'id': '47289',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8VTK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	4.517958789257556
Encrypted:	false
SSDEEP:	48:+uhWOXqYf/K1nqv+tfJoXjlhHp6Ch9JOAj+qkkPbOMIlBTt+SnmXNfW6NF:YOXq6/inqv8fJsRJpxTPbO3lBTtznIND
MD5:	93D1F657FA5ACEF73B71DE48C8A322C4
SHA1:	28F781967C320FA89D4E25D80DCD14059D37A0F3
SHA-256:	AB8B903CF3E9FCD477A2D935D6B141FE515EA30E4CA3DEDE3353C64570EE9BBC
SHA-512:	08ED258287CAD09142FCCD2D6967EC38160C1D610FB62E9B2F265AC6E699054764BACCCEB5BC965FB7E492F712ACC04EA87DC79819B67A1532DFE8D4C8BDD23F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. unescapeHTML,.)...class ATVAtIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?atv\.at/(?:[^/]+/){2}(?P<id>[dv]\d+)'. _TESTS = [{. 'url': 'http://atv.at/aktuell/di-210317-2005-uhr/v1698449/',. 'md5': 'c3b6b975fb3150fc628572939df205f2',. 'info_dict': {. 'id': '1698447',. 'ext': 'mp4',. 'title': 'DI, 21.03.17 \| 20:05 Uhr 1/1',. }. }, {. 'url': 'http://atv.at/aktuell/meinrad-knapp/d8416/',. 'only_matching': True,. }].. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id). video_data = self._parse_json(unescapeHTML(self._search_regex(. [r'flashPlayerOptions\s=\s(["\'])(?P<json>(?:(?!\1).)+)\1',. r'class="[^"]jsb_video/FlashPlayer[^"]"[^>]+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-8VUQN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1681
Entropy (8bit):	5.118757823023587
Encrypted:	false
SSDEEP:	48:+u/xGZfgcnRU5wPsqemFefkXj1aRBb0P4EBiQeSY:bx6rnG5wPsZmFeff3QVY
MD5:	95C884C6664EA35C492F287596494D60
SHA1:	0B7AAE1188E62722D1D8D03DD0380BC863AFAA60
SHA-256:	821AA54F205E365D5918139D04BD9DA89E942DAFAECEC2346D1F3AF9D2E05EFB
SHA-512:	5AE6AFF394C00F89CD6CC6CAD14D916362E4BC82543205C368764C96A3A39BB18A106FCB449CBB9CE0041F9BCF0EB77488B174CC357D3F7FC14E387507153A83
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class WeiqiTVIE(InfoExtractor):. IE_DESC = 'WQTV'. _VALID_URL = r'https?://(?:www\.)?weiqitv\.com/index/video_play\?videoId=(?P<id>[A-Za-z0-9]+)'.. _TESTS = [{. 'url': 'http://www.weiqitv.com/index/video_play?videoId=53c744f09874f0e76a8b46f3',. 'md5': '26450599afd64c513bc77030ad15db44',. 'info_dict': {. 'id': '53c744f09874f0e76a8b46f3',. 'ext': 'mp4',. 'title': '2013....',. },. }, {. 'url': 'http://www.weiqitv.com/index/video_play?videoId=567379a2d4c36cca518b4569',. 'info_dict': {. 'id': '567379a2d4c36cca518b4569',. 'ext': 'mp4',. 'title': '.....',. },. }, {. 'url': 'http://www.weiqitv.com/index/video_play?videoId=5430220a9874f088658b4567',. 'info_dict': {. 'id': '5430220a9874f088658b4567',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-90V98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3759
Entropy (8bit):	4.520469117058511
Encrypted:	false
SSDEEP:	96:JMeXXSDHIMq9eVOnqHyalFzdufOF38pBTi6NggtW5Bh:JMenSlq9eVOuyouOF38HTi6Ngh
MD5:	E292B90024D90DEA5E2390EB33E82854
SHA1:	6E50D7D199295362226703E581FA0FA1895C63B6
SHA-256:	3238AC0039087E77E46A13777EA2613761D6BC1F30BDD5C1F5250AEF4068483E
SHA-512:	2D5CEA4A8E850E2B68563F88955F6E1FAE116E85744594283D2773F2DD9A03614172754CC1E457688E33E37B7E74BC633A2AFBEF7CE347D3B7CDDB2B05B2C100
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. try_get,. urljoin,.)...class PhilharmonieDeParisIE(InfoExtractor):. IE_DESC = 'Philharmonie de Paris'. _VALID_URL = r'''(?x). https?://. (?:. live\.philharmoniedeparis\.fr/(?:[Cc]oncert/\|embed(?:app)?/\|misc/Playlist\.ashx\?id=)\|. pad\.philharmoniedeparis\.fr/doc/CIMU/. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://pad.philharmoniedeparis.fr/doc/CIMU/1086697/jazz-a-la-villette-knower',. 'md5': 'a0a4b195f544645073631cbec166a2c2',. 'info_dict': {. 'id': '1086697',. 'ext': 'mp4',. 'title': 'Jazz . la Villette : Knower',. },. }, {. 'url': 'http://live.philharmoniedeparis.fr/concert/1032066.html',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-91HS5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2248
Entropy (8bit):	4.625555436049224
Encrypted:	false
SSDEEP:	48:+uhWO008VGfumvdaxYbptfjXhkbY/wnvvapW8GRqGm48YdqBTraYjb86NQKyf:YOd/umvdmYbXfaTvv38GRdmpYdqBTrXu
MD5:	D15F91723013330A5D3B4C32DA816326
SHA1:	D68390D5FC140D306ECF009CDD28EFFE65D15348
SHA-256:	4153BA21795C190687C7B4C1F89FD236C2D91972F95DF0AB5C69FD0F97476234
SHA-512:	E6F6211FD066CB3147A761D1156ABD3BDA66E93445FFDD430A47A66F2D633BBACEDB2039F8AE7C31FE72C69E3564D93DB20A49D7CA3CE3AD4C66DA0E95DD969E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. js_to_json,.)...class RTPIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rtp\.pt/play/p(?P<program_id>[0-9]+)/(?P<id>[^/?#]+)/?'. _TESTS = [{. 'url': 'http://www.rtp.pt/play/p405/e174042/paixoes-cruzadas',. 'md5': 'e736ce0c665e459ddb818546220b4ef8',. 'info_dict': {. 'id': 'e174042',. 'ext': 'mp3',. 'title': 'Paix.es Cruzadas',. 'description': 'As paix.es musicais de Ant.nio Cartaxo e Ant.nio Macedo',. 'thumbnail': r're:^https?://.*\.jpg',. },. }, {. 'url': 'http://www.rtp.pt/play/p831/a-quimica-das-coisas',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). title = self._html_search_meta(. 'twitter:title', webp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-92JOJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3375
Entropy (8bit):	4.666488474966102
Encrypted:	false
SSDEEP:	96:/2KF2zpYtXEKKfAOhzU54W9DuisRBT06N9BN1t:+KkpFK4AaUqW9DuJfT06Nd
MD5:	1D99DEEE421AD3923CDC89018CD4936F
SHA1:	F0CF0E0D43F5BC85F0A28D7F7400789204BC3FAB
SHA-256:	D0C3EF734D59AF78C5A3F161A11C8D07CA0F774B2AB92822D8919B8632CE69D6
SHA-512:	EB21989F4CADDDE7C07818454BE1B4922EB2288767B243A50ED6EBFB630AD2892AD4413972108DD61362A680B75C1307093C3FF8F1BACB3CB33B8A473AE80638
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import time.import uuid..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,.)...class MGTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mgtv\.com/(v\|b)/(?:[^/]+/)(?P<id>\d+)\.html'. IE_DESC = '..TV'. _GEO_COUNTRIES = ['CN'].. _TESTS = [{. 'url': 'http://www.mgtv.com/v/1/290525/f/3116640.html',. 'info_dict': {. 'id': '3116640',. 'ext': 'mp4',. 'title': '.... ...',. 'description': '............',. 'duration': 7461,. 'thumbnail': r're:^https?://.\.jpg$',. },. }, {. 'url': 'http://www.mgtv.com/b/301817/3826653.html',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). try:. api_dat

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9328D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3101
Entropy (8bit):	4.672505823822513
Encrypted:	false
SSDEEP:	96:T8U7R6FuYj7kWFDAeqfJaNCxrZS1Vlf6BT6vIW54qBn6Ng:T718uiwQE7JaN2ZS1VlmT6vdxp6Ng
MD5:	47773DC4906A9D19151D6A8EFC94B2D7
SHA1:	5F15628A2E4A1E412D169D6EEF797E0243B74BFE
SHA-256:	E46C55F0B30E9B3B59477EFB38532EDBCC2C40FA0488E564FB6F13A301E1318C
SHA-512:	B4931CE92B4E393BE759B5224D89B7075917119B2D831A2EFBA67298B7273989F91EEDB7931E854644F788C44385D435603BA15BB8522740976C80BD035F8B20
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import os.path..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. url_basename,. remove_start,.)...class DemocracynowIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?democracynow\.org/(?P<id>[^\?]*)'. IE_NAME = 'democracynow'. _TESTS = [{. 'url': 'http://www.democracynow.org/shows/2015/7/3',. 'md5': '3757c182d3d84da68f5c8f506c18c196',. 'info_dict': {. 'id': '2015-0703-001',. 'ext': 'mp4',. 'title': 'Daily Show for July 03, 2015',. 'description': 'md5:80eb927244d6749900de6072c7cc2c86',. },. }, {. 'url': 'http://www.democracynow.org/2015/7/3/this_flag_comes_down_today_bree',. 'info_dict': {. 'id': '2015-0703-001',. 'ext': 'mp4',. 'title': '"This Flag Comes Down Today": Bree Newsome Scales SC Capitol Flagpole, Takes Down Confederate Flag',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-93NSI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.731823669537528
Encrypted:	false
SSDEEP:	48:+uA6BLvNf/E2TrvcEtfjXh5f6SmxujpwtWEwbEtsv:5RNM2TrvVf3CSOkitWPIav
MD5:	A98CAE68E1D95869F388639C68DE9A8B
SHA1:	3A3F5BB699B6A327F850D88A1437D97267D90A97
SHA-256:	F0B8EFE8B4F99FDF623B7A7E22B269DF36D7F2275276D342F2621E1935FB78E0
SHA-512:	06682DB1FBAB3D2ACA77BB052F7A9ECF13DD56A6F1D7E25CD495FA628F0B69F7B1850D6EDBFA27FC0F1AEF516996FD6CE985F2BF99D8EF3B116CEE0322882621
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. str_to_int,. unified_strdate,.)...class CloudyIE(InfoExtractor):. _IE_DESC = 'cloudy.ec'. _VALID_URL = r'https?://(?:www\.)?cloudy\.ec/(?:v/\|embed\.php\?.*?\bid=)(?P<id>[A-Za-z0-9]+)'. _TESTS = [{. 'url': 'https://www.cloudy.ec/v/af511e2527aac',. 'md5': '29832b05028ead1b58be86bf319397ca',. 'info_dict': {. 'id': 'af511e2527aac',. 'ext': 'mp4',. 'title': 'Funny Cats and Animals Compilation june 2013',. 'upload_date': '20130913',. 'view_count': int,. }. }, {. 'url': 'http://www.cloudy.ec/embed.php?autoplay=1&id=af511e2527aac',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(. 'https://www.cloudy.ec/embed.php', video_id, query={. 'id': video_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-94JRP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	23878
Entropy (8bit):	4.81265184363539
Encrypted:	false
SSDEEP:	384:Igxs33yIXVpZC8qfEhgQQXoMsXdHMAIxxluTAtTzoOySulfCsCTwtN3YoIJWWa1H:IfQBgz3YoIJtcvcvf5Q8gDlRWObTEeW4
MD5:	B4BD2E143D7669EAB494506221321B77
SHA1:	FF5AF174C440C94482FDB5AD3678CC8E7C38D2B6
SHA-256:	F89E216C7CCACE87108D0064A7D4811473C41062ED53E27299891DAECC7835F3
SHA-512:	634734539BB6E320CE4A9E4872449F8F1E63C169A04D40A118C194E7C911EDD4F41BC4646EB9A8FFB424C3BF7900CEBA8055FAFB588140767EB3BB492178DDCF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import json.import re..from .common import InfoExtractor, SearchInfoExtractor.from ..compat import (. compat_urllib_parse,. compat_urlparse,.).from ..utils import (. clean_html,. determine_ext,. ExtractorError,. extract_attributes,. int_or_none,. mimetype2ext,. smuggle_url,. unescapeHTML,.)..from .brightcove import (. BrightcoveLegacyIE,. BrightcoveNewIE,.).from .nbc import NBCSportsVPlayerIE...class YahooIE(InfoExtractor):. IE_DESC = 'Yahoo screen and movies'. _VALID_URL = r'(?P<host>https?://(?:(?P<country>[a-zA-Z]{2})\.)?[\da-zA-Z_-]+\.yahoo\.com)/(?:[^/]+/)*(?:(?P<display_id>.+)?-)?(?P<id>[0-9]+)(?:-[a-z]+)?(?:\.html)?'. _TESTS = [. {. 'url': 'http://screen.yahoo.com/julian-smith-travis-legg-watch-214727115.html',. 'info_dict': {. 'id': '2d25e626-2378-391f-ada0-ddaf1417e588',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9B57E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2094
Entropy (8bit):	4.888059172215429
Encrypted:	false
SSDEEP:	48:+u6SDWx1FsL1qryNjMadfFkZVSpoDEkXejXVXpeXCKga6Pt/8ci:RDiAL6yNjMaGIHZjVKx6Pt/8B
MD5:	AB4FBBBB34F07F4139D2D47A2F147D56
SHA1:	C280A28B9F165EE92961361CF6C6F4E529A1E9CF
SHA-256:	346BFBD05B20EE93C5F8A2B1E4AE257DA875B86467B6FD267CE0C8E55A715901
SHA-512:	46E80B6E71361FFD783199327F8D6766F569D6DA8DC7EE3874A10395523BA216018809BE2CCFB56661B8251ECCE50C46B715146A2AB2838A64C519DAF596E24C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. parse_duration,.)...class MojvideoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mojvideo\.com/video-(?P<display_id>[^/]+)/(?P<id>[a-f0-9]+)'. _TEST = {. 'url': 'http://www.mojvideo.com/video-v-avtu-pred-mano-rdecelaska-alfi-nipic/3d1ed4497707730b2906',. 'md5': 'f7fd662cc8ce2be107b0d4f2c0483ae7',. 'info_dict': {. 'id': '3d1ed4497707730b2906',. 'display_id': 'v-avtu-pred-mano-rdecelaska-alfi-nipic',. 'ext': 'mp4',. 'title': 'V avtu pred mano rde.elaska - Alfi Nipi.',. 'thumbnail': r're:^http://.*\.jpg$',. 'duration': 242,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). display_id = mobj.group('display_id').. # XML is malformed. playerap

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9GLCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	12124
Entropy (8bit):	4.766910002612116
Encrypted:	false
SSDEEP:	192:dX7uGVk2x2/tH4Sq1FkiiEEEv96EGrNKEQR2lEKEHkE7E9cBEUJYEIfzQgd591yJ:dX7u87xatlqsNC4zQgd53y4H0ivS4MR
MD5:	FEA701BA55F3B16FC81DCF0D7FB38884
SHA1:	77921A63E8DDB5EA4738A8232AA9E891178F01C7
SHA-256:	9289520A3449684EEB7D88C53404CCA226AE2DF0AACD33547CB28A3EB42EA842
SHA-512:	E1C515CE0A19A34043A995642EBE090F715ADF20BD510464F80406145A2296AD4248DA1566A906466CA121CF573F858CB0EFF7A97AA733EB84C600A4E041D786
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import hashlib..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. try_get,.)...class YandexMusicBaseIE(InfoExtractor):. @staticmethod. def _handle_error(response):. if isinstance(response, dict):. error = response.get('error'). if error:. raise ExtractorError(error, expected=True). if response.get('type') == 'captcha' or 'captcha' in response:. YandexMusicBaseIE._raise_captcha().. @staticmethod. def _raise_captcha():. raise ExtractorError(. 'YandexMusic has considered youtube-dl requests automated and '. 'asks you to solve a CAPTCHA. You can either wait for some '. 'time until unblocked and optionally use --sleep-interval '. 'in future or alternatively you can go to https://music.yandex.ru/ '.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9IAD6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2717
Entropy (8bit):	4.828686940847195
Encrypted:	false
SSDEEP:	48:+uK5eGLCMDqjtL3NZBie23X1tfjXjmBycninxUfV9PaplYpwF:G5pLC6qjtL3NXie2HTfbaUSfVxaLF
MD5:	8A68A9988B02290D2678E2DE195E15A9
SHA1:	DFCAA2DAB45F1E45FBD86084B037074906666D18
SHA-256:	2C3DD787DB24A70F721EC33C9B16ADE11B703DC10A67EE52131256BD840A7D63
SHA-512:	E21A8D2C3443BB93B3D597DA3A44E5A95DD28FE500B83E39FE32A32D4A22D1F6665A19A5187F3B6C805319ED93C3176576E2869D07BDAF4EA0F446010662E895
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. smuggle_url,. ExtractorError,.)...class SBSIE(InfoExtractor):. IE_DESC = 'sbs.com.au'. _VALID_URL = r'https?://(?:www\.)?sbs\.com\.au/(?:ondemand\|news)/video/(?:single/)?(?P<id>[0-9]+)'.. _TESTS = [{. # Original URL is handled by the generic IE which finds the iframe:. # http://www.sbs.com.au/thefeed/blog/2014/08/21/dingo-conservation. 'url': 'http://www.sbs.com.au/ondemand/video/single/320403011771/?source=drupal&vertical=thefeed',. 'md5': '3150cf278965eeabb5b4cea1c963fe0a',. 'info_dict': {. 'id': '320403011771',. 'ext': 'mp4',. 'title': 'Dingo Conservation (The Feed)',. 'description': 'md5:f250a9856fca50d22dec0b5b8015f8a5',. 'thumbnail': r're:http://.*\.jpg',. 'duration': 308,. 'timestamp': 1408613220,. 'upload_date': '20140821',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9JPKD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8443
Entropy (8bit):	4.544250951800426
Encrypted:	false
SSDEEP:	96:hYt8sL5dH4Lz3PVhRX89zEufiSJgulezoLzbjo/+qHGAJuy+bL1X26U9kBTa6EVq:fYSLh4BqJ6bjUTHxkyslU9sTbkYzV6Ng
MD5:	22DAA56F1F3E36DF1C6F69004A704968
SHA1:	FE576BDE907CFB2751307BC6E69DF101D1BAC4B9
SHA-256:	A130A4398256C3F41253D74A7A316C95E93A47187F1584BDCEDF00C656EA5E80
SHA-512:	4E4EF55699E7A9600493165EE18A9DE5DC3C8749B85A69032A5B17F7B4C1074BC853CECC78AF31CEA78D07E13CCA5C77903D778B5554A05C0995F8459B9B6DF4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time.import hashlib..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. clean_html,. ExtractorError,. int_or_none,. float_or_none,. parse_iso8601,. sanitized_Request,. urlencode_postdata,.)...class NocoIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.)?noco\.tv/emission/\|player\.noco\.tv/\?idvideo=)(?P<id>\d+)'. _LOGIN_URL = 'https://noco.tv/do.php'. _API_URL_TEMPLATE = 'https://api.noco.tv/1.1/%s?ts=%s&tk=%s'. _SUB_LANG_TEMPLATE = '&sub_lang=%s'. _NETRC_MACHINE = 'noco'.. _TESTS = [. {. 'url': 'http://noco.tv/emission/11538/nolife/ami-ami-idol-hello-france/',. 'md5': '0a993f0058ddbcd902630b2047ef710e',. 'info_dict': {. 'id': '11538',. 'ext': 'mp4',. 'title': 'Ami Ami Idol - Hello! France',. 'description

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9M6FF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5533
Entropy (8bit):	5.006957012941449
Encrypted:	false
SSDEEP:	96:I5W5ahwd0Zq1/tUd50p7r9jfOk4ijGAxoX+jSrb3dm4t7hgLneqO4fafmxRfe05:I05aSd0ZC1W50R5jmk92Oec4xOLnOuaA
MD5:	D71919E57F62697E37431A69AD0CA251
SHA1:	FE78D605C4DE8145F9B58C316BC73E0499F0AD87
SHA-256:	AAA11AFE613D2A2F0D016D18AC395384EE778D7774A6D9D0C0A00B577B40B262
SHA-512:	983876739BB1B61F85D7138F532AC51F35930ABA6A4213E1752BABC75C93F7CE46833436F7813DCFE2FFEA888869E22DC85F7ADD4BCE415679AA9E52EB00835A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .mtv import MTVServicesInfoExtractor.from .common import InfoExtractor...class ComedyCentralIE(MTVServicesInfoExtractor):. _VALID_URL = r'''(?x)https?://(?:www\.)?cc\.com/. (video-clips\|episodes\|cc-studios\|video-collections\|shows(?=/[^/]+/(?!full-episodes))). /(?P<title>.)'''. _FEED_URL = 'http://comedycentral.com/feeds/mrss/'.. _TESTS = [{. 'url': 'http://www.cc.com/video-clips/kllhuv/stand-up-greg-fitzsimmons--uncensored---too-good-of-a-mother',. 'md5': 'c4f48e9eda1b16dd10add0744344b6d8',. 'info_dict': {. 'id': 'cef0cbb3-e776-4bc9-b62e-8016deccb354',. 'ext': 'mp4',. 'title': 'CC:Stand-Up\|August 18, 2013\|1\|0101\|Uncensored - Too Good of a Mother',. 'description': 'After a certain point, breastfeeding becomes c*kblocking.',. 'timestamp': 1376798400,. 'upload_date': '20130818',. },. }, {. 'url': 'http://www.cc.com/s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9O8UG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3447
Entropy (8bit):	4.707070027962389
Encrypted:	false
SSDEEP:	96:M9LxvXjgfPvZ9odf0izc7UdLworDNCoBTBRWN6NJ0gNqh10:QN6vZ9o90igIdLworBCoTBRw6NI30
MD5:	3893ECF4169935EC2D5D5839A8A5C136
SHA1:	4B2FD17BC935CCE9AD290581F6DEDA4CC47EC2F8
SHA-256:	9C05B2678AE77F60DAE0E67AF10C7EA2F673C982F54A7E5E3DE5DA79938F381F
SHA-512:	E8049319EE9BD8C80818AF6796371F53AB7CE7C705B9501F8C65BB72204EB5C0EC3D2879110A0109FB56B230233B34B09FCC348F2C22AD18E2A23850B548A6DA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_str,.).from ..utils import (. int_or_none,. try_get,. unified_timestamp,.)...class PornFlipIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pornflip\.com/(?:v\|embed)/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.pornflip.com/v/wz7DfNhMmep',. 'md5': '98c46639849145ae1fd77af532a9278c',. 'info_dict': {. 'id': 'wz7DfNhMmep',. 'ext': 'mp4',. 'title': '2 Amateurs swallow make his dream cumshots true',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 112,. 'timestamp': 1481655502,. 'upload_date': '20161213',. 'uploader_id': '106786',. 'uploader': 'figifoto',. 'view_count': int,. 'age_limit': 18,. }. }, {. 'url': 'https://www.pornflip.com/embed/wz7DfNhMmep',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9OHU3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3465
Entropy (8bit):	4.738691250671751
Encrypted:	false
SSDEEP:	96:HQ+ksgKXFmt2c6Js59Ie6l7OFALBX/GlNxzcXgyLrLBTk71L38Ns6Ng:ngiUD6Js51Q7OFALBX/GlNxZyv9TkhJL
MD5:	51F05C8BE75E0A1EEEC09C1CF914D30D
SHA1:	C29D734EAFF84156BBA70CF12D1C041A9AB6D012
SHA-256:	D74F8DABECDF3BE43111DDBB530F37F9114BC6B34C08B90F8AE99538FE124C8B
SHA-512:	39C288EE3696736E52D255C9E84CC8D53556C90E3F449E31D15493AC5188973D85892D6F19CD27BAD42C5FB9217580FF6B51591A4429065A1768552702DF94A2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. find_xpath_attr,. int_or_none,. js_to_json,. unescapeHTML,. determine_ext,.)...class HowStuffWorksIE(InfoExtractor):. _VALID_URL = r'https?://[\da-z-]+\.(?:howstuffworks\|stuff(?:(?:youshould\|theydontwantyouto)know\|toblowyourmind\|momnevertoldyou)\|(?:brain\|car)stuffshow\|fwthinking\|geniusstuff)\.com/(?:[^/]+/)*(?:\d+-)?(?P<id>.+?)-video\.htm'. _TESTS = [. {. 'url': 'http://www.stufftoblowyourmind.com/videos/optical-illusions-video.htm',. 'md5': '76646a5acc0c92bf7cd66751ca5db94d',. 'info_dict': {. 'id': '855410',. 'ext': 'mp4',. 'title': 'Your Trickster Brain: Optical Illusions -- Science on the Web',. 'description': 'md5:e374ff9561f6833ad076a8cc0a5ab2fb',. },. },. {. 'url': 'http://shows.howstuffworks.com/more-shows/why-does-balloon-stick

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9P5OH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6275
Entropy (8bit):	4.88080561685403
Encrypted:	false
SSDEEP:	192:zQnCf3Fr2ErRvRIXd18b1XhAvZKphPNtCRjY7Ft6T06Ng:zQUVJrR5IXd1Ax4AphPqRjY7Ft6T06Ng
MD5:	9A35B6BC808BDBFBF09D17EA9D58023F
SHA1:	008FF5369367BC01C021A66005D21C001959F586
SHA-256:	42C60BEC38AC678602216C53322B7347F5AFA7A159525F3786E360AD78F2741B
SHA-512:	C293866196F7402CC656DCA3617610F7EA65D396B938D93B3EBBF71D363BB2E879B8DCD696CAC31AA87520CD39E27DC7B4E4D907BF36CEF2A681AED81A407F51
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.from .common import InfoExtractor.from ..utils import (. ExtractorError,. unsmuggle_url,.).from ..compat import (. compat_parse_qs,. compat_urlparse,.)...class SenateISVPIE(InfoExtractor):. _COMM_MAP = [. ['ag', '76440', 'http://ag-f.akamaihd.net'],. ['aging', '76442', 'http://aging-f.akamaihd.net'],. ['approps', '76441', 'http://approps-f.akamaihd.net'],. ['armed', '76445', 'http://armed-f.akamaihd.net'],. ['banking', '76446', 'http://banking-f.akamaihd.net'],. ['budget', '76447', 'http://budget-f.akamaihd.net'],. ['cecc', '76486', 'http://srs-f.akamaihd.net'],. ['commerce', '80177', 'http://commerce1-f.akamaihd.net'],. ['csce', '75229', 'http://srs-f.akamaihd.net'],. ['dpc', '76590', 'http://dpc-f.akamaihd.net'],. ['energy', '76448', 'http://energy-f.akamaihd.net'],. ['epw', '76478', 'http://epw-f.akamaihd.net'],.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9SAEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	4.948992507591847
Encrypted:	false
SSDEEP:	24:zi8lFvkAGXUV8V/4bLjddlXIHTnD1f/JoXjlhHw5N4+IC:+uJ2MssHd+rD1XJoXjlhHwHMC
MD5:	D1144FC6263F41B858D7DBAB6D44FC79
SHA1:	0E07D3AA1E71F84F1A2D85740195A776EBE29E07
SHA-256:	2770E2B3AF0094996CDE41CFA756345C51B57A72D3ED236147345FF2A59BF4C9
SHA-512:	63AFF4DE11DFC8EF4F18029F658D47CD45BBC94A684411B93676398B61D7DFD12A0E52446B62FC45B001ACCE319F8F058EA7CDE2C95F4FF871D6B23B0DA15B3B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class NRLTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nrl\.com/tv(/[^/]+)*/(?P<id>[^/?&#]+)'. _TEST = {. 'url': 'https://www.nrl.com/tv/news/match-highlights-titans-v-knights-862805/',. 'info_dict': {. 'id': 'YyNnFuaDE6kPJqlDhG4CGQ_w89mKTau4',. 'ext': 'mp4',. 'title': 'Match Highlights: Titans v Knights',. },. 'params': {. # m3u8 download. 'skip_download': True,. 'format': 'bestvideo',. },. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id). q_data = self._parse_json(self._search_regex(. r"(?s)q-data='({.+?})'", webpage, 'player data'), display_id). ooyala_id = q_data['videoId']. return self.url_result(. 'ooyala:' + ooyala_id, 'Ooyala', ooyala_id, q_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9SG9O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4486
Entropy (8bit):	4.144908415401477
Encrypted:	false
SSDEEP:	96:yOOjlIl0Gx2a1Suxx7rDik17uyRN4vPZpBTRlkNl5bIazdWe8N6No:vadaRyM45HTgIAqN6No
MD5:	0E6863D32D7CDE06C739D862218730F1
SHA1:	31D7319C909587DB03F2AB6944460421BD1085AC
SHA-256:	C12A588F14A1C562370350D3F07821735347625192D0767AA3B27131B9577B6A
SHA-512:	69E73F14F64995EE3C27F19785580C3B090723B97BFFB93ABB0BDFC19952884F5E7A9B3FF2DD1476C50358E27C255E2C75C2434E9AEFBDC9D7109C39EA6ED019
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. int_or_none,. qualities,. urlencode_postdata,. xpath_text,.)...class NFBIE(InfoExtractor):. IE_NAME = 'nfb'. IE_DESC = 'National Film Board of Canada'. _VALID_URL = r'https?://(?:www\.)?(?:nfb\|onf)\.ca/film/(?P<id>[\da-z_-]+)'.. _TEST = {. 'url': 'https://www.nfb.ca/film/qallunaat_why_white_people_are_funny',. 'info_dict': {. 'id': 'qallunaat_why_white_people_are_funny',. 'ext': 'flv',. 'title': 'Qallunaat! Why White People Are Funny ',. 'description': 'md5:6b8e32dde3abf91e58857b174916620c',. 'duration': 3128,. 'creator': 'Mark Sandiford',. 'uploader': 'Mark Sandiford',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-9VFME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6395
Entropy (8bit):	4.270440106129039
Encrypted:	false
SSDEEP:	192:O6THomppVOVqHzKrAWQ6Hkvj7MYTrOFdiFSAoFThZ6JmNTwi6Ng:pTHompOVqHWrAWMj7MY3OFdiFSAoFThx
MD5:	5504AC143948235C19B43BFAAAA6F95B
SHA1:	0E5F6BF83B04209886172D5DB060A7CD65803D21
SHA-256:	C43E13E0AC2E984CFCCEC2703753769576EB28829E8AB6034C27CF51D772ECD5
SHA-512:	A4C30E1C7F530A4BC92E50F547C6B72155C0461C9B23BD7D0F19DE1093782110E0A863B6CCF5D3F9E130034D764EE0633CF69730F1D460C88ACBEFF47D73895F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urllib_parse_urlparse.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. xpath_attr,. xpath_text,.)...class RuutuIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:ruutu\|supla)\.fi/(?:video\|supla)/(?P<id>\d+)'. _TESTS = [. {. 'url': 'http://www.ruutu.fi/video/2058907',. 'md5': 'ab2093f39be1ca8581963451b3c0234f',. 'info_dict': {. 'id': '2058907',. 'ext': 'mp4',. 'title': 'Oletko aina halunnut tiet.. mit. tapahtuu vain hetki ennen l.hetyst.? - Nyt se selvisi!',. 'description': 'md5:cfc6ccf0e57a814360df464a91ff67d6',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 114,. 'age_limit': 0,. },. },. {. 'url': 'http://www.ruutu.fi/video/2057306'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-A2QL0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6168
Entropy (8bit):	4.691217478357625
Encrypted:	false
SSDEEP:	192:q7BybXGJefFsh3GW3ZySp9T0TSJ6Nxf4gxO:q7BcXLstZXp9T0TSJ6NxwgxO
MD5:	981250CEDF595B4B043E700A92DD9799
SHA1:	8981CF065C3AD7F3620F259D89945A44A46FB479
SHA-256:	37510F1CE3124BB7228D031B53A7FF33052163BA99F08A0B99AE5615C99B6629
SHA-512:	C7A8195327A29E61B5B1A3CFC47156BF4C21A51B7B4850BCA2F04D868268D8F04A0AA167E337EC549D471A2CB2052E092F4ED0E59F31E6B576DBFCB05BAC2B34
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. js_to_json,. orderedSet,. parse_duration,. sanitized_Request,. str_to_int,.)...class XTubeIE(InfoExtractor):. _VALID_URL = r'''(?x). (?:. xtube:\|. https?://(?:www\.)?xtube\.com/(?:watch\.php\?.*\bv=\|video-watch/(?:embedded/)?(?P<display_id>[^/]+)-). ). (?P<id>[^/?&#]+). '''.. _TESTS = [{. # old URL schema. 'url': 'http://www.xtube.com/watch.php?v=kVTUy_G222_',. 'md5': '092fbdd3cbe292c920ef6fc6a8a9cdab',. 'info_dict': {. 'id': 'kVTUy_G222_',. 'ext': 'mp4',. 'title': 'strange erotica',. 'description': 'contains:an ET kind of thing',. 'uploader': 'greenshowers',. 'duration': 450,. 'vie

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-A36R7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3298
Entropy (8bit):	4.4487309269773405
Encrypted:	false
SSDEEP:	96:5edaVvEXjH+Ah8cyd31avW2k8nvq+WBTzNH8rF6Ng:0dm4e31QdLyTSx6Ng
MD5:	522D8809CDAC8E6AB8CD647A09492DE9
SHA1:	32680057AE4CE7A74FA7DFED736147DA3EC9C6AC
SHA-256:	BE581FC9051E409E4CED5804D1E657E9D069A1AB8205A3671476B9ADC25D4371
SHA-512:	A73519B861EDB8D64707F4545951DB255E0218CF0B5C1642C645B7A1680B80D47B42295D8CD69FE180A95BEBBBC14412C30C436A172EE960D5B3EA9075E4C018
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. str_or_none,. url_or_none,.)...class ViqeoIE(InfoExtractor):. _VALID_URL = r'''(?x). (?:. viqeo:\|. https?://cdn\.viqeo\.tv/embed/\?.?\bvid=\|. https?://api\.viqeo\.tv/v\d+/data/startup?.?\bvideo(?:%5B%5D\|\[\])=. ). (?P<id>[\da-f]+). '''. _TESTS = [{. 'url': 'https://cdn.viqeo.tv/embed/?vid=cde96f09d25f39bee837',. 'md5': 'a169dd1a6426b350dca4296226f21e76',. 'info_dict': {. 'id': 'cde96f09d25f39bee837',. 'ext': 'mp4',. 'title': 'cde96f09d25f39bee837',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 76,. },. }, {. 'url': 'viqeo:cde96f09d25f39bee837',. 'only_matching'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-A7TB6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2599
Entropy (8bit):	4.724935270290998
Encrypted:	false
SSDEEP:	48:+uAzXwXLyOnbPPTPSVLchdfFkouBsLxlKioFtBrNlaBet/wCU/AQ8cFP9q:MzXwlbnTKVLydKbBrNlaBet/wCU/J8+U
MD5:	413A04E2A380EDD21E59B4D830464B30
SHA1:	C611F7EA9A19EC44D862ECABFEB9E591DAFA3376
SHA-256:	4D87C551C1D12877511FC4AEF319569F2009E04B313024DA15788BA503543D78
SHA-512:	FB372F1536CE5FAB5DA969668E6DC654C535A98FD208B26F11D55996EBC22726CEEF4669ADA76D836C6700594490DD42831235438014212DA929F22542BF5F74
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,.)...class PlayFMIE(InfoExtractor):. IE_NAME = 'play.fm'. _VALID_URL = r'https?://(?:www\.)?play\.fm/(?P<slug>(?:[^/]+/)+(?P<id>[^/]+))/?(?:$\|[?#])'.. _TEST = {. 'url': 'https://www.play.fm/dan-drastic/sven-tasnadi-leipzig-electronic-music-batofar-paris-fr-2014-07-12',. 'md5': 'c505f8307825a245d0c7ad1850001f22',. 'info_dict': {. 'id': '71276',. 'ext': 'mp3',. 'title': 'Sven Tasnadi - LEIPZIG ELECTRONIC MUSIC @ Batofar (Paris,FR) - 2014-07-12',. 'description': '',. 'duration': 5627,. 'timestamp': 1406033781,. 'upload_date': '20140722',. 'uploader': 'Dan Drastic',. 'uploader_id': '71170',. 'view_count': int,. 'comment_count': int,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-A8DVE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.8886091381657115
Encrypted:	false
SSDEEP:	24:1R8lQuGHQfUlDGP/X/dlFvO5hUGDHNqHPU18tfeIX0L924Ei:PuQuIQfUlDGnX/pvS1rNqvU18tfjX0Lb
MD5:	4F630CABFBA987A36B85C7F5B04D6203
SHA1:	1C9C10B794BC5A98CC392EC9BFA8693A0944896D
SHA-256:	29ED49317D38F60C8314F14C138D72556179F91419DB71E4DDDCEEB7034EC25C
SHA-512:	DB03C2E93E3692B90DEB4E91B944A72C9854D4B35B452810C67DF008F92EB44F431F56FC793B7E61F982B6228EA2E91E34F3259FE2F544D8D5EE6BFBE61D7C5B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .nuevo import NuevoBaseIE...class NonkTubeIE(NuevoBaseIE):. _VALID_URL = r'https?://(?:www\.)?nonktube\.com/(?:(?:video\|embed)/\|media/nuevo/embed\.php\?.*?\bid=)(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.nonktube.com/video/118636/sensual-wife-uncensored-fucked-in-hairy-pussy-and-facialized',. 'info_dict': {. 'id': '118636',. 'ext': 'mp4',. 'title': 'Sensual Wife Uncensored Fucked In Hairy Pussy And Facialized',. 'age_limit': 18,. 'duration': 1150.98,. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'https://www.nonktube.com/embed/118636',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. info = self._extract_nuevo(. 'https://www.nonktube.com/media/nuevo/econfig.php?key=%s'. % video_id, video_id).. info['age_limit']

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-A8MKN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (326)
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	4.852301494039982
Encrypted:	false
SSDEEP:	96:QfVQtSOKZXUYj2KfqKMBHMusBymZNx5CpzIO11QBTCY8V6Ng:Q4YVqKIMuyym55WMO11gT8V6Ng
MD5:	8F36096859CC696EA1B353EF0D849EF7
SHA1:	28280EBB9223C17C44E3040A0D1022F6E7CC9BA5
SHA-256:	76DFB7C07728A6C17739D224774E0A966A9363895856207FB0A509EF620BD703
SHA-512:	277F0C17F0D27DAF0C7C82D5208341B1BFCA6E55F9B3B125A8ABC096A4231DC667E5D2AE71A412AD914A1E64988412B0DE8E82A19EFB089CE711AFA7A5423407
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. js_to_json,. parse_duration,.)...class NTVDeIE(InfoExtractor):. IE_NAME = 'n-tv.de'. _VALID_URL = r'https?://(?:www\.)?n-tv\.de/mediathek/videos/[^/?#]+/[^/?#]+-article(?P<id>.+)\.html'.. _TESTS = [{. 'url': 'http://www.n-tv.de/mediathek/videos/panorama/Schnee-und-Glaette-fuehren-zu-zahlreichen-Unfaellen-und-Staus-article14438086.html',. 'md5': '6ef2514d4b1e8e03ca24b49e2f167153',. 'info_dict': {. 'id': '14438086',. 'ext': 'mp4',. 'thumbnail': r're:^https?://.*\.jpg$',. 'title': 'Schnee und Gl.tte f.hren zu zahlreichen Unf.llen und Staus',. 'alt_title': 'Winterchaos auf deutschen Stra.en',. 'description': 'Schnee und Gl.tte sorgen deutschlandweit f.r einen chaotischen Start in die Woche: Auf den Stra.en

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-A95PD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2764
Entropy (8bit):	4.450690127064308
Encrypted:	false
SSDEEP:	48:PuAJiKcUfQdRd9ngJq4L4JW4fdfFjXvB8cHEjPDrDafV2u3xN6kbVQBHzlOw7WV+:LJiKZQdRd9nGxL4Y4fzEjPPOfV2u3xNU
MD5:	6EC9C723C05CAF8C56318C445E77FEB8
SHA1:	7DC083200995373E6EEB7F423609D9EBC764A9B2
SHA-256:	DB6DBFF24BB3524484F722971651416A4EA4C3882917D9F7D57E229B25634B42
SHA-512:	AF6099FFC53D057BCA53CFB2501DA02AAECC105B295B4F054BAAC0B4D3BCC88F47F63E2117AAB3287B964F37CCDB8B8DA7529FCFD40DA330BF198177EB0A7522
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import int_or_none...class PyvideoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pyvideo\.org/(?P<category>[^/]+)/(?P<id>[^/?#&.]+)'.. _TESTS = [{. 'url': 'http://pyvideo.org/pycon-us-2013/become-a-logging-expert-in-30-minutes.html',. 'info_dict': {. 'id': 'become-a-logging-expert-in-30-minutes',. },. 'playlist_count': 2,. }, {. 'url': 'http://pyvideo.org/pygotham-2012/gloriajw-spotifywitherikbernhardsson182m4v.html',. 'md5': '5fe1c7e0a8aa5570330784c847ff6d12',. 'info_dict': {. 'id': '2542',. 'ext': 'm4v',. 'title': 'Gloriajw-SpotifyWithErikBernhardsson182.m4v',. },. }].. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). category = mobj.group('category'). video_id = mobj.group('id').. entri

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AAMCH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1820
Entropy (8bit):	4.830565523135814
Encrypted:	false
SSDEEP:	48:PugczfRLSKmXjZN2VtfjXhkzXGVa3YrkreVvrKCPt/8cs:OblSKmXjZozfaaVQLCKCPt/8t
MD5:	CBD93E56BC627F87FEF53459EDD5DCAB
SHA1:	4A01948AC0CCF696A7684FFA9A0AE214BD16281C
SHA-256:	63AB470E67652C782AE5776FF10B8992FEC70DAB60F43F132D420CE486AE8788
SHA-512:	6AD6F08577028644218E73D26E3A66285E3896DD33BEE15F7EF58E35C94597FE3903D79848BDC7327D6FF05403EA2535E47E2461471302164A8FFAA3D8BB07A5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_duration,. urljoin,.)...class YourPornIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:yourporn\.sexy\|sxyprn\.com)/post/(?P<id>[^/?#&.]+)'. _TESTS = [{. 'url': 'https://yourporn.sexy/post/57ffcb2e1179b.html',. 'md5': '6f8682b6464033d87acaa7a8ff0c092e',. 'info_dict': {. 'id': '57ffcb2e1179b',. 'ext': 'mp4',. 'title': 'md5:c9f43630bd968267672651ba905a7d35',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 165,. 'age_limit': 18,. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'https://sxyprn.com/post/57ffcb2e1179b.html',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. video_url = urljoin(url, self.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ACK8N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9916
Entropy (8bit):	4.700465523303083
Encrypted:	false
SSDEEP:	192:boxKHNEujtT26NfeJfIVdttA8SdEDM79gahznIxrc9VvTie9cG4GJDdvM6JsOWO:bCKHNEitT26NmNIVdtK8AEDS9g6znIOr
MD5:	BA132B33C78F8FBE7B2233E50667E27D
SHA1:	63369CDAF7EFE5D005B62BD7EC3B7D4267E16BD0
SHA-256:	A5D3DB6198ABC07ACA318EC1B90B95903244AE42A7B631D16239661D1E10624B
SHA-512:	86D5453078A3F410FEAD2A8631123E9F680804F424631C766D9E5955F4ACD7689E82E3CF32A6AF5264887B318EB2A55C60080563BC11E0E738ED3951D6793D9F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .theplatform import ThePlatformIE.from ..utils import (. extract_attributes,. ExtractorError,. int_or_none,. smuggle_url,. update_url_query,.).from ..compat import (. compat_urlparse,.)...class AENetworksBaseIE(ThePlatformIE):. _THEPLATFORM_KEY = 'crazyjava'. _THEPLATFORM_SECRET = 's3cr3t'.. def _extract_aen_smil(self, smil_url, video_id, auth=None):. query = {'mbr': 'true'}. if auth:. query['auth'] = auth. TP_SMIL_QUERY = [{. 'assetTypes': 'high_video_ak',. 'switch': 'hls_high_ak'. }, {. 'assetTypes': 'high_video_s3'. }, {. 'assetTypes': 'high_video_s3',. 'switch': 'hls_ingest_fastly'. }]. formats = []. subtitles = {}. last_e = None. for q in TP_SMIL_QUERY:. q.update(query). m_url = update_url_query(smil_url, q). m_url =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AELNG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5209
Entropy (8bit):	4.745353254708157
Encrypted:	false
SSDEEP:	96:jOZigkzyGvMR+aeR1H57ACujPtSdK15j/6F6NMdspIWO0ZRegjsrTcfIxi:MigAdg+ae757ACubYdK15jm6NMWQa
MD5:	7FBDAC73EE209BE20E36B2931FB947F0
SHA1:	4EBD435985C88435BE771FCBE887CDDB2ECC0F13
SHA-256:	DFE00FB6670A034930D96BD13AC0849E5F651C2AD58AFCDD922E84E61E0BC904
SHA-512:	B4648EED7AD4E31A224D4BC70F98A07EA7C1DB60F3FABDD5818EBCC7604C0D919A9238F59CAA823C874041E8684A248CD37F6B35A0CDB071B159E35AD05850B4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import base64.import json.import random.import re..from .common import InfoExtractor.from ..aes import (. aes_cbc_decrypt,. aes_cbc_encrypt,.).from ..compat import compat_b64decode.from ..utils import (. bytes_to_intlist,. bytes_to_long,. extract_attributes,. ExtractorError,. intlist_to_bytes,. js_to_json,. int_or_none,. long_to_bytes,. pkcs1pad,.)...class DaisukiMottoIE(InfoExtractor):. _VALID_URL = r'https?://motto\.daisuki\.net/framewatch/embed/[^/]+/(?P<id>[0-9a-zA-Z]{3})'.. _TEST = {. 'url': 'http://motto.daisuki.net/framewatch/embed/embedDRAGONBALLSUPERUniverseSurvivalsaga/V2e/760/428',. 'info_dict': {. 'id': 'V2e',. 'ext': 'mp4',. 'title': '#117 SHOWDOWN OF LOVE! ANDROIDS VS UNIVERSE 2!!',. 'subtitles': {. 'mul': [{. 'ext': 'ttml',. }],. },. },. 'params': {. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AGO90.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3025
Entropy (8bit):	4.752854182011624
Encrypted:	false
SSDEEP:	48:PuXNnNyUBnsaafFIUqB1bOt7ZKEREErqGy9rBTJ26NQrb8r1UrXrmR8HJSXjdB1M:QnNyUZsagebOt7BiErdy5BT06NQX8JU1
MD5:	A2F2F369AB9A63FBA6DBA64BCE17D027
SHA1:	252E91C8FF5E93807284A6699B449CD9F303D54B
SHA-256:	603A5E7058E84B2FB5F3388812E831B25C37734B766A159F8E1BD6E77A30CD9B
SHA-512:	C83B1CBF31516155DE0A09142AC3687F11CBD986FB3FB688529504A526223F262CE64A0348940BB04800B8C0EC593C60D9A3102323ECAB8540DCD1E29F30E071
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import int_or_none...class DLiveVODIE(InfoExtractor):. IE_NAME = 'dlive:vod'. _VALID_URL = r'https?://(?:www\.)?dlive\.tv/p/(?P<uploader_id>.+?)\+(?P<id>[a-zA-Z0-9]+)'. _TEST = {. 'url': 'https://dlive.tv/p/pdp+3mTzOl4WR',. 'info_dict': {. 'id': '3mTzOl4WR',. 'ext': 'mp4',. 'title': 'Minecraft with james charles epic',. 'upload_date': '20190701',. 'timestamp': 1562011015,. 'uploader_id': 'pdp',. }. }.. def _real_extract(self, url):. uploader_id, vod_id = re.match(self._VALID_URL, url).groups(). broadcast = self._download_json(. 'https://graphigo.prd.dlive.tv/', vod_id,. data=json.dumps({'query': '''query {. pastBroadcast(permlink:"%s+%s") {. content. createdAt. length. playbackUrl. title. thumbnailUrl. viewCount. }.}''

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AHC7T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	41407
Entropy (8bit):	4.388469200381338
Encrypted:	false
SSDEEP:	384:f6nN2nGx8fNhcDZ6hHae6De+FNcLKBcLuDnykAFPvqoD11BXLswPURj:SNIGxWNhcDcHae0ZcLuYFXq6BXLsw8Rj
MD5:	FCA5A653DCF1BDE0273007615E655B8B
SHA1:	78577951DF507F01F35B5460E69134D23CA97ECF
SHA-256:	3E103B7D03ACB1F0AAC3D2B23A9CEA02663AFF37D9086932C188ED31DAFD451A
SHA-512:	9682290F5A8800F9E67731C1952FACB54F9EC61AD0BC756E178E1D242CF2128F71B120C3FFF2DD82233C58F84BAB990F29E7476DDCFF755957422EE5B04C4726
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time.import xml.etree.ElementTree as etree..from .common import InfoExtractor.from ..compat import (. compat_kwargs,. compat_urlparse,.).from ..utils import (. unescapeHTML,. urlencode_postdata,. unified_timestamp,. ExtractorError,. NO_DEFAULT,.)...MSO_INFO = {. 'DTV': {. 'name': 'DIRECTV',. 'username_field': 'username',. 'password_field': 'password',. },. 'ATT': {. 'name': 'AT&T U-verse',. 'username_field': 'userid',. 'password_field': 'password',. },. 'ATTOTT': {. 'name': 'DIRECTV NOW',. 'username_field': 'email',. 'password_field': 'loginpassword',. },. 'Rogers': {. 'name': 'Rogers',. 'username_field': 'UserName',. 'password_field': 'UserPassword',. },. 'Comcast_SSO': {. 'name': 'Comcast XFINITY',. 'username_field': 'user',. 'password_field': 'passwd',. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ANEHL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	59092
Entropy (8bit):	4.5078237940756924
Encrypted:	false
SSDEEP:	1536:PKMhm7DSoBOtdwsiiEkiKiviAicieiMiBiQTwV8vNrs2FXliv2iBiFTbh8tiBTX0:axqfrVbEZsY1ENftgmYAOjvGM
MD5:	A1301E73E0AAB69AB159811FB358441E
SHA1:	67B6ED9DF0F723838A80D69753CD0EEF0436D37A
SHA-256:	A6C015175F5793AAF2814E4E5DDD650A3FA8FBD0E36769A4B2903D212ED5371C
SHA-512:	44ADAD6360D264D536EEF4B065AB11537B572882EAFC32048F3DB3B31841985834205CB4FC0953323FD2DEBA15071217D1D03A10A0CEC2D1E11864C9A0F83CC1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..utils import (. clean_html,. dict_get,. ExtractorError,. float_or_none,. get_element_by_class,. int_or_none,. js_to_json,. parse_duration,. parse_iso8601,. try_get,. unescapeHTML,. url_or_none,. urlencode_postdata,. urljoin,.).from ..compat import (. compat_etree_Element,. compat_HTTPError,. compat_urlparse,.)...class BBCCoUkIE(InfoExtractor):. IE_NAME = 'bbc.co.uk'. IE_DESC = 'BBC iPlayer'. _ID_REGEX = r'(?:[pbm][\da-z]{7}\|w[\da-z]{7,14})'. _VALID_URL = r'''(?x). https?://. (?:www\.)?bbc\.co\.uk/. (?:. programmes/(?!articles/)\|. iplayer(?:/[^/]+)?/(?:episode/\|playlist/)\|. music/(?:clips\|audiovideo/popular)[/#]\|. radio/player/\|.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AP9NU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1497
Entropy (8bit):	4.897553376669123
Encrypted:	false
SSDEEP:	24:zi8lFvli3ZGuC9fw0sNiP/2dln8OAeHbcmwOvqw0tfeIXjlgtsQieGkBs+aPrPkh:+usZ1C9fein278OAe7TyRtfjXjlksQDb
MD5:	446A3D7CB74E09767658625C903FEBE9
SHA1:	3F3255ECB0855A31819675BCE4A38BC352FC28FD
SHA-256:	3DEE481CDB5AEF386EC12068E8ABE087B1C5CF2F73D14EBCC7D63FA59104EDF7
SHA-512:	3880B8D32C3966787579E31B87BD307453D5D9CBDC8E8C78C4ABBB7436750480F401C741B6E0114C23A9C162194456003F6D2C8F37B8F5D88C544AEAD01280F5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. NO_DEFAULT,. remove_start.)...class OdaTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?odatv\.com/(?:mob\|vid)_video\.php\?.*\bid=(?P<id>[^&]+)'. _TESTS = [{. 'url': 'http://odatv.com/vid_video.php?id=8E388',. 'md5': 'dc61d052f205c9bf2da3545691485154',. 'info_dict': {. 'id': '8E388',. 'ext': 'mp4',. 'title': 'Art.k Davuto.lu ile devam edemeyiz'. }. }, {. # mobile URL. 'url': 'http://odatv.com/mob_video.php?id=8E388',. 'only_matching': True,. }, {. # no video. 'url': 'http://odatv.com/mob_video.php?id=8E900',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. no_video = 'NO VIDEO!' in webpage.. video_url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AQQ6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5550
Entropy (8bit):	4.713075197055495
Encrypted:	false
SSDEEP:	96:3zx/5nuqXzJbv/QHlXX6IjG/e/gP2X49DqfatEYTRMGBLPwjDTp5eTNUKnRPHHBG:txuSlvOaIMe09WatEkM6Lw22oPBTi6NE
MD5:	82633B383A4A4415456E0FB21359E0A1
SHA1:	6BA829EFE0268028C6DEE8D9D7936CEC03FE24AC
SHA-256:	2CF52D416747AC4F37DCE152C803F523730A4056B06ABEA4B1E3B8EC128A6C52
SHA-512:	CC79835361C4FF5D23C5CEAAC85EBE294004C395BD0BFA0CDD6CB4FAE5C59B09790767DB2B0D3C230FDA40C59341FAD5DEAB3668D4C2D87B4871B4F107847273
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. orderedSet,.)...class WebOfStoriesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?webofstories\.com/play/(?:[^/]+/)?(?P<id>[0-9]+)'. _VIDEO_DOMAIN = 'http://eu-mobile.webofstories.com/'. _GREAT_LIFE_STREAMER = 'rtmp://eu-cdn1.webofstories.com/cfx/st/'. _USER_STREAMER = 'rtmp://eu-users.webofstories.com/cfx/st/'. _TESTS = [{. 'url': 'http://www.webofstories.com/play/hans.bethe/71',. 'md5': '373e4dd915f60cfe3116322642ddf364',. 'info_dict': {. 'id': '4536',. 'ext': 'mp4',. 'title': 'The temperature of the sun',. 'thumbnail': r're:^https?://.*\.jpg$',. 'description': 'Hans Bethe talks about calculating the temperature of the sun',. 'duration': 238,. }. }, {. 'url': 'http://www.webofstories.com/play/55908',. 'md5': '29

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AS4G5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8860
Entropy (8bit):	4.715609156268355
Encrypted:	false
SSDEEP:	192:om1b99VzabLpRvVAvGvTTwdTbCTvgaJWqg0mZ2isLOG3f2hH1Tg6Nl8eg+/:D1NUpVVAv+TTwdTYX4dZuOGv2hH1Tg6f
MD5:	B7A60A9CC2243EC384A4F61CA6DF591C
SHA1:	0BC069ED3BC2E30C5AF8A34E88450FD6867ADE43
SHA-256:	809DF46D8199019085F430EE3DB539F007D8A135B1104201B2CB0183D64C19D1
SHA-512:	06CB8F9D06E58A3450FCA3C04E00BBE8BF8DB380C536A9054D7B84710F7F7839BDF6921B153F9B621006D28FD3EB35FFEE093AE7A7DF43193FE6BFE2EFF8BEF9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlparse,. compat_urlparse,.).from ..utils import (. determine_ext,. extract_attributes,. int_or_none,. js_to_json,. mimetype2ext,. orderedSet,. parse_iso8601,.)...class CondeNastIE(InfoExtractor):. """. Cond. Nast is a media group, some of its sites use a custom HTML5 player. that works the same in all of them.. """.. # The keys are the supported sites and the values are the name to be shown. # to the user and in the extractor description.. _SITES = {. 'allure': 'Allure',. 'architecturaldigest': 'Architectural Digest',. 'arstechnica': 'Ars Technica',. 'bonappetit': 'Bon App.tit',. 'brides': 'Brides',. 'cnevids': 'Cond. Nast',. 'cntraveler': 'Cond. Nast Traveler',. 'details': 'Details',. 'epicurious': 'Epicurious',. 'glamo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ASGDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3254
Entropy (8bit):	5.0142242638149
Encrypted:	false
SSDEEP:	48:+ugRf6n0j7DXNqvr9Xpt27dfFty1KAMBoPpdRWsuhSoZtkji7aPdWeEx7dBTVdwQ:0Z6n07TsvrRX27VIRW37UdWfVdBTb6Ng
MD5:	0B1AA5371A7A9A3D0DA2181446821239
SHA1:	108A88C43B0ECE44C3AE21D504C0D7026B857C4A
SHA-256:	C4EF884B5403C92B0C0814ADDE72D52891CC6E4FA3A816E404B56634B77A64A4
SHA-512:	5DB77A60DE58E0E3ECFDF805FC899AB439F85A5BF721AC2B56B4B70F46D93C3DE29A5D3349CC0D96EB16AEFF89BA8C43158B14C8238CEAEF7D0F192BFDBB4F91
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_urlparse,.).from ..utils import qualities...class IvideonIE(InfoExtractor):. IE_NAME = 'ivideon'. IE_DESC = 'Ivideon TV'. _VALID_URL = r'https?://(?:www\.)?ivideon\.com/tv/(?:[^/]+/)*camera/(?P<id>\d+-[\da-f]+)/(?P<camera_id>\d+)'. _TESTS = [{. 'url': 'https://www.ivideon.com/tv/camera/100-916ca13b5c4ad9f564266424a026386d/0/',. 'info_dict': {. 'id': '100-916ca13b5c4ad9f564266424a026386d',. 'ext': 'flv',. 'title': 're:^..... [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': '........ .............. - ...... ........ ......... .... ..... ....',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'https

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ATUD1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3501
Entropy (8bit):	4.701421379294048
Encrypted:	false
SSDEEP:	48:PuLHKmfW5MzLOcAWPiFHclLkWD9fxYfdfFklkfXhcWzlmdK+tNdFnM/MBvQR1LF8:e1nzLk8iFHclw6fxYftpbl8l1nTqvDg
MD5:	10ED3D03CEB927E5DF13764763786678
SHA1:	8B2D2435208A228E3F153C1F530487AF741AC4E8
SHA-256:	B21373D36B294AD1660B3CE8F439D45ED069DB21E5F6F908B0C6E7CAD169F1DD
SHA-512:	AF3C11CCE18374434232F8441EEBECB6DA5D44EBF32CBE3077A09F7A180F3932BC88F401836A767FD38B23C4E4EBD54394887D2213F2C527DFA21B5AC4907867
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from .youtube import YoutubeIE.from ..compat import compat_b64decode.from ..utils import (. clean_html,. ExtractorError.)...class ChilloutzoneIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?chilloutzone\.net/video/(?P<id>[\w\|-]+)\.html'. _TESTS = [{. 'url': 'http://www.chilloutzone.net/video/enemene-meck-alle-katzen-weg.html',. 'md5': 'a76f3457e813ea0037e5244f509e66d1',. 'info_dict': {. 'id': 'enemene-meck-alle-katzen-weg',. 'ext': 'mp4',. 'title': 'Enemene Meck - Alle Katzen weg',. 'description': 'Ist das der Umkehrschluss des Niesenden Panda-Babys?',. },. }, {. 'note': 'Video hosted at YouTube',. 'url': 'http://www.chilloutzone.net/video/eine-sekunde-bevor.html',. 'info_dict': {. 'id': '1YVQaAgHyRU',. 'ext': 'mp4',. 'title': '16 Photos Taken 1

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AUKCR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2295
Entropy (8bit):	4.971542759685967
Encrypted:	false
SSDEEP:	48:+uIt88PfzR+HXUWAF4x1uTeXx1uTIivIE0KnJXj/BpB9aeuxCfW+ETVNlWf4:FqzaXJAF4xgixgEiGKnzuxQW+EhN1
MD5:	33C503EBB911775BD6D2ADE086883B7B
SHA1:	C5F7F8E94A371AC15E95D77DEACC4F5BC0EAB46C
SHA-256:	495FE664B551C13DFB28941ACDB69E6484610F77ED42F29C93F60BBBCF2ED8CE
SHA-512:	7F512C3AEE9F1AFEC1568A8DF7E86A3C28CD5117756F125602C652B3769FF1B85EB0B09E65EC392E505D43927B7CCD7CAEB39EC202B9F3A0A3CE5520E8888F64
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .prosiebensat1 import ProSiebenSat1BaseIE.from ..utils import (. unified_strdate,. parse_duration,. compat_str,.)...class Puls4IE(ProSiebenSat1BaseIE):. _VALID_URL = r'https?://(?:www\.)?puls4\.com/(?P<id>[^?#&]+)'. _TESTS = [{. 'url': 'http://www.puls4.com/2-minuten-2-millionen/staffel-3/videos/2min2miotalk/Tobias-Homberger-von-myclubs-im-2min2miotalk-118118',. 'md5': 'fd3c6b0903ac72c9d004f04bc6bb3e03',. 'info_dict': {. 'id': '118118',. 'ext': 'flv',. 'title': 'Tobias Homberger von myclubs im #2min2miotalk',. 'description': 'md5:f9def7c5e8745d6026d8885487d91955',. 'upload_date': '20160830',. 'uploader': 'PULS_4',. },. }, {. 'url': 'http://www.puls4.com/pro-und-contra/wer-wird-prasident/Ganze-Folgen/Wer-wird-Praesident.-Norbert-Hofer',. 'only_matching': True,. }, {. 'url': 'http://www.puls4.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-AVUNC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3071
Entropy (8bit):	4.819394612653789
Encrypted:	false
SSDEEP:	48:+uV+C3fdHHJqnydcFhgyBnly6YU8A0tStfjXhkswFQ/v0UuEcQ4DPtqMBT/YFpW0:phNpqnydc/gyBnly6YTA0tQfahQ30Rla
MD5:	707A752240B38D80F8A65624712CB6F7
SHA1:	24EC16ECDE5E2E068C933368C275BFC4E97ADDB9
SHA-256:	18FB1B077D68F0039783EBFBDACA8EF26926A81BCE329D653DD7BF72090B78D4
SHA-512:	BD4EEDA77BAF029EEC011B853197AA03B3BFEF0A3C08AD4CF37C9AF40BCCA38579C1F676389F9A79665581C92574971C0BDDCD1E256231A73B94D9351AE49556
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import unified_timestamp...class URPlayIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ur(?:play\|skola)\.se/(?:program\|Produkter)/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://urplay.se/program/203704-ur-samtiden-livet-universum-och-rymdens-markliga-musik-om-vetenskap-kritiskt-tankande-och-motstand',. 'md5': 'ff5b0c89928f8083c74bbd5099c9292d',. 'info_dict': {. 'id': '203704',. 'ext': 'mp4',. 'title': 'UR Samtiden - Livet, universum och rymdens m.rkliga musik : Om vetenskap, kritiskt t.nkande och motst.nd',. 'description': 'md5:5344508a52aa78c1ced6c1b8b9e44e9a',. 'timestamp': 1513512768,. 'upload_date': '20171217',. },. }, {. 'url': 'https://urskola.se/Produkter/190031-Tripp-Trapp-Trad-Sovkudde',. 'info_dict': {. 'id': '190031',. 'ext': 'm

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-B07SC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3234
Entropy (8bit):	4.663606901437011
Encrypted:	false
SSDEEP:	96:KOOUeBbcSute0EoBBTUIfq3x87/jQwLOW3APXBTeoKBNbpwlmn6N1t38Eo:HOUgK15B1q36gwLOW3ApTk96NoJ
MD5:	88591C7393234FF3338D60CBD5CC0D8D
SHA1:	86C944C98B7F132A5622B86738C6E04649FA84B0
SHA-256:	FFA46737C1860E72FB27E089B5C6E34831985C06825CF8DB71780296CBCD9B68
SHA-512:	7262AEF8D3EDDEB5B5BA18A0A4902DD8DAD9E96A75DD17E9C166E5924FEC10179B3665B353F16FF2420A9C87EEEB206A1BAE16298D147B5F8A64A2601EC104C7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. parse_duration,. remove_end,.)...class LRTIE(InfoExtractor):. IE_NAME = 'lrt.lt'. _VALID_URL = r'https?://(?:www\.)?lrt\.lt/mediateka/irasas/(?P<id>[0-9]+)'. _TESTS = [{. # m3u8 download. 'url': 'http://www.lrt.lt/mediateka/irasas/54391/',. 'md5': 'fe44cf7e4ab3198055f2c598fc175cb0',. 'info_dict': {. 'id': '54391',. 'ext': 'mp4',. 'title': 'Septynios Kauno dienos',. 'description': 'md5:24d84534c7dc76581e59f5689462411a',. 'duration': 1783,. 'view_count': int,. 'like_count': int,. },. }, {. # direct mp3 download. 'url': 'http://www.lrt.lt/mediateka/irasas/1013074524/',. 'md5': '389da8ca3cad0f51d12bed0c844f6a0a',. 'info_dict': {. 'id': '1013074524',. 'ext

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-B0IB4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6903
Entropy (8bit):	5.100758646623155
Encrypted:	false
SSDEEP:	192:l0tg9JiXuSWHEFBlsNSIpaH0PJdq35wMlEgOb3KTHV6Ng:l0tg9JiXuSWHQlsNSCaH0PJo35wMlEgJ
MD5:	10CE4064B6208540F5B42367D574E0D2
SHA1:	1B22EA0DF848636BF3E2BD65FCBC244A15921AF6
SHA-256:	066DB1A7DF131B68D70952E11C0A298FBC228DB1891A33CC3ECA4024C5D87DE1
SHA-512:	D8121725ED038C27C93765899FCCFB26F57CA3295D3F9CC0E729DD85FCC2AE374036A0042F561F1613BA941B0DD715EF416D46E2A3BCE1255D2E6D8047F82CC2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. float_or_none,. try_get,. unified_timestamp,.)...class CCTVIE(InfoExtractor):. IE_DESC = '...'. _VALID_URL = r'https?://(?:(?:[^/]+)\.(?:cntv\|cctv)\.(?:com\|cn)\|(?:www\.)?ncpa-classic\.com)/(?:[^/]+/)*?(?P<id>[^/?#&]+?)(?:/index)?(?:\.s?html\|[?#&]\|$)'. _TESTS = [{. # fo.addVariable("videoCenterId","id"). 'url': 'http://sports.cntv.cn/2016/02/12/ARTIaBRxv4rTT1yWf1frW2wi160212.shtml',. 'md5': 'd61ec00a493e09da810bf406a078f691',. 'info_dict': {. 'id': '5ecdbeab623f4973b40ff25f18b174e8',. 'ext': 'mp4',. 'title': '[NBA]......46. ............',. 'description': 'md5:7e14a5328dc5eb3d1cd6afbbe0574e95',. 'duration': 98,. 'uploader': 'songjunjie',. 'timestamp': 1455279956,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-B3E8U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1348
Entropy (8bit):	4.6694618292225565
Encrypted:	false
SSDEEP:	24:zi8lFvVSMeIXjlgtbXnEBPYMriHUMhLr7jgkKNusHhKtVal3W6Kw2f:+uPSMjXjlkbXnEBPdmHUY7j7gbHhY0WD
MD5:	7CD924C578035D418D419EF9C6C5901A
SHA1:	163136A52F9AB9846F842A15C97E0BCF980BB3C2
SHA-256:	186BC339507807F094E4011D9D9D0C183ECB7A2ECD55215410CF6E96B603764F
SHA-512:	5C9C227DFA780902944A7986068DA32CE41CF5A431C693DDD54E45852A827A3BA029371EF346A699EEF71E99B72278900A27DD486A3F12D97D4F9CC782FB0BDC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urlparse,.)...class AdobeConnectIE(InfoExtractor):. _VALID_URL = r'https?://\w+\.adobeconnect\.com/(?P<id>[\w-]+)'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). title = self._html_search_regex(r'<title>(.+?)</title>', webpage, 'title'). qs = compat_parse_qs(self._search_regex(r"swfUrl\s=\s'([^']+)'", webpage, 'swf url').split('?')[1]). is_live = qs.get('isLive', ['false'])[0] == 'true'. formats = []. for con_string in qs['conStrings'][0].split(','):. formats.append({. 'format_id': con_string.split('://')[0],. 'app': compat_urlparse.quote('?' + con_string.split('?')[1] + 'flvplayerapp/' + qs['appInstance'][0]),. 'ext': 'flv',. 'play_path': 'mp4:' + qs

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-B5K7M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	4.78814282128818
Encrypted:	false
SSDEEP:	48:PuqKxv6kjajNyXdrD1PT3jXhkGwJ64BLWq0zgnZxYBqzIz:PKVTajNyXdrJT3aX6lJqNy
MD5:	310C8F7D67EE33E536CB0AAEBFE9537D
SHA1:	969CC7B8A83A4B343DAFD34C5A47EBA736D640F5
SHA-256:	49B3C7CC7B345FCEFD59CCA8E3D3173EAEE79B63305049100EFEC0B266A7F134
SHA-512:	279A761C5604B768C76FCE35862AFC2DA51A0C951E4CBE70D068E26032CDC7A0458B2DB505F4920C76B8308B92DCEC2AB2BB546B0A9A35D8F38E2A351C4A3BEF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. smuggle_url,.)...class MinistryGridIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ministrygrid\.com/([^/?#]/)(?P<id>[^/#?]+)/?(?:$\|[?#])'.. _TEST = {. 'url': 'http://www.ministrygrid.com/training-viewer/-/training/t4g-2014-conference/the-gospel-by-numbers-4/the-gospel-by-numbers',. 'md5': '844be0d2a1340422759c2a9101bab017',. 'info_dict': {. 'id': '3453494717001',. 'ext': 'mp4',. 'title': 'The Gospel by Numbers',. 'thumbnail': r're:^https?://.*\.jpg',. 'upload_date': '20140410',. 'description': 'Coming soon from T4G 2014!',. 'uploader_id': '2034960640001',. 'timestamp': 1397145591,. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'add_ie': ['TDSLifeway'],. }.. def _real_extract

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-B61FE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3138
Entropy (8bit):	4.869558367491717
Encrypted:	false
SSDEEP:	48:PuW0xfw0vxSZrn64zU46U81dA8VfjXhknHMEXXIuBVyBfWXQzuZQMq3bUzLhaxeK:W5/kZrn64A44dA8VfanH+UgRu+oHsxeK
MD5:	FB8B8A258E30B8885AC03421696E5ED1
SHA1:	2219D487FB0E8B474B854D485C3B3244450F8757
SHA-256:	912E94EA772FEB25E0F33052A7C1024ADA4102879EBCE36C934637A0BC07F2F0
SHA-512:	DFB6F4CED15BFD93877F6E9AC6983CF00298D8CAA4607817FCC6F612E9DC65A878329DBC2962F14987A3E2F91F2FEAF3D8EE3940856A60C7551239AC108A2000
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .youtube import YoutubeIE.from ..utils import (. parse_iso8601,. str_to_int,.)...class CrackedIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cracked\.com/video_(?P<id>\d+)_[\da-z-]+\.html'. _TESTS = [{. 'url': 'http://www.cracked.com/video_19070_if-animal-actors-got-e21-true-hollywood-stories.html',. 'md5': '89b90b9824e3806ca95072c4d78f13f7',. 'info_dict': {. 'id': '19070',. 'ext': 'mp4',. 'title': 'If Animal Actors Got E! True Hollywood Stories',. 'timestamp': 1404954000,. 'upload_date': '20140710',. }. }, {. # youtube embed. 'url': 'http://www.cracked.com/video_19006_4-plot-holes-you-didnt-notice-in-your-favorite-movies.html',. 'md5': 'ccd52866b50bde63a6ef3b35016ba8c7',. 'info_dict': {. 'id': 'EjI00A3rZD0',. 'ext': 'mp4',. 'title':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-B6F5E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3355
Entropy (8bit):	4.737622281259504
Encrypted:	false
SSDEEP:	96:VJmwASbdaVN8VStdv0s4CGOLMioy90nnd7BTKsWxi1gNt6Ng:VJUoQ84dh4CGOLMioS0n/TKn76Ng
MD5:	55083DBC4E461DBC2DA344D1EB907748
SHA1:	3308F6CF51EE7376927925C821FC22498AFDDB25
SHA-256:	EC369749FE74228AC201040DC244705179135749D02370076D114F7CFFD03451
SHA-512:	4E438155AA039E52C6A63256A278EE3194B1BFD69654932A68C43A666B6705F77952F42701A4E051E686291182E4596A8842C13FA4F73323383997643D4D9961
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class PerformGroupIE(InfoExtractor):. _VALID_URL = r'https?://player\.performgroup\.com/eplayer(?:/eplayer\.html\|\.js)#/?(?P<id>[0-9a-f]{26})\.(?P<auth_token>[0-9a-z]{26})'. _TESTS = [{. # http://www.faz.net/aktuell/sport/fussball/wm-2018-playoffs-schweiz-besiegt-nordirland-1-0-15286104.html. 'url': 'http://player.performgroup.com/eplayer/eplayer.html#d478c41c5d192f56b9aa859de8.1w4crrej5w14e1ed4s1ce4ykab',. 'md5': '259cb03d142e2e52471e8837ecacb29f',. 'info_dict': {. 'id': 'xgrwobuzumes1lwjxtcdpwgxd',. 'ext': 'mp4',. 'title': 'Liga MX: Keine Einsicht nach Horrorfoul',. 'description': 'md5:7cd3b459c82725b021e046ab10bf1c5b',. 'timestamp': 1511533477,. 'upload_date': '20171124',. }. }].. def _call_api(self, service, auth_token, content_id, refer

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BAD7I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11891
Entropy (8bit):	4.443270811257581
Encrypted:	false
SSDEEP:	192:akIlc+isOTSN43t8nDTq7O7cXij2lgUJH5jEPwkW3P7BgTlFyGAeD6NVDV3xGETm:wlc+iTTSN43t8DTKO7+ij2lgUd51zBgh
MD5:	B00A23B53B5CB6EA5AEFA58795976FDF
SHA1:	9E187CBC17095374950FE0F0CA268125B243D9A6
SHA-256:	B08F9C9E676C14CB9D55E7124D94024ECADB4E0AB93FA2751C7B8A6E786946D9
SHA-512:	CD19DB54BB4BB9886019A5DCC03B6D226EC68EF4D8204965F33EFD85EA406BA455A5BC0F2FF9D54FA915B353BE2112981C87623A10ED6A61D2BA0EECCB6DBBEB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. int_or_none,. NO_DEFAULT,. orderedSet,. parse_codecs,. qualities,. try_get,. unified_timestamp,. update_url_query,. url_or_none,. urljoin,.)...class ZDFBaseIE(InfoExtractor):. def _call_api(self, url, player, referrer, video_id, item):. return self._download_json(. url, video_id, 'Downloading JSON %s' % item,. headers={. 'Referer': referrer,. 'Api-Auth': 'Bearer %s' % player['apiToken'],. }).. def _extract_player(self, webpage, video_id, fatal=True):. return self._parse_json(. self._search_regex(. r'(?s)data-zdfplayer-jsb=(["\'])(?P<json>{.+?})\1', webpage,. 'player JSON', default='{}' if not fatal else NO_DEFAULT,. group='json'),. vide

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BCGL4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1424
Entropy (8bit):	5.306780569449599
Encrypted:	false
SSDEEP:	24:zi8lFvVLbIGUY6LjdQueWwIkinh+Gfb/xMpdlclaFj3JaeIXjlgtaDcLE75qrmXx:+uPLbIJjdrbp+aTyoyZajXjlkYIi5qr0
MD5:	FB6780E97567A1996CBEC39A453E71D9
SHA1:	AE4F1EADC7BAD1EA077B9F1AE9982EFA0986C4C3
SHA-256:	8CFB8B5F2ABA38AF650C14B6C36D6B7489BCF1585C466091164C61985C9D78C5
SHA-512:	EBFC6C7B30394EF202F8777E5D6704202C60DC112A83421461D4C91DCC2AC6FFF1611A3D0F7027ACC59BD32E8053DD26279DD1823329BE16244DA34D61A7F23C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import unescapeHTML...class VODPlatformIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vod-platform\.net/[eE]mbed/(?P<id>[^/?#]+)'. _TEST = {. # from http://www.lbcgroup.tv/watch/chapter/29143/52844/%D8%A7%D9%84%D9%86%D8%B5%D8%B1%D8%A9-%D9%81%D9%8A-%D8%B6%D9%8A%D8%A7%D9%81%D8%A9-%D8%A7%D9%84%D9%80-cnn/ar. 'url': 'http://vod-platform.net/embed/RufMcytHDolTH1MuKHY9Fw',. 'md5': '1db2b7249ce383d6be96499006e951fc',. 'info_dict': {. 'id': 'RufMcytHDolTH1MuKHY9Fw',. 'ext': 'mp4',. 'title': 'LBCi News_ ...... .. ..... ... "........"',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = unescapeHTML(self._og_search_title(webpage)). hidden_inputs = self._hidden_inputs(webpage)..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BD77T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2783
Entropy (8bit):	4.567675132601024
Encrypted:	false
SSDEEP:	48:PuLRcP3hPUpYr6tgFdg7FXEPBFsRi/i4ki0CWLbHhg7FXEPBFfwPp+lxcOJoXhhZ:pP3hPQTtgFdg7KPAR+y/CqbHhg7KPjwd
MD5:	21AAD900DAC01A6B983C6325312F2D92
SHA1:	A0D3FDC53E943818BD4AE603061DA1747BBC3090
SHA-256:	385642A9098D181DA9DDB375AB035D46CC6DE836F77F34221A04643B5E6D91D7
SHA-512:	0BE18F63B29DA26F77C92A12555650F99451C43F1875024E17FC829A6D1DEE5BC035A8F056509A54B5B82E5BF19BD22555A63866C1648793A73DCFCC025C6918
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .mtv import MTVServicesInfoExtractor.from ..utils import unified_strdate...class BetIE(MTVServicesInfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bet\.com/(?:[^/]+/)+(?P<id>.+?)\.html'. _TESTS = [. {. 'url': 'http://www.bet.com/news/politics/2014/12/08/in-bet-exclusive-obama-talks-race-and-racism.html',. 'info_dict': {. 'id': '07e96bd3-8850-3051-b856-271b457f0ab8',. 'display_id': 'in-bet-exclusive-obama-talks-race-and-racism',. 'ext': 'flv',. 'title': 'A Conversation With President Obama',. 'description': 'President Obama urges persistence in confronting racism and bias.',. 'duration': 1534,. 'upload_date': '20141208',. 'thumbnail': r're:(?i)^https?://.*\.jpg$',. 'subtitles': {. 'en': 'mincount:2',. }. },. 'params':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BFRF4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3724
Entropy (8bit):	4.671204077419834
Encrypted:	false
SSDEEP:	96:9KbfVs5q57ppA4EP8JreYT/CFnuUDGBBTeKSECj6NWTXwWw4z:6fi5app7LlYuUqPTI6Nkjw4z
MD5:	4608C36B1F20CF664A72262CC7F7B0F9
SHA1:	9857E9445C4048B704618D527073B486F2FD134B
SHA-256:	03DC3196389B724F764A8747A4F45F99279B9CBE3CC2E889CD330E587BA96131
SHA-512:	F907A1CB299A5459482443767FEF535048DC80FDB9356986C9044966B4D6EA9337B7D30A6B6E34F2A0B59842EDD575AE7E0C64FD024A73A607BAD39CDD74E4C3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. clean_html,. ExtractorError,. int_or_none,. PUTRequest,.)...class PlayPlusTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?playplus\.(?:com\|tv)/VOD/(?P<project_id>[0-9]+)/(?P<id>[0-9a-f]{32})'. _TEST = {. 'url': 'https://www.playplus.tv/VOD/7572/db8d274a5163424e967f35a30ddafb8e',. 'md5': 'd078cb89d7ab6b9df37ce23c647aef72',. 'info_dict': {. 'id': 'db8d274a5163424e967f35a30ddafb8e',. 'ext': 'mp4',. 'title': 'Cap.tulo 179 - Final',. 'description': 'md5:01085d62d8033a1e34121d3c3cabc838',. 'timestamp': 1529992740,. 'upload_date': '20180626',. },. 'skip': 'Requires account credential',. }. _NETRC_MACHINE = 'playplustv'. _GEO_COUNTRIES = ['BR']. _token = None. _profile_id = None..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BGHUT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7271
Entropy (8bit):	4.791376742866182
Encrypted:	false
SSDEEP:	192:01FytPPoYzp36igRnVPdefaL81via2BsymzeLXATjJ6Ng:06ZoYzp3rKVPdeiL8hD2uXSLXATjJ6Ng
MD5:	DBDCC6A657A4A1C074036D1B94BEB061
SHA1:	974274AE26EC78977FBD2558E6F6CB313473624E
SHA-256:	D17AD6678BC8BCEF80BD3B9287444342E7033A6AE1CAFBC57F8468422B5D2A77
SHA-512:	295296B3B68316796D535A3ED6CEAE41AC3133E827C8800667F006F4B667288FB8BFCF311946A7A0AC7ECA8152262B5D0224971B794567ACE26C425214DC210A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urlparse,. compat_urllib_parse_urlencode,.).from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,. qualities,.)...class PlaytvakIE(InfoExtractor):. IE_DESC = 'Playtvak.cz, iDNES.cz and Lidovky.cz'. _VALID_URL = r'https?://(?:.+?\.)?(?:playtvak\|idnes\|lidovky\|metro)\.cz/.\?(?:c\|idvideo)=(?P<id>[^&]+)'. _TESTS = [{. 'url': 'http://www.playtvak.cz/vyzente-vosy-a-srsne-ze-zahrady-dn5-/hodinovy-manzel.aspx?c=A150730_150323_hodinovy-manzel_kuko',. 'md5': '4525ae312c324b4be2f4603cc78ceb4a',. 'info_dict': {. 'id': 'A150730_150323_hodinovy-manzel_kuko',. 'ext': 'mp4',. 'title': 'Vy.e.te vosy a sr.n. ze zahrady',. 'description': 'md5:4436e61b7df227a093778efb7e373571',. 'thumbnail': r're:(?i)^https?://.\.(?:jpg\|png)$',. 'duration': 279,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BGL36.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3665
Entropy (8bit):	4.55776307990221
Encrypted:	false
SSDEEP:	96:0ibgO9kf8qPAfqrc87KzNlrZ22FIiVsOV8BTg6Nv86tc:db2QqkPZ22FIi2OVUTg6N0Z
MD5:	74C0014C8886C402B1457FEDC2916AA6
SHA1:	FC1688DBC96BC4D214AEB73D6A4D6E75284745BD
SHA-256:	E034E5C37B8AD994950E85DC9F154A3A35A85A1D759DDCF8434F332E7F2DEF81
SHA-512:	6922B94F92098BE21B2F5114B94A8609A4F0A64E8CE5E8E811908696790677D27D7FD63FC19594333A5DDE6CEC2FAA6C91D2289DF3FE1209B22FB900BA0B7C81
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote,. compat_xpath,.).from ..utils import (. int_or_none,. find_xpath_attr,. xpath_text,. update_url_query,.)...class NozIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?noz\.de/video/(?P<id>[0-9]+)/'. _TESTS = [{. 'url': 'http://www.noz.de/video/25151/32-Deutschland-gewinnt-Badminton-Lnderspiel-in-Melle',. 'info_dict': {. 'id': '25151',. 'ext': 'mp4',. 'duration': 215,. 'title': '3:2 - Deutschland gewinnt Badminton-L.nderspiel in Melle',. 'description': 'Vor rund 370 Zuschauern gewinnt die deutsche Badminton-Nationalmannschaft am Donnerstag ein EM-Vorbereitungsspiel gegen Frankreich in Melle. Video Moritz Frankenberg.',. 'thumbnail': r're:^http://.*\.jpg',. },. }].. def _real_extract(self, url):. video_id = self._match_i

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BP669.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3217
Entropy (8bit):	4.58255570509069
Encrypted:	false
SSDEEP:	96:dqwe13ArV/npr1EXQTuIXdelipauPnBTz26NU6e8B:dLesxprwjodeliQiBTz26NUUB
MD5:	5378ADC6C2E74BC4F9DBA8FF7D56B119
SHA1:	25FF2B130728375BF08D7491F3550B9DC6B3D6F6
SHA-256:	6382B3CB35910A4FB8CA675E9C33F6A2ECC7E22E9F86C5661ABC5F8E06AFE182
SHA-512:	FA1720D2F407B9C902CEABAAAF638DAF17FB3619BA74C70E14C58238D76437C322D1928B6B45051A1DCC791E41730DD0E82DE371225B57F20C1E0CEF65B2E4DF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import (. remove_start,. int_or_none,.)...class BlinkxIE(InfoExtractor):. _VALID_URL = r'(?:https?://(?:www\.)blinkx\.com/#?ce/\|blinkx:)(?P<id>[^?]+)'. IE_NAME = 'blinkx'.. _TEST = {. 'url': 'http://www.blinkx.com/ce/Da0Gw3xc5ucpNduzLuDDlv4WC9PuI4fDi1-t6Y3LyfdY2SZS5Urbvn-UPJvrvbo8LTKTc67Wu2rPKSQDJyZeeORCR8bYkhs8lI7eqddznH2ofh5WEEdjYXnoRtj7ByQwt7atMErmXIeYKPsSDuMAAqJDlQZ-3Ff4HJVeH_s3Gh8oQ',. 'md5': '337cf7a344663ec79bf93a526a2e06c7',. 'info_dict': {. 'id': 'Da0Gw3xc',. 'ext': 'mp4',. 'title': 'No Daily Show for John Oliver; HBO Show Renewed - IGN News',. 'uploader': 'IGN News',. 'upload_date': '20150217',. 'timestamp': 1424215740,. 'description': 'HBO has renewed Last Week Tonight With John Oliver for two more seasons.',. 'duration': 47.743333,. },. }..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BQKTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3419
Entropy (8bit):	4.502572059523825
Encrypted:	false
SSDEEP:	96:Por+MuGoVnfpgXkvVfuEG6hEcaFM+ydR8m6Kzfe1pz5rBTz3Up6Nt:gyVG2f4EVuEG6hEcSM+IWUYdTz3Up6Nt
MD5:	95D70BCF4B7CAE7F30D7C460B16164B5
SHA1:	2DCA4D9C574745DC6028354556C87A11AB5A56BE
SHA-256:	067ECC7D2555FF966BA09379EAE04971E64770EE327563609397511C6AB52DDD
SHA-512:	316CE9555ED44D4A9DAB00F9E74593DC91C32C496B5677F6E8AA393A24A68C4E292FC4CDA0483DA1084C0965127F10CD79EC609487C4C93C143EC668035D929E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import int_or_none...class BeatportIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.\|pro\.)?beatport\.com/track/(?P<display_id>[^/]+)/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://beatport.com/track/synesthesia-original-mix/5379371',. 'md5': 'b3c34d8639a2f6a7f734382358478887',. 'info_dict': {. 'id': '5379371',. 'display_id': 'synesthesia-original-mix',. 'ext': 'mp4',. 'title': 'Froxic - Synesthesia (Original Mix)',. },. }, {. 'url': 'https://beatport.com/track/love-and-war-original-mix/3756896',. 'md5': 'e44c3025dfa38c6577fbaeb43da43514',. 'info_dict': {. 'id': '3756896',. 'display_id': 'love-and-war-original-mix',. 'ext': 'mp3',. 'title': 'Wolfgang Gartner - Love & War (Original Mix)',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BTP8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3910
Entropy (8bit):	4.982185985447009
Encrypted:	false
SSDEEP:	96:eRSvcNbgXjnxp8nXi5cDaGmBTKjiUgNs6NezpNb2ZXjoQn7QXjFduikxXj8Cfk3:oSvcBCKXiW+fTKD6N0pB1Q7OEjSwc
MD5:	435FD89AA18630A790CE48D87AF0C789
SHA1:	DC53856C0F3C1DC27C8D52D6ACC5690923D963D7
SHA-256:	38108ECA50FD6D511BD16F23C80753D39B8F39A6672D451918C0173997E85187
SHA-512:	673291CE728FF9FC7325E5AFD37C80E40FD0573D9F7441AFE48A522FDAE9591416657CCD7A25B5CD781C5E2F9AD7D743FBA7846C121015F4998B9D10672618D2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,.)...class TVCIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?tvc\.ru/video/iframe/id/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.tvc.ru/video/iframe/id/74622/isPlay/false/id_stat/channel/?acc_video_id=/channel/brand/id/17/show/episodes/episode_id/39702',. 'md5': 'bbc5ff531d1e90e856f60fc4b3afd708',. 'info_dict': {. 'id': '74622',. 'ext': 'mp4',. 'title': '........ ".......". .... .. 22.05.2015 14:30',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 1122,. },. }.. @classmethod. def _extract_url(cls, webpage):. mobj = re.search(. r'<iframe[^>]+?src=(["\'])(?P<url>(?:http:)?//(?:www\.)?tvc\.ru/video/iframe/id/[^"]+)\1', webpage). if mobj:. return mobj.group('url').. def

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BU7N7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2953
Entropy (8bit):	4.849685740384726
Encrypted:	false
SSDEEP:	48:+uZcETfrFMEL+sVdN8BcV13R/vMEL2UVWNccgwvUOXxR2ItfJoXhh1BDPAkiRAkO:VcE7jL+sfqBExfL2U8WcgUUOXx8ufJaj
MD5:	DC4A6508E1005F5ED01800F914FBF95D
SHA1:	E44CE259E9DB74AFCA0114A1268BD0742FB55B21
SHA-256:	C3DFE40FE861BD81D336D999032E376D7CC419009269EB028A86D8A65349C7DD
SHA-512:	90D3E685CF4032D75FE6FEFAE7213EF41CEDCAEE58BA845595071E23E2BF0CF5EEAA876565BB02DEF2198CB9945B261C2D042E9686A7137E834C5D97B6BA962B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .arkena import ArkenaIE...class LcpPlayIE(ArkenaIE):. _VALID_URL = r'https?://play\.lcp\.fr/embed/(?P<id>[^/]+)/(?P<account_id>[^/]+)/[^/]+/[^/]+'. _TESTS = [{. 'url': 'http://play.lcp.fr/embed/327336/131064/darkmatter/0',. 'md5': 'b8bd9298542929c06c1c15788b1f277a',. 'info_dict': {. 'id': '327336',. 'ext': 'mp4',. 'title': '327336',. 'timestamp': 1456391602,. 'upload_date': '20160225',. },. 'params': {. 'skip_download': True,. },. }]...class LcpIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lcp\.fr/(?:[^/]+/)*(?P<id>[^/]+)'.. _TESTS = [{. # arkena embed. 'url': 'http://www.lcp.fr/la-politique-en-video/schwartzenberg-prg-preconise-francois-hollande-de-participer-une-primaire',. 'md5': 'b8bd9298542929c06c1c15788b1f277a',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BUEST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	4.787341845875019
Encrypted:	false
SSDEEP:	192:5dTUiW1ToMXT3py0yEkH7+wCORTzw1H0eV6NPaYWToTlRwAA:zZW18ETw0Z2+wCORTzwtV6Nwscb
MD5:	FFD1B4057C80F60155AB65476726DA3F
SHA1:	C0C7A82350E54B5012DF1E8ADCE6407A628A1DAB
SHA-256:	08300035E19E3D0ACD41F3E56A9888D559C99C6702142E051CA3786204D936C4
SHA-512:	D23A1FDB040E28D50C3DB42E58FAAEC263EF1B98F9947AF41B81731E173BE48B6A5CE056EE5768CFDB6E4EFF57475E02B3C76F58117926F2F95B3312549E7797
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. qualities,.)...class IviIE(InfoExtractor):. IE_DESC = 'ivi.ru'. IE_NAME = 'ivi'. _VALID_URL = r'https?://(?:www\.)?ivi\.(?:ru\|tv)/(?:watch/(?:[^/]+/)?\|video/player\?.?videoId=)(?P<id>\d+)'. _GEO_BYPASS = False. _GEO_COUNTRIES = ['RU'].. _TESTS = [. # Single movie. {. 'url': 'http://www.ivi.ru/watch/53141',. 'md5': '6ff5be2254e796ed346251d117196cf4',. 'info_dict': {. 'id': '53141',. 'ext': 'mp4',. 'title': '.... .......... ...... .........',. 'description': 'md5:b924063ea1677c8fe343d8a72ac2195f',. 'duration': 5498,. 'thumbnail': r're:^https?://.\.jpg$',. },. 'skip': 'Only works from Russia',. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-BUOPL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3279
Entropy (8bit):	4.787465594412977
Encrypted:	false
SSDEEP:	96:Ko2+Qo7QD2X1cv7FflYccTTNSSXBTNjUMEY+e6NNQT7L2DXfkv76Cfqmz:9fQo7Q1v7FlPcTZSSxTNIsx6NGT7iAvL
MD5:	FFAB8B8C8A0A781D7A6FFEC77BB9C1CB
SHA1:	AADC53A69AA7E67C1C9C066E937C1DA1137C1600
SHA-256:	79BBDA6FF8EB1C4ECCD477B5B358D8B2645321B8D869028A15B618FA73A5C708
SHA-512:	51491F453FE9BE23436A300EA73F98DA3080570D62459DA46E788ADF15E340E283FC16B8D5B6D390913C954C867E8763540D9CD4A72434B6953190A6F34A6718
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_duration,.)...class MwaveIE(InfoExtractor):. _VALID_URL = r'https?://mwave\.interest\.me/(?:[^/]+/)?mnettv/videodetail\.m\?searchVideoDetailVO\.clip_id=(?P<id>[0-9]+)'. _URL_TEMPLATE = 'http://mwave.interest.me/mnettv/videodetail.m?searchVideoDetailVO.clip_id=%s'. _TESTS = [{. 'url': 'http://mwave.interest.me/mnettv/videodetail.m?searchVideoDetailVO.clip_id=168859',. # md5 is unstable. 'info_dict': {. 'id': '168859',. 'ext': 'flv',. 'title': '[M COUNTDOWN] SISTAR - SHAKE IT',. 'thumbnail': r're:^https?://.*\.jpg$',. 'uploader': 'M COUNTDOWN',. 'duration': 206,. 'view_count': int,. }. }, {. 'url': 'http://mwave.interest.me/en/mnettv/videodetail.m?searchVideoDetailVO.clip_id=176199',. 'only_matching': True

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-C3DIB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	4.770451618846276
Encrypted:	false
SSDEEP:	24:zi8lFvxGqvpip/UdlnkeIXhgtMDimRdlDDCmDDg1Aq1Jw:+ujvuUAjXhky/zJvg131e
MD5:	375B4EDBE6854E49F75DC3D8CD28C168
SHA1:	26494B34B3B390382C70C795C6B31F2CBFE127DF
SHA-256:	9805D1106DED2E98727AC6677DBB59FF54B5059B8CAB6C3107503D70FE9E1DC0
SHA-512:	D7FE2B9FB73E89F1B6519B3F250D20B88412B154A44B8A7D69B0C1D54039CFF814ED88F41BB23B036F26931B0A91EA667A0C455B2AD814FA26DF62589900560D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class KeekIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?keek\.com/keek/(?P<id>\w+)'. IE_NAME = 'keek'. _TEST = {. 'url': 'https://www.keek.com/keek/NODfbab',. 'md5': '9b0636f8c0f7614afa4ea5e4c6e57e83',. 'info_dict': {. 'id': 'NODfbab',. 'ext': 'mp4',. 'title': 'md5:35d42050a3ece241d5ddd7fdcc6fd896',. 'uploader': 'ytdl',. 'uploader_id': 'eGT5bab',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. return {. 'id': video_id,. 'url': self._og_search_video_url(webpage),. 'ext': 'mp4',. 'title': self._og_search_description(webpage).strip(),. 'thumbnail': self._og_search_thumbnail(webpage),. 'uploader': self._search_regex(. r'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-C503V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2585
Entropy (8bit):	4.873390696541669
Encrypted:	false
SSDEEP:	48:+uveAQgBs7/z+u5UZ1utiajXhk7qvCVzVCeVJXGb6BXGD1XzjuS5+qXU8qXbOmYr:KAQgBc/zUutiaaOvdHb6wxXZ5+b8QOmC
MD5:	AE715DD8CEE986E288885DD716E97835
SHA1:	6DF0F7A121E011BBC88AE484A16B25659B11DEF2
SHA-256:	0845502F7A108C614ADFED4808269307D5E7B397AED62EC361354450A8DB4A67
SHA-512:	44A9D94F85ECBA0B7BF41AF88EFCD104C9E51A90F331A424D02CB5716731F5A6A57F5E827406CAF1387F552A79C452FCD0753478DC765B8622C08D4ED35E8508
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_strdate,.)...class JpopsukiIE(InfoExtractor):. IE_NAME = 'jpopsuki.tv'. _VALID_URL = r'https?://(?:www\.)?jpopsuki\.tv/(?:category/)?video/[^/]+/(?P<id>\S+)'.. _TEST = {. 'url': 'http://www.jpopsuki.tv/video/ayumi-hamasaki---evolution/00be659d23b0b40508169cdee4545771',. 'md5': '88018c0c1a9b1387940e90ec9e7e198e',. 'info_dict': {. 'id': '00be659d23b0b40508169cdee4545771',. 'ext': 'mp4',. 'title': 'ayumi hamasaki - evolution',. 'description': 'Release date: 2001.01.31\r\n..... - evolution',. 'thumbnail': 'http://www.jpopsuki.tv/cache/89722c74d2a2ebe58bcac65321c115b2.jpg',. 'uploader': 'plama_chan',. 'uploader_id': '404',. 'upload_date': '20121101'. }. }.. def _real_extract(self, url):. video_id = self._m

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-C5NOF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1514
Entropy (8bit):	4.872904617441403
Encrypted:	false
SSDEEP:	24:1R8lQLGM5vw3BdN//xkHbAFdlXtu8TOAwVUG1vaJoXhhdIBneKmtaBeRGGOyvJKG:PuQL1vircbSh81vaJoXhh6BnpoaBeRTR
MD5:	B2EA31AB313C421212C6A0213CC4B042
SHA1:	532560992F36F093FDC516A12E74B3EE1217984D
SHA-256:	3F2FEC640C345A9BDEFDED232FD13B4BD58C03CB9D0AEA1466BF075F7D4E02C6
SHA-512:	522455EA93313F7BC644A1B106790E9566EC416E75F0779EAAC2360CFB4E47085A0D3D604C9E9BFBA019C0681831D492756E5E6073E4C860475D1D5162135BA8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .nuevo import NuevoBaseIE...class RulePornIE(NuevoBaseIE):. _VALID_URL = r'https?://(?:www\.)?ruleporn\.com/(?:[^/?#&]+/)*(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'http://ruleporn.com/brunette-nympho-chick-takes-her-boyfriend-in-every-angle/',. 'md5': '86861ebc624a1097c7c10eaf06d7d505',. 'info_dict': {. 'id': '48212',. 'display_id': 'brunette-nympho-chick-takes-her-boyfriend-in-every-angle',. 'ext': 'mp4',. 'title': 'Brunette Nympho Chick Takes Her Boyfriend In Every Angle',. 'description': 'md5:6d28be231b981fff1981deaaa03a04d5',. 'age_limit': 18,. 'duration': 635.1,. }. }.. def _real_extract(self, url):. display_id = self._match_id(url).. webpage = self._download_webpage(url, display_id).. video_id = self._search_regex(. r'lovehomeporn\.com/embed/(\d+)', webpage, 'video id').. title = self.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CA1U3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4505
Entropy (8bit):	4.550856667863298
Encrypted:	false
SSDEEP:	96:YOB8oRveKGRJfaoBQQ2l7O13FYfyy4s8b4egQ5BTUGHjV2mt/8V6No:tuoRWBxayE7O13FYay4sCtgQXT1jQV62
MD5:	5D84CC29AFAD2875BCE9AAC54CD84EDC
SHA1:	42179F3EE82A40E468D9C207814E1A44D857A9CA
SHA-256:	624491BB0522BE1A10E27B8E3E49462D731E11A3EC852BA5719B0FC429150A10
SHA-512:	841B5C3CF874296FB3448584CE55D6AEA535970240F5BC63AC88A70888EC466145E39077393696E48AE12C32ED6DA039DD0AA7DDB6C2BF783103A51B1A09A3D5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. url_or_none,.)...class KonserthusetPlayIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:konserthusetplay\|rspoplay)\.se/\?.\bm=(?P<id>[^&]+)'. _TESTS = [{. 'url': 'http://www.konserthusetplay.se/?m=CKDDnlCY-dhWAAqiMERd-A',. 'md5': 'e3fd47bf44e864bd23c08e487abe1967',. 'info_dict': {. 'id': 'CKDDnlCY-dhWAAqiMERd-A',. 'ext': 'mp4',. 'title': 'Orkesterns instrument: Valthornen',. 'description': 'md5:f10e1f0030202020396a4d712d2fa827',. 'thumbnail': 're:^https?://.$',. 'duration': 398.76,. },. }, {. 'url': 'http://rspoplay.se/?m=elWuEH34SMKvaO4wO_cHBw',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CCAPS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11135
Entropy (8bit):	4.643884495409274
Encrypted:	false
SSDEEP:	192:joFmcHAN+v4a9SaZiDOPUsybIdbCATc6NoXSdLFv7vYCFeVXVQimhM92KQXOZTia:MngNmR9SaEOPUsybIdbCATc6NoC1R7v6
MD5:	E997604B0B6AFF7DC75E4A80AB538D94
SHA1:	4B7D20971B9D0E1B443385876BFD6F8079B209C6
SHA-256:	684914AC66C85EB9E9AC6EB07F172EBFF09E4C7733C97DDD00E35946A35AD948
SHA-512:	33F70E21C8676423C03C6E3B6741E1956E7A0EBC547E9147292621E2D38D601EC28DB4DB5322FC2BF15FB4E7EB51EC27E9806A811898FE35910941DB7C06A784
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import base64.import re..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote.from ..utils import (. ExtractorError,. clean_html,. determine_ext,. int_or_none,. js_to_json,. parse_age_limit,. parse_duration,.)...class ViewLiftBaseIE(InfoExtractor):. _DOMAINS_REGEX = r'(?:snagfilms\|snagxtreme\|funnyforfree\|kiddovid\|winnersview\|(?:monumental\|lax)sportsnetwork\|vayafilm)\.com\|hoichoi\.tv'...class ViewLiftEmbedIE(ViewLiftBaseIE):. _VALID_URL = r'https?://(?:(?:www\|embed)\.)?(?:%s)/embed/player\?.*\bfilmId=(?P<id>[\da-f]{8}-(?:[\da-f]{4}-){3}[\da-f]{12})' % ViewLiftBaseIE._DOMAINS_REGEX. _TESTS = [{. 'url': 'http://embed.snagfilms.com/embed/player?filmId=74849a00-85a9-11e1-9660-123139220831&w=500',. 'md5': '2924e9215c6eff7a55ed35b72276bd93',. 'info_dict': {. 'id': '74849a00-85a9-11e1-9660-123139220831',. 'ext': 'mp4',. 'title': '#whilewewat

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CCLHC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	4.82161493424305
Encrypted:	false
SSDEEP:	96:eNN2Ipl38iNnxQFKRmfq4o1MpXntKRWibYUJyPAONOBT8bNu6hG5H6Ne90f:+0IvMi3Xsq4EAntribYUmAONaT8bgH69
MD5:	F98A93FA6850F23A77053A24556A07DE
SHA1:	99AF1618C0546545BFCA6A1430D46BC65F244766
SHA-256:	C35D5E8E5735E007C214177F5D26436B7B9C6436C69316BF44CDEE505C89C80C
SHA-512:	FE70A3EF0A359FCAE2FBF13474707F403FCA74C3B11910D1BC20C9C8FDC688D284204F8D63F6863BEB046617BE982871DBC021B0B3B2A8C66AFF4A87D564C3A7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. update_url_query,.)...class NaverIE(InfoExtractor):. _VALID_URL = r'https?://(?:m\.)?tv(?:cast)?\.naver\.com/v/(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://tv.naver.com/v/81652',. 'info_dict': {. 'id': '81652',. 'ext': 'mp4',. 'title': '[9. .... ....][.._...] .. A. 16~20.',. 'description': '..... .. ..... \| ..... .. ... .... 9. .... ..A. 16... 20... ..... ......',. 'upload_date': '20130903',. },. }, {. 'url': 'http://tv.naver.com/v/395837',. 'md5': '638ed4c12012c458fefcddfd01f173cd',. 'info_dict': {. 'id': '395837',. 'ext': 'mp4',. 'title': '9.. ... ..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CEDON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7911
Entropy (8bit):	4.838809480915498
Encrypted:	false
SSDEEP:	192:ARi1s/atLVNaUU/J2hjG5sRqDisgoGlTOZPeV6No:ARks/afwUU/JqjssRGisgoGlTOMV6No
MD5:	87B42CE45490E0942AEE0F16DC0D2120
SHA1:	D8DB9105F8B1E1083E403E82B1ACF8AC4074C126
SHA-256:	CE161A687B89BCEDED22D31949D1A4052690BCE6E0E400AB974E30A9BAAABD73
SHA-512:	899D40217EEA93BA2A9B78CFD5F51D63F797D0E702735DD78EED848E1425C4BED4AFCEE47BC6DCF2887B36B64064973416589792C1EE9A0A99E28B414754D87E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import time.import hmac.import hashlib.import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. sanitized_Request,. urlencode_postdata,. xpath_text,.)...class AtresPlayerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?atresplayer\.com/television/[^/]+/[^/]+/[^/]+/(?P<id>.+?)_\d+\.html'. _NETRC_MACHINE = 'atresplayer'. _TESTS = [. {. 'url': 'http://www.atresplayer.com/television/programas/el-club-de-la-comedia/temporada-4/capitulo-10-especial-solidario-nochebuena_2014122100174.html',. 'md5': 'efd56753cda1bb64df52a3074f62e38a',. 'info_dict': {. 'id': 'capitulo-10-especial-solidario-nochebuena',. 'ext': 'mp4',. 'title': 'Especial Solidario de Nochebuena',. 'description': 'md5:e2d52ff12214fa937107d21064075bf1',. 'du

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CFN7H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6933
Entropy (8bit):	4.558161322875779
Encrypted:	false
SSDEEP:	192:VhFmxDcApDCP3AJ3T9tolhKrmU6DvqouxDJNTuMM6Ny3:VhFmxDcIDc3mD9tolgrkvqoupJNTuMMp
MD5:	B163E76D5A0CEF030E720C16CA9D6A04
SHA1:	3CAC81A72DDD292E605CBE2CAF33A792CC17283C
SHA-256:	D92DDA0314114C84E0B9EFE62968E68475F458570BBE8B009DAA6CFAF0DE27FB
SHA-512:	8AA2800852B81666AA7DCF3250FCFECC54072383E03802AA148E3383B75604A8AB40C2814BC30500ADC9A9BD3445CCDEB8B31EF7011624A9F3F8C69DA44A7C1B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,.).from ..utils import (. int_or_none,. ExtractorError,.)...class VubeIE(InfoExtractor):. IE_NAME = 'vube'. IE_DESC = 'Vube.com'. _VALID_URL = r'https?://vube\.com/(?:[^/]+/)+(?P<id>[\da-zA-Z]{10})\b'.. _TESTS = [. {. 'url': 'http://vube.com/trending/William+Wei/Y8NUZ69Tf7?t=s',. 'md5': 'e7aabe1f8f1aa826b9e4735e1f9cee42',. 'info_dict': {. 'id': 'Y8NUZ69Tf7',. 'ext': 'mp4',. 'title': 'Best Drummer Ever [HD]',. 'description': 'md5:2d63c4b277b85c2277761c2cf7337d71',. 'thumbnail': r're:^https?://.*\.jpg',. 'uploader': 'William',. 'timestamp': 1406876915,. 'upload_date': '20140801',. 'duration': 258.051,. 'like_count': int,. 'dislike_count': int,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CHBKK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	19932
Entropy (8bit):	4.627847416932105
Encrypted:	false
SSDEEP:	384:kXopNVQlGubdFJdioza0lpKJM+lgluQRd2q0ii2byTR36NHQPy7C40ZTe06NNfaD:WlpKJM+lgluQRd2q0ii2byTR38wPMPmr
MD5:	139D15A69B6D3004FEBE31877C28D8B4
SHA1:	644223FEBCA29CC4465077F2952E201038FE70D6
SHA-256:	A5BBB478E6B1B5EDBAA8599115C92B9AAADE3A9E5C05C8E3494C459E7DC59017
SHA-512:	62142C7F0F1F1A04DC365208CFEC51432216FA1D12FF69970BA5D542BC23EABCF4F54FFF4DF87C0F17FEC5BD67DD999F7113BAFF0B0C4E61807B1A9AB7240936
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import functools.import hashlib.import itertools.import json.import random.import re.import string..from .common import InfoExtractor.from ..compat import compat_struct_pack.from ..utils import (. determine_ext,. error_to_compat_str,. ExtractorError,. int_or_none,. mimetype2ext,. OnDemandPagedList,. parse_iso8601,. sanitized_Request,. str_to_int,. try_get,. unescapeHTML,. update_url_query,. url_or_none,. urlencode_postdata,.)...class DailymotionBaseInfoExtractor(InfoExtractor):. @staticmethod. def _build_request(url):. """Build a request with the family filter disabled""". request = sanitized_Request(url). request.add_header('Cookie', 'family_filter=off; ff=off'). return request.. def _download_webpage_handle_no_ff(self, url, args, *kwargs):. request = self._build_request(url). return self._download_webpage_handle(request,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CIMH0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	139727
Entropy (8bit):	4.300742067504036
Encrypted:	false
SSDEEP:	1536:O6OWbUW9gwMkZ6vuA02CZhj+aA4RQNp0HK4xpkbdcPzLxk3YhXk0qp3i5p27gb5c:OGMkAPO5zLxPeZ3gj+x40/217FEYel
MD5:	352CDE2CA047135DA71F286B62FD0FB8
SHA1:	5B1FD84DA7E2CA697CF9D648C19D54C0FD875822
SHA-256:	C18571AC532F93F4F300B871142C1A21092A593D873DB0DC22137C09D7E42571
SHA-512:	1B1FBE5CA821EDC15BFC852688DF3F0EFC9D537941B32998681C48727B72C3BE72C3666149751464B2C283AF3936352A6682D781BCFEAD682E48D5FECB45828A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import datetime.import hashlib.import json.import netrc.import os.import random.import re.import socket.import sys.import time.import math..from ..compat import (. compat_cookiejar,. compat_cookies,. compat_etree_Element,. compat_etree_fromstring,. compat_getpass,. compat_integer_types,. compat_http_client,. compat_os_name,. compat_str,. compat_urllib_error,. compat_urllib_parse_unquote,. compat_urllib_parse_urlencode,. compat_urllib_request,. compat_urlparse,. compat_xml_parse_error,.).from ..downloader.f4m import (. get_base_url,. remove_encrypted_media,.).from ..utils import (. NO_DEFAULT,. age_restricted,. base_url,. bug_reports_message,. clean_html,. compiled_regex_type,. determine_ext,. determine_protocol,. dict_get,. error_to_compat_str,. ExtractorError,. extract_attributes,. fix_xml_ampersands,. float_or_none,. Ge

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CISRF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2954
Entropy (8bit):	4.941630070325161
Encrypted:	false
SSDEEP:	48:+udbV7fWH6mXudgp4gQUvLjObXGXXfs4jxELXECMtfjXhkdVSwOHP6oEf3/p1YTv:5pjWamXudSfvLyzGnF0EBfavW6ok3/pK
MD5:	5567C9419A6BB4036403244B16BD2315
SHA1:	2A57A048489062BF1146D2B6A7033763F7E05285
SHA-256:	7C2BB25051BC17775195E899CE888B2C67198D470F0932A08AE9527620B104E1
SHA-512:	BD876EE81159F3A6783B5992426C5DACD6A3A019E738C9F1BBFE99787912E5F1D98FD7F76885C49115D2AD1F6821A8F6AA654EA2098F4C08323CCF539C3ACBA8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unescapeHTML,.)...class TVN24IE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:[^/]+)\.)?tvn24(?:bis)?\.pl/(?:[^/]+/)(?P<id>[^/]+)'. _TESTS = [{. 'url': 'http://www.tvn24.pl/wiadomosci-z-kraju,3/oredzie-artura-andrusa,702428.html',. 'md5': 'fbdec753d7bc29d96036808275f2130c',. 'info_dict': {. 'id': '1584444',. 'ext': 'mp4',. 'title': '".wi.ta maj. by. weso.e, dlatego, ludziska, wszyscy pod jemio.."',. 'description': 'Wyj.tkowe or.dzie Artura Andrusa, jednego z go.ci "Szk.a kontaktowego".',. 'thumbnail': 're:https?://.[.]jpeg',. }. }, {. 'url': 'http://fakty.tvn24.pl/ogladaj-online,60/53-konferencja-bezpieczenstwa-w-monachium,716431.html',. 'only_matching': True,. }, {. 'url': 'http://sport.tvn24.pl/pilka-nozna,105/ligue-1-kamil-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CJFP9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5029
Entropy (8bit):	4.639614033736345
Encrypted:	false
SSDEEP:	96:IOC2Yo8wHCYLHScURlHCEukPxokFfqtw5tirE3Gx4VmREXhpBTaNl0K896No:9C/oRiYOcWH/ZPikFqNrE3Gx4VmqXRTX
MD5:	0CEC442BE0FB36037CB0443F75B4BFC2
SHA1:	692921A0F6F67C464A33F6E7B09EB28D6389A081
SHA-256:	6FBD54290C7B47D1AEDC65BDF58E7A1DED96A895AC390B69590459384AFE1DE1
SHA-512:	722A8659C9B8CAFD1FFF55E54614EE26E3BE798BDF0EDC21DD35F115B3CF46A8DE54ABD4D9303AFB6FFD5C57271EF04BDA893996EE135F1AF0EA95D637244A46
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor..from ..utils import (. determine_ext,. float_or_none,. int_or_none,. parse_filesize,.)...class LibraryOfCongressIE(InfoExtractor):. IE_NAME = 'loc'. IE_DESC = 'Library of Congress'. _VALID_URL = r'https?://(?:www\.)?loc\.gov/(?:item/\|today/cyberlc/feature_wdesc\.php\?.*\brec=)(?P<id>[0-9a-z_.]+)'. _TESTS = [{. # embedded via <div class="media-player". 'url': 'http://loc.gov/item/90716351/',. 'md5': '6ec0ae8f07f86731b1b2ff70f046210a',. 'info_dict': {. 'id': '90716351',. 'ext': 'mp4',. 'title': "Pa's trip to Mars",. 'duration': 0,. 'view_count': int,. },. }, {. # webcast embedded via mediaObjectId. 'url': 'https://www.loc.gov/today/cyberlc/feature_wdesc.php?rec=5578',. 'info_dict': {. 'id': '5578',. 'ext': 'mp4',. 'tit

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CKE13.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4890
Entropy (8bit):	4.9209302197789215
Encrypted:	false
SSDEEP:	96:v+LU7aJuNsftlXluorpyNOefU0BcQtZUGmaKd97hBTZN64B2pTX3rS6NOyZQL/fU:GI7aINoXPrsNOk9lUGjKd97vTlB+26Nh
MD5:	55EA6E1C7C32215AE3554ED699207AC6
SHA1:	F008266CBD1ADD860ABA656414FEB4996CBF27A7
SHA-256:	98A78933198D7D9995E4B0586AD0E43AAB8BB3D20B7B3A9F2F90A966B92C91D6
SHA-512:	06EF292B1096FC4D0DF656EABDDA37809BA67EA2F4D046438273F9F24426D501BAE8BA350974281FB2585DEC332E07F2E585AB789FECE32F8E0D5DB401EE7F3E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. float_or_none,. ExtractorError,.)...class RedBullTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?redbull(?:\.tv\|\.com(?:/[^/]+)?(?:/tv)?)(?:/events/[^/]+)?/(?:videos?\|live)/(?P<id>AP-\w+)'. _TESTS = [{. # film. 'url': 'https://www.redbull.tv/video/AP-1Q6XCDTAN1W11',. 'md5': 'fb0445b98aa4394e504b413d98031d1f',. 'info_dict': {. 'id': 'AP-1Q6XCDTAN1W11',. 'ext': 'mp4',. 'title': 'ABC of... WRC - ABC of... S1E6',. 'description': 'md5:5c7ed8f4015c8492ecf64b6ab31e7d31',. 'duration': 1582.04,. },. }, {. # episode. 'url': 'https://www.redbull.tv/video/AP-1PMHKJFCW1W11',. 'info_dict': {. 'id': 'AP-1PMHKJFCW1W11',. 'ext': 'mp4',. 'title': 'Grime - Hashtags S2E4',. 'descri

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CLD4D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7959
Entropy (8bit):	4.814931539334507
Encrypted:	false
SSDEEP:	192:trF3U2HScIjv7kty0spdLnTYtOdkSa5n6N+Sy8evq9g:trF3U2Hjg7kFspdLnTYtOdkVn6N+a8d
MD5:	07830724633FDBD38190BB6D9B5077D3
SHA1:	5FF116E54E1CEF1174F5DDAC2C1B519F8078BB49
SHA-256:	B1D1D027ED9BCFEA8A9C4CC52908455F4C74FAD1DBA9ED5F6453776CAA4C9BC5
SHA-512:	2C77C116B2FE31E1307EB03883B0AD1D4E0F84FB95A669903C45E4E0C425D4E85AD8E25A310CA78C47ABEBABE2F530FC71EF98C9F44713ED3367CFDC94602192
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import math.import re..from .aws import AWSIE.from ..compat import compat_HTTPError.from ..utils import (. clean_html,. ExtractorError,. InAdvancePagedList,. int_or_none,. parse_iso8601,. str_or_none,. urlencode_postdata,.)...class ShahidBaseIE(AWSIE):. _AWS_PROXY_HOST = 'api2.shahid.net'. _AWS_API_KEY = '2RRtuMHx95aNI1Kvtn2rChEuwsCogUd4samGPjLh'.. def _handle_error(self, e):. fail_data = self._parse_json(. e.cause.read().decode('utf-8'), None, fatal=False). if fail_data:. faults = fail_data.get('faults', []). faults_message = ', '.join([clean_html(fault['userMessage']) for fault in faults if fault.get('userMessage')]). if faults_message:. raise ExtractorError(faults_message, expected=True).. def _call_api(self, path, video_id, request=None):. query = {}. if request:. query['request'] = js

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-COS1K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.81363673244651
Encrypted:	false
SSDEEP:	96:+sFQQMSgXIYCZ8whTYAfAKjaZ2dKbOQQ2s2s9CxLZWVJNUItN8As6Ng:+sCv5whTYWAKju49CxlHZ6Ng
MD5:	07A052A16A0869703DC4DF31FE060B82
SHA1:	FD8F38B3130E0DAE98957F753147CB0BAE90D6D6
SHA-256:	DE52344122BF6E3ED27017C5D8959D451584982E5E6254A9ED64070BC5E03699
SHA-512:	6BF34A669232FA3E7C7716E12B4697C2A88B6EABABC15420ABC6D8AB416E64B1525905A765311566247105CAAEC84F4CEAACA25DC66C1282F4F37D69122CBE4E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_iso8601,. int_or_none,. xpath_attr,. xpath_element,.)...class TwentyFourVideoIE(InfoExtractor):. IE_NAME = '24video'. _VALID_URL = r'''(?x). https?://. (?P<host>. (?:(?:www\|porno)\.)?24video\.. (?:net\|me\|xxx\|sexy?\|tube\|adult\|site). )/. (?:. video/(?:(?:view\|xml)/)?\|. player/new24_play\.swf\?id=. ). (?P<id>\d+). '''.. _TESTS = [{. 'url': 'http://www.24video.net/video/view/1044982',. 'md5': 'e09fc0901d9eaeedac872f154931deeb',. 'info_dict': {. 'id': '1044982',. 'ext': 'mp4',. 'title': '....... ......... ....',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CPE77.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2279
Entropy (8bit):	4.899855277647735
Encrypted:	false
SSDEEP:	48:+u8ZQPyPX7/RtkwFzFApWtfjXhktuX3mY35K+9N8m:gOPyPL/RtkwFzFAp0faymYw+9Cm
MD5:	E167D62809B38BA7AB2232836C84D0B2
SHA1:	9482D63D2D618E0DC66E410667267967FD81E82E
SHA-256:	D145458C70EC7AC4A666D6D056FBA44E298959A21CACA217133447D4A2E5FFC4
SHA-512:	4DAE777F79581B209140C5BEC0F5B464512BAC210BEC7551D2A22E3A5096B2E280EE041CFBAC9D2617AE1A815B2B7449D332B6743B56A19FCDE3D42510432DE7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. js_to_json,. smuggle_url,.)...class LA7IE(InfoExtractor):. IE_NAME = 'la7.it'. _VALID_URL = r'''(?x)(https?://)?(?:. (?:www\.)?la7\.it/([^/]+)/(?:rivedila7\|video)/\|. tg\.la7\.it/repliche-tgla7\?id=. )(?P<id>.+)'''.. _TESTS = [{. # 'src' is a plain URL. 'url': 'http://www.la7.it/crozza/video/inccool8-02-10-2015-163722',. 'md5': '8b613ffc0c4bf9b9e377169fc19c214c',. 'info_dict': {. 'id': 'inccool8-02-10-2015-163722',. 'ext': 'mp4',. 'title': 'Inc.Cool8',. 'description': 'Benvenuti nell\'incredibile mondo della INC. COOL. 8. dove .INC.. sta per .Incorporated. .COOL. sta per .fashion. ed Eight sta per il gesto atletico',. 'thumbnail': 're:^https?://.*',. 'uploader_id': 'kdla7pillole@iltrovatore.it',. 'timestamp': 1443814869,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CQ4RT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3226
Entropy (8bit):	4.8824676192408285
Encrypted:	false
SSDEEP:	48:+uJoBXfC0/s/n+xvgZ3tfJoXjlhpBofrBzAFqG7/3BHeu3iftE6iBTixBfoipRzF:eNi/n+xvK9fJswqFdw3iBTwywRHN6Ng
MD5:	DCDC0543DDD500633D5A9750AC0C4967
SHA1:	46E5482DAD006CAB547AF82295FFAD8D39FA8F06
SHA-256:	965111CCA838495549951C38E1A12BE66BD33D6139CFB1C701E4583B185C5CE1
SHA-512:	C2D6677E1D01356DC0649816DA77E4AB4A2BB9FFC1E9138C9402D5F0641983FAB9A2AA96852729D48800E4F4E5930CD3BB25897452054DF4BA24E0559714E7BF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. get_element_by_attribute,. qualities,. unescapeHTML,.)...class OraTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:ora\.tv\|unsafespeech\.com)/([^/]+/)*(?P<id>[^/\?#]+)'. _TESTS = [{. 'url': 'https://www.ora.tv/larrykingnow/2015/12/16/vine-youtube-stars-zach-king-king-bach-on-their-viral-videos-0_36jupg6090pq',. 'md5': 'fa33717591c631ec93b04b0e330df786',. 'info_dict': {. 'id': '50178',. 'ext': 'mp4',. 'title': 'Vine & YouTube Stars Zach King & King Bach On Their Viral Videos!',. 'description': 'md5:ebbc5b1424dd5dba7be7538148287ac1',. }. }, {. 'url': 'http://www.unsafespeech.com/video/2016/5/10/student-self-censorship-and-the-thought-police-on-university-campuses-0_6622bnkppw4d',. 'only_matching': True,. }].. de

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CSUCD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4890
Entropy (8bit):	4.48978094849312
Encrypted:	false
SSDEEP:	96:U3OW6uo/HTz2SXwUvtnQdtvtiK+Vuz1GOSz2qfKfEwchoYZ3WBTf26NOTgRBO9q:g76f2ZUvKvsVuzEO2KcRhhRyTf26NOa
MD5:	CE11784F56C2223A0046541D5AEB7F96
SHA1:	ACBFC653EB0278B0FD6ED1DB02A2AEA48369BF30
SHA-256:	509B1C10CDF870155FF1FD1EB59527DFE7FC163B1EC4EAC2537DB8A2C07854A6
SHA-512:	CA2572B20DDED68FD1F4BAB824C516EEA297EE0376AEF7DE4A98EB9BF23A143594F8A0564D038A95746CA4E5ADC8A17AC82A14088FA207A5091BB7B3DB7835BD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. float_or_none,. int_or_none,.)...class ViddlerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?viddler\.com/(?:v\|embed\|player)/(?P<id>[a-z0-9]+)(?:.+?\bsecret=(\d+))?'. _TESTS = [{. 'url': 'http://www.viddler.com/v/43903784',. 'md5': '9eee21161d2c7f5b39690c3e325fab2f',. 'info_dict': {. 'id': '43903784',. 'ext': 'mov',. 'title': 'Video Made Easy',. 'description': 'md5:6a697ebd844ff3093bd2e82c37b409cd',. 'uploader': 'viddler',. 'timestamp': 1335371429,. 'upload_date': '20120425',. 'duration': 100.89,. 'thumbnail': r're:^https?://.*\.jpg$',. 'view_count': int,. 'comment_count': int,. 'categories': ['video content', 'high quality video', 'video made easy', 'how to produce video with limited resources', 'viddler'],.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CU6QL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.562360585691066
Encrypted:	false
SSDEEP:	48:PuRWIO61OAqZM6xYfRoAXFwMNs0p62XjtuSyDB3GK4Xa5vQaWSm:g1OfAqZDYfnXFwMudG/xym
MD5:	86C081A4FA5ABED7952B482C7E3C714E
SHA1:	A776968DAC0577F12AA7FD0843ED64DA964194AF
SHA-256:	9CAB6AA43ACB3DC88C47B22403051891045675ECFAF1F8087A4FD5FBCA12C225
SHA-512:	88AE762C64BF6A29BA7D224AC4CD2FF8763D8B75B1663CCAA4E3A3503CF4E2342C6379EA1B032253DC7F9568728A7FF147ED143CF0C7253F42BFE1D0D5CD830E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,.)...class ServingSysIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^.]+\.)?serving-sys\.com/BurstingPipe/adServer\.bs\?.*?&pli=(?P<id>[0-9]+)'.. _TEST = {. 'url': 'http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=is&c=23&pl=VAST&pli=5349193&PluID=0&pos=7135&ord=[timestamp]&cim=1?',. 'info_dict': {. 'id': '5349193',. 'title': 'AdAPPter_Hyundai_demo',. },. 'playlist': [{. 'md5': 'baed851342df6846eb8677a60a011a0f',. 'info_dict': {. 'id': '29955898',. 'ext': 'flv',. 'title': 'AdAPPter_Hyundai_demo (1)',. 'duration': 74,. 'tbr': 1378,. 'width': 640,. 'height': 400,. },. }, {. 'md5': '979b4da2655c4bc2d81aeb915a8c5014',. 'info_dict': {. 'id'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CU7PP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3647
Entropy (8bit):	5.506941526037366
Encrypted:	false
SSDEEP:	96:MT28hE9wQGm6R3GLXbosjzLcZZXBSpgtfVO/12VHtI:S2+ThmA3LsXLbuNox
MD5:	5DDD67CBC03BD7AEDA764F769354F3B8
SHA1:	EF2D73AA1B2550B113A43729DB4D0D85DD352D1C
SHA-256:	AA3FEE736E38D4A61348990E88E8EC08214290D368E8925982FDE672CFE49AEE
SHA-512:	A71DF72717DE6B3327FE1FF689B1B2B5FCB2D99F214F1BE5D1AFDBE7278EE67C73D885D9CEB5FDA27F114633F0B16CD0EF8335F37776EB19F5B21A9A981E1798
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import unified_timestamp.from .youtube import YoutubeIE..class CtsNewsIE(InfoExtractor):. IE_DESC = '....'. _VALID_URL = r'https?://news\.cts\.com\.tw/[a-z]+/[a-z]+/\d+/(?P<id>\d+)\.html'. _TESTS = [{. 'url': 'http://news.cts.com.tw/cts/international/201501/201501291578109.html',. 'md5': 'a9875cb790252b08431186d741beaabe',. 'info_dict': {. 'id': '201501291578109',. 'ext': 'mp4',. 'title': '......... 3... - .....',. 'description': '.......................................................................................................',. 'timestamp': 1422528540,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-CVLE9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2298
Entropy (8bit):	4.72583545428019
Encrypted:	false
SSDEEP:	48:+uzPVF6nNXBSqjXNERBb/jRjTg0GxUDyDlq64RSYyo7D4zoAtN0T6Ng:PT6nNXBSqJET/RFGxU+h3hYyo7ErtN0f
MD5:	3D29F24AC39A96616775D3E56EB422FC
SHA1:	8596DD92D216ED48BCF3A5930E99A9A93F013E21
SHA-256:	B68F1AA29A34AAD4F06C0DC8EB12C3AFA16890C7829B0C7AB84006525BDB6B31
SHA-512:	B015B2FD22AACC2FF8A9968B0DB35BB398B7E80AFF674AAB14A778500DCDFCEAC4459A487D4208D20A51FB1222758E8C744C7F94ABC42E21928B45E09D4B3135
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. unified_strdate,. update_url_query,. urlencode_postdata,.)...class MediciIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?medici\.tv/#!/(?P<id>[^?#&]+)'. _TEST = {. 'url': 'http://www.medici.tv/#!/daniel-harding-frans-helmerson-verbier-festival-music-camp',. 'md5': '004c21bb0a57248085b6ff3fec72719d',. 'info_dict': {. 'id': '3059',. 'ext': 'flv',. 'title': 'Daniel Harding conducts the Verbier Festival Music Camp \u2013 With Frans Helmerson',. 'description': 'md5:322a1e952bafb725174fd8c1a8212f58',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20170408',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. # Sets csrftoken cookie. self._download_webpage(url, video_id).. MEDICI_URL = 'http://www.medici

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D09MU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2095
Entropy (8bit):	5.069034743714979
Encrypted:	false
SSDEEP:	48:+uiiZZfR+vLxakZvRktfJoXhgll+qBmup6tbS2kyuemjz8vI:Gi7KxakZvsfJ3wucVLAeBg
MD5:	B0D7A954BCBDE2B1883DC367FDFD8CA2
SHA1:	39685ADF150889CD4CED642D2C9009E86CFF391B
SHA-256:	C7537389BB0768DBE6DE0F6D988C61610245DD4455554580C3DB9F88C3980456
SHA-512:	5E8E69A603B9E9A544591C49BD3D8F0BCFF8D7D54E085A429F83F1FBDEDA54C3611E2F7DA75EC606EF0BABC8A843DFA9E6D9E6491572E0F75FCE82F0FB722FA2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import merge_dicts...class MallTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mall\.tv/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.mall.tv/18-miliard-pro-neziskovky-opravdu-jsou-sportovci-nebo-clovek-v-tisni-pijavice',. 'md5': '1c4a37f080e1f3023103a7b43458e518',. 'info_dict': {. 'id': 't0zzt0',. 'display_id': '18-miliard-pro-neziskovky-opravdu-jsou-sportovci-nebo-clovek-v-tisni-pijavice',. 'ext': 'mp4',. 'title': '18 miliard pro neziskovky. Opravdu jsou sportovci nebo .lov.k v t.sni pijavice?',. 'description': 'md5:25fc0ec42a72ba602b602c683fa29deb',. 'duration': 216,. 'timestamp': 1538870400,. 'upload_date': '20181007',. 'view_count': int,. }. }, {. 'url': 'https://www.mall.tv/kdo-to-plati/18-miliard-p

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D0JV7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	5.353135592160199
Encrypted:	false
SSDEEP:	48:+u8SPWpfqROrcrD1vi/+5JoXjlhHwnL9j946LsbmiLFRRQJE:gHpftwrVp5JsmL9jK6LstLhQJE
MD5:	9056D5EEB9406400D1F9055770B7A7D7
SHA1:	CB531C51FA5511B265F370B937042CA63B8B60DA
SHA-256:	CDAAFF7CFC7D5B2D5F5874B663A7E11E692E989F06E70ACEFBD89B31192ACD82
SHA-512:	85A49FC57ADA9EE097D47700E436E87365D84C4CF4B22A0F3176B926F9ECC9B8EE7619B1CD35CFBC0232F256AB17267960862D1A932B0508B001D62A14E62C53
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. js_to_json,. smuggle_url,.)...class NTVCoJpCUIE(InfoExtractor):. IE_NAME = 'cu.ntv.co.jp'. IE_DESC = 'Nippon Television Network'. _VALID_URL = r'https?://cu\.ntv\.co\.jp/(?!program)(?P<id>[^/?&#]+)'. _TEST = {. 'url': 'https://cu.ntv.co.jp/televiva-chill-gohan_181031/',. 'info_dict': {. 'id': '5978891207001',. 'ext': 'mp4',. 'title': '............. .... ....................',. 'upload_date': '20181213',. 'description': 'md5:211b52f4fd60f3e0e72b68b0c6ba52a9',. 'uploader_id': '3855502814001',. 'timestamp': 1544669941,. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/%s/defaul

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D0U70.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1512
Entropy (8bit):	5.100847868720758
Encrypted:	false
SSDEEP:	24:zi8lzvQK33J3yCfwRu7AC/+lnHSEV20ZtHPdxMotBKctVL1JlKcyRVVbneIXjfE5:+uMK33ByCfEY8yEV2Yvdxht8c3/ocyBe
MD5:	9E6BFF8C0F1EC133D569B4C352F2B54E
SHA1:	33243F6DE7579380520883051E15F2938AFACAD3
SHA-256:	10310D86CC5D43C4A2CE552F4F57A8EC19716C65921B3E2D5AE84D48A51F5B92
SHA-512:	39053BA9679C2E3640606AC8D5647910F8BD75947794BC98C6AAE528428C88756E2AC5626E5D7AB3CF689B7C5CC3677A2C5BCA5B206A6D7D28FDB459AC9D3C6F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class JWPlatformIE(InfoExtractor):. _VALID_URL = r'(?:https?://(?:content\.jwplatform\|cdn\.jwplayer)\.com/(?:(?:feed\|player\|thumb\|preview\|video)s\|jw6\|v2/media)/\|jwplatform:)(?P<id>[a-zA-Z0-9]{8})'. _TESTS = [{. 'url': 'http://content.jwplatform.com/players/nPripu9l-ALJ3XQCI.js',. 'md5': 'fa8899fa601eb7c83a64e9d568bdf325',. 'info_dict': {. 'id': 'nPripu9l',. 'ext': 'mov',. 'title': 'Big Buck Bunny Trailer',. 'description': 'Big Buck Bunny is a short animated film by the Blender Institute. It is made using free and open source software.',. 'upload_date': '20081127',. 'timestamp': 1227796140,. }. }, {. 'url': 'https://cdn.jwplayer.com/players/nPripu9l-ALJ3XQCI.js',. 'only_matching': True,. }].. @staticmethod. def _extract_url(webpage):. urls = JWPlatformIE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D1P7F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4825
Entropy (8bit):	4.603200812853087
Encrypted:	false
SSDEEP:	96:GEMS6aHivZshFpGaJ6N1NqdNqoaiOtn5XEi3n94nAoXA3ac81rqK:qSvHiv+7pGaJ6NDyOsit4A2s+
MD5:	102BC45D2D4ADE6445CCEC256C3AEB73
SHA1:	F5A708C9B70B69B13E93D4FFD9DBCE2BA68BCCBB
SHA-256:	6BCCF4D14233B90D5ABD2B9DBFDE87FECCE4AE1F12D12BAE571CCD090C1EB5AA
SHA-512:	B53BABA73C532763EA269E2C54B933481E4160EF41783DAF32A02A44846D878CB1B9C2761CA712881C390B700E2A39411BA284E824BB9CA7F220684159DD0759
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. update_url_query,.)...class ZingMp3BaseInfoExtractor(InfoExtractor):.. def _extract_item(self, item, page_type, fatal=True):. error_message = item.get('msg'). if error_message:. if not fatal:. return. raise ExtractorError(. '%s returned error: %s' % (self.IE_NAME, error_message),. expected=True).. formats = []. for quality, source_url in zip(item.get('qualities') or item.get('quality', []), item.get('source_list') or item.get('source', [])):. if not source_url or source_url == 'require vip':. continue. if not re.match(r'https?://', source_url):. source_url = '//' + source_url. source_url = self._proto_relative_url(source_url, 'http:'). quality_num = int_o

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D346C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	5.0008639249047535
Encrypted:	false
SSDEEP:	48:PuXo1fZeCjENXEQjgpDBSXefOZXh0C/BlXCwHLQBYPX4Ux0EKqQ8c4bdB:aoN5ENXEQjgZsXefO0CjCULjN3Kz8hxB
MD5:	E7B5A63FD2FC0E073E90D2A76AF42B9F
SHA1:	6AC8BB61DD3910FAD6F85C7262E61005C558840A
SHA-256:	3823C434310D2D343AE64FE02DBC096561B23BC66F0AC7CB995FF4E3B11DD4E1
SHA-512:	94FDC6524BDA070A8410F32A1324B93F1975595DB84CDAE4D56FDFE7AA105B6FA4E7D7F1B77058D374F2C51995CF54D9B259594F65589AAE4D9D287012BBC27F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import parse_duration...class DHMIE(InfoExtractor):. IE_DESC = 'Filmarchiv - Deutsches Historisches Museum'. _VALID_URL = r'https?://(?:www\.)?dhm\.de/filmarchiv/(?:[^/]+/)+(?P<id>[^/]+)'.. _TESTS = [{. 'url': 'http://www.dhm.de/filmarchiv/die-filme/the-marshallplan-at-work-in-west-germany/',. 'md5': '11c475f670209bf6acca0b2b7ef51827',. 'info_dict': {. 'id': 'the-marshallplan-at-work-in-west-germany',. 'ext': 'flv',. 'title': 'MARSHALL PLAN AT WORK IN WESTERN GERMANY, THE',. 'description': 'md5:1fabd480c153f97b07add61c44407c82',. 'duration': 660,. 'thumbnail': r're:^https?://.*\.jpg$',. },. }, {. 'url': 'http://www.dhm.de/filmarchiv/02-mapping-the-wall/peter-g/rolle-1/',. 'md5': '09890226332476a3e3f6f2cb74734aa5',. 'info_dict': {. 'id': 'rolle-1',. 'ext

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D3SOU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2889
Entropy (8bit):	4.6952349775236435
Encrypted:	false
SSDEEP:	48:+uvWOTgfg/HT5r/TbDXZtfjXhkzthXm/VpVbxCOWXLOr3ka+8y5FWVdBTeeVnTfW:KOTCg/HTR/T3HfaJAVCzXLOr3DUFIBTm
MD5:	C3ED59AD7713AA7E99571D79E955F8D1
SHA1:	E08834878ECCB8E2722041EEE66572E40893D03F
SHA-256:	F86727D6355CC96E6D39F1D16666345B9A33272C07F5E00F2C32A5CA41ACA12F
SHA-512:	8ABE473B456B0D8B4BDDF33BCA3986DED112C31E6D3970AB5F2FEB38AFDD494A1A498BCEBA2F165C64754DE00D5849CAF699E38933F3FB586D5E6B6CFB2391FB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. NO_DEFAULT,. str_to_int,.)...class XNXXIE(InfoExtractor):. _VALID_URL = r'https?://(?:video\|www)\.xnxx\.com/video-?(?P<id>[0-9a-z]+)/'. _TESTS = [{. 'url': 'http://www.xnxx.com/video-55awb78/skyrim_test_video',. 'md5': '7583e96c15c0f21e9da3453d9920fbba',. 'info_dict': {. 'id': '55awb78',. 'ext': 'mp4',. 'title': 'Skyrim Test Video',. 'thumbnail': r're:^https?://.*\.jpg',. 'duration': 469,. 'view_count': int,. 'age_limit': 18,. },. }, {. 'url': 'http://video.xnxx.com/video1135332/lida_naked_funny_actress_5_',. 'only_matching': True,. }, {. 'url': 'http://www.xnxx.com/video-55awb78/',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_i

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D711J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	21015
Entropy (8bit):	4.705784374502431
Encrypted:	false
SSDEEP:	384:nYG/t85/ZxRplvOqJVBVDL6DoldGhT3cwwBB6NXgIHBm5S7KwI54sdXc/xCS8+eq:5qJ5DLKoldGhT3OBB8XgIz
MD5:	F301BC356694C877EEC49A36C94FDEBE
SHA1:	4764A6B4358C068F3261FD0E9CBBB3DE7E6C086F
SHA-256:	77280DB1FB98DC617E4127C4ABE6EFC8143A6F4AEB8876A8199B24B561D309F1
SHA-512:	EA401F731A0972E7F12A1B9B2865063260BFD391F8398770B85E858F22A43B7A09F4079AB1D104DDAE56E5EE0712DBAD9C9137D6DC38D61703227D8DAFBC40AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import functools.import itertools.import operator.import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,. compat_urllib_request,.).from .openload import PhantomJSwrapper.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. orderedSet,. remove_quotes,. str_to_int,. url_or_none,.)...class PornHubBaseIE(InfoExtractor):. def _download_webpage_handle(self, args, kwargs):. def dl(args, *kwargs):. return super(PornHubBaseIE, self)._download_webpage_handle(args, *kwargs).. webpage, urlh = dl(args, *kwargs).. if any(re.search(p, webpage) for p in (. r'<body\b[^>]+\bonload=["\']go',. r'document\.cookie\s=\s*["\']RNKEY=',. r'document\.location\.reload$true$')):. url_or_request = args[0]. url = (url_or_request.get_full_url().

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D7F1A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2204
Entropy (8bit):	4.714492929423355
Encrypted:	false
SSDEEP:	48:+udWxtYEYzMXDwD7bClkk8ajXjlkdXYgMp57uM4Lc0LxPGkQXlBTg6Nnx:kvYEYzMTwDHCak8aqLkzJCPGvVBTg6Nx
MD5:	CA34293A1EBC6157639561FD7ECA407C
SHA1:	EB2F93194CDAEFC3FB10D6DD2CB5186493CFA4E9
SHA-256:	D9BF6EB363618406659CFD2AAEBEACDBE0DF75F296C76F0030D1858FBA751499
SHA-512:	242EF22A8BCEB9AC4C2FD9966B0BE3C96E6E86AD39BC635105B292AC215149B8D5D9C73F27B0E0D7A1F3C1E25F9E845D099E00CE1E5D4CED032F044C94D7FED0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. js_to_json,. determine_ext,.)...class BpbIE(InfoExtractor):. IE_DESC = 'Bundeszentrale f.r politische Bildung'. _VALID_URL = r'https?://(?:www\.)?bpb\.de/mediathek/(?P<id>[0-9]+)/'.. _TEST = {. 'url': 'http://www.bpb.de/mediathek/297/joachim-gauck-zu-1989-und-die-erinnerung-an-die-ddr',. # md5 fails in Python 2.6 due to buggy server response and wrong handling of urllib2. 'md5': 'c4f84c8a8044ca9ff68bb8441d300b3f',. 'info_dict': {. 'id': '297',. 'ext': 'mp4',. 'title': 'Joachim Gauck zu 1989 und die Erinnerung an die DDR',. 'description': 'Joachim Gauck, erster Beauftragter f.r die Stasi-Unterlagen, spricht auf dem Geschichtsforum .ber die friedliche Revolution 1989 und eine "gewisse Traurigkeit" im Umgang mit der DDR-Vergangenheit.'. }. }.. def _real_extract(sel

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D7P8E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3010
Entropy (8bit):	4.555825916161983
Encrypted:	false
SSDEEP:	48:+uEWOPGJP7fVdCGsWr/v3Pt8cyJYn0gnjXBAiBwEYArtkhZCz6xYbMViBTWDqxi1:rO+PjVdzsWr/v3V8cyx2lAPEYAhkhs6j
MD5:	C3D0F49A68969DAB0214425381926535
SHA1:	9584FB37708CB5C582A1E11500A8E56CA04CBBBD
SHA-256:	7C51305C563639E97A690832ECC42FB370E4B0DE08B730D1F7698FDDE65EAD4D
SHA-512:	F34DE75D701B6DAB09D4D8CE9BB9B9F84B26240BD84A594FB2EF7BCE452777B7CB1CE30455EB944E8BFBB3A5C1C4A98DD5C3D4CCA4C61B18264937BCF988F6E2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. float_or_none,. parse_age_limit,. qualities,. random_birthday,. try_get,. unified_timestamp,. urljoin,.)...class VideoPressIE(InfoExtractor):. _VALID_URL = r'https?://videopress\.com/embed/(?P<id>[\da-zA-Z]+)'. _TESTS = [{. 'url': 'https://videopress.com/embed/kUJmAcSf',. 'md5': '706956a6c875873d51010921310e4bc6',. 'info_dict': {. 'id': 'kUJmAcSf',. 'ext': 'mp4',. 'title': 'VideoPress Demo',. 'thumbnail': r're:^https?://.\.jpg',. 'duration': 634.6,. 'timestamp': 1434983935,. 'upload_date': '20150622',. 'age_limit': 0,. },. }, {. # 17+, requires birth_ params. 'url': 'https://videopress.com/embed/iH3gstfZ',. 'only_matching': True,. }].. @stat

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D916M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4018
Entropy (8bit):	4.82458745729241
Encrypted:	false
SSDEEP:	96:jQj1wQqeJ4pELWNTXj3er1eoteLqePM4kcTfdxDxnT5/JDbDeRHrNZXjFo7DUmBo:EjGT0IrV41htfpUT9V/hbD25A7DNBno
MD5:	797E38FB12D387C650519BAC667B102C
SHA1:	C729B8751FB6F68F40E51CD12B32B13F6ABEC3A0
SHA-256:	B22BBFEE5F62AE966B2670DDB2EA134274B3550E2F8F4DB5A32B5A50E9F31724
SHA-512:	EBA228F3B36BCE0C3C69E9ABA13A57104F463793F5A447A94D4D4BA306DD343B444693715F0A38AAA5B5E4B69E4E2BBF2D18E216C6DB9EF0D7178E8ACE26B08E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .vimple import SprutoBaseIE...class MyviIE(SprutoBaseIE):. _VALID_URL = r'''(?x). (?:. https?://. (?:www\.)?. myvi\.. (?:. (?:ru/player\|tv)/. (?:. (?:. embed/html\|. flash\|. api/Video/Get. )/\|. content/preloader\.swf\?.*\bid=. )\|. ru/watch/. )\|. myvi:. ). (?

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-D9JO5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3092
Entropy (8bit):	4.860581964222115
Encrypted:	false
SSDEEP:	48:+u47XOZOINFQSpO54ptsrEzkp4HImABu4tN5mZW+RGepiaH1xxca:UXOZrNWSW30Xl/Bca
MD5:	35F51FA40DEDEE0C19DB271155E6FAC3
SHA1:	028E95C01FEACFBED775E34AC44F15E07D92DFCF
SHA-256:	8DC0A2C265DB0DDA6FDDCEDE2CDD4394EB62C2745A1752319EEB75590C8F8FA2
SHA-512:	DBE365A2B4EB3BBDAE36991EBA4D18577BB4C6382F8741739837D55A43D33EE19AA47DCACC9C7224B299C2F1FEC1AE5F0385051E4AF0426DAD88B2A1AC1D9AE5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import datetime.import hashlib.import hmac..from .common import InfoExtractor.from ..compat import compat_urllib_parse_urlencode...class AWSIE(InfoExtractor):. _AWS_ALGORITHM = 'AWS4-HMAC-SHA256'. _AWS_REGION = 'us-east-1'.. def _aws_execute_api(self, aws_dict, video_id, query=None):. query = query or {}. amz_date = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%SZ'). date = amz_date[:8]. headers = {. 'Accept': 'application/json',. 'Host': self._AWS_PROXY_HOST,. 'X-Amz-Date': amz_date,. 'X-Api-Key': self._AWS_API_KEY. }. session_token = aws_dict.get('session_token'). if session_token:. headers['X-Amz-Security-Token'] = session_token.. def aws_hash(s):. return hashlib.sha256(s.encode('utf-8')).hexdigest().. # Task 1: http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.h

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DAO54.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4782
Entropy (8bit):	4.6898175209545565
Encrypted:	false
SSDEEP:	96:ZOTwQriAn0zoo5X5Rqkafspnj992bqPpCId8tjoqc:WwQhnG5XivspnjXDPPHqc
MD5:	D46B549113CAB808F02929B67451B102
SHA1:	254A14E6A34976D5A9575BF2EF03E564C54262E4
SHA-256:	BAA9DB720C6D723E70EE9D4D5F1E4FA36AE50A5514606BB00035E7520ACFB2AE
SHA-512:	92B05051AC2D84B61F03E32359AC697E755F81A3B4E75CDFDA5D09423DD0152E14BE7C4C4B9E3397A0913D563FCD9226220A20CE5C72E5BBC63F8A9D0C459029
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. sanitized_Request,. urlencode_postdata,.)...class BambuserIE(InfoExtractor):. IE_NAME = 'bambuser'. _VALID_URL = r'https?://bambuser\.com/v/(?P<id>\d+)'. _API_KEY = '005f64509e19a868399060af746a00aa'. _LOGIN_URL = 'https://bambuser.com/user'. _NETRC_MACHINE = 'bambuser'.. _TEST = {. 'url': 'http://bambuser.com/v/4050584',. # MD5 seems to be flaky, see https://travis-ci.org/ytdl-org/youtube-dl/jobs/14051016#L388. # 'md5': 'fba8f7693e48fd4e8641b3fd5539a641',. 'info_dict': {. 'id': '4050584',. 'ext': 'flv',. 'title': 'Education engineering days - lightning talks',. 'duration': 3741,. 'uploader': 'pixelversity',. 'uploader_id': '344706',. 'timestamp': 1

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DB3OR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4208
Entropy (8bit):	4.687140208425004
Encrypted:	false
SSDEEP:	96:JOc7AXTdvlroZcHBTr6NztQrSN7xdX9rjagS1hHDraS6SezaJkfX9IBo/ird:JOuYTdvlroZchTr6NRQrSZ9fS1hHHaSn
MD5:	14C57918DCD8A5A78255FB9EE7C0E7A0
SHA1:	3DA18BB760BA048ECE6C959E9D3C81AC19205602
SHA-256:	1198B2E9807C1E0A576737BAE2D40B5AB7E8D633F80BA31EE177AF50013020CD
SHA-512:	EE7AAFD5B57D20FDD973341CD755939B6867835EA40C870774634BD90EEC17386D33BAE47278D8CED2FFF53B2CA4766F2891EF85CD2355EA07F748217D9DE1C9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. url_or_none,.)...class RedditIE(InfoExtractor):. _VALID_URL = r'https?://v\.redd\.it/(?P<id>[^/?#&]+)'. _TEST = {. # from https://www.reddit.com/r/videos/comments/6rrwyj/that_small_heart_attack/. 'url': 'https://v.redd.it/zv89llsvexdz',. 'md5': '0a070c53eba7ec4534d95a5a1259e253',. 'info_dict': {. 'id': 'zv89llsvexdz',. 'ext': 'mp4',. 'title': 'zv89llsvexdz',. },. 'params': {. 'format': 'bestvideo',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. formats = self._extract_m3u8_formats(. 'https://v.redd.it/%s/HLSPlaylist.m3u8' % video_id, video_id,. 'mp4', entry_protocol='m3u8_native', m3u8_id='hls', fatal=False).. formats.extend(self._extract_mpd_formats

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DC40O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1804
Entropy (8bit):	4.876544125779296
Encrypted:	false
SSDEEP:	48:+uuNKtg+h5s2KfYmlpyqAvKNfJoXjlhbXU5BwXL+EU:yNKtgwG/ffoqAvK5Jsf7+EU
MD5:	770887E4DA030BC98945A533362DA9BB
SHA1:	194897261E9BB5D79CD9979DAA904C3E06982C80
SHA-256:	E40D09CAB6DCD3143F17A423BA14DD73CC8B2BF4546F9C65D724969D1F4AE1CA
SHA-512:	482730B352030D130CC5C35D658D879EDFB9E944431C07121F8E1EF902581865679750F788A8941F31470D0244E6FBE682E9437E3CB13E4CF0C4A5C05329222B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urlparse,.)...class MotorsportIE(InfoExtractor):. IE_DESC = 'motorsport.com'. _VALID_URL = r'https?://(?:www\.)?motorsport\.com/[^/?#]+/video/(?:[^/?#]+/)(?P<id>[^/]+)/?(?:$\|[?#])'. _TEST = {. 'url': 'http://www.motorsport.com/f1/video/main-gallery/red-bull-racing-2014-rules-explained/',. 'info_dict': {. 'id': '2-T3WuR-KMM',. 'ext': 'mp4',. 'title': 'Red Bull Racing: 2014 Rules Explained',. 'duration': 208,. 'description': 'A new clip from Red Bull sees Daniel Ricciardo and Sebastian Vettel explain the 2014 Formula One regulations . which are arguably the most complex the sport has ever seen.',. 'uploader': 'mcomstaff',. 'uploader_id': 'UC334JIYKkVnyFoNCclfZtHQ',. 'upload_date': '20140903',. 'thumbnail': r're:^https?://.+\.jpg$'. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DCG0I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7625
Entropy (8bit):	4.249829535666477
Encrypted:	false
SSDEEP:	192:6RU2bdMjFPcvrD/Ygw4BbOb3qTobasbvOTbg1VbZ6N0:6yIdyoggw4VObaTobasbvOTE1V96N0
MD5:	F1647AD4AD0DD4BA3CBB10344C58BFEB
SHA1:	ADC07DD72046466C2D2E4211C042DBE70731E87E
SHA-256:	5EDDF5C5CB398FD4A12E78FB49C900B38A186E225D145BCC6985B0487EE78C7E
SHA-512:	1AA0FF8D9F4D90C1E06F88F46C0699839EE0FCABB89DFE15877C16851F8C26AA6AF8CEE3FAB2804F70FC8723E2538FFAC3A006E6E74BD850467D44DEC44A51DF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals, division..import hashlib.import hmac.import re.import time..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. parse_age_limit,. parse_duration,. url_or_none,. ExtractorError.)...class CrackleIE(InfoExtractor):. _VALID_URL = r'(?:crackle:\|https?://(?:(?:www\|m)\.)?(?:sony)?crackle\.com/(?:playlist/\d+/\|(?:[^/]+/)+))(?P<id>\d+)'. _TESTS = [{. # geo restricted to CA. 'url': 'https://www.crackle.com/andromeda/2502343',. 'info_dict': {. 'id': '2502343',. 'ext': 'mp4',. 'title': 'Under The Night',. 'description': 'md5:d2b8ca816579ae8a7bf28bfff8cefc8a',. 'duration': 2583,. 'view_count': int,. 'average_rating': 0,. 'age_limit': 14,. 'genre': 'Action, Sci-Fi',. 'creator': 'Allan Kroeker',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DGCGF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	21388
Entropy (8bit):	4.531477239810912
Encrypted:	false
SSDEEP:	384:FE5uSoNObHHaixOCoS8ctXu6XzTy6NQfVw3U2iwAY/gkWmEq7FBwKtRBWIAnl8Le:FE5uSoNObH6ixOCoSZe6DTy8H9JRYQoj
MD5:	B901F2937FD6B5A9FE892925252CF8A9
SHA1:	40443106D58BFA93F6D827EF6B20AAFD5D2F3E64
SHA-256:	CC1502C80E981AA2DB365CD8263BB82F5EC98158835D5455BF10C550F00E7D79
SHA-512:	67760A796699E4F615E747A63CCDD5E298B3343429131A1E1F1E03FAFDF2598B04139D748D125E51B80EC772B68CD51CC273C57917B92728722824CC5918AAFC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from hashlib import sha1.from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. determine_ext,. float_or_none,. int_or_none,. unified_strdate,.)...class ProSiebenSat1BaseIE(InfoExtractor):. _GEO_COUNTRIES = ['DE']. _ACCESS_ID = None. _SUPPORTED_PROTOCOLS = 'dash:clear,hls:clear,progressive:clear'. _V4_BASE_URL = 'https://vas-v4.p7s1video.net/4.0/get'.. def _extract_video_info(self, url, clip_id):. client_location = url.. video = self._download_json(. 'http://vas.sim-technik.de/vas/live/v2/videos',. clip_id, 'Downloading videos JSON', query={. 'access_token': self._TOKEN,. 'client_location': client_location,. 'client_name': self._CLIENT_NAME,. 'ids': clip_id,. })[0].. if video.get('is_protected') is True:. raise Extra

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DH2MT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3079
Entropy (8bit):	4.751739002934147
Encrypted:	false
SSDEEP:	96:lMj+TvU2bWZJ9veRR7V1atw2fxtoTQ0j4etExIBHWw6:IycXhve77au8xtKZtEvw6
MD5:	E676D3ED46103493A24917D9881D38B4
SHA1:	15673683BA9994ABA5B39A9A010D005075708BF7
SHA-256:	4A6C496D416D5F130FB60E140DB3B4026DFA8C20E632030931D03515D983A02B
SHA-512:	3BD043418E245D2CACFF5BAF1E14563596FB35B0F2C5CC440A14CBC1F5BCB841B3EA38F62690CB72D4C9767EEE7AC5DE3FDA6AFA65278657467CA049915CAF07
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. float_or_none,. int_or_none,.)...class DotsubIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?dotsub\.com/view/(?P<id>[^/]+)'. _TESTS = [{. 'url': 'https://dotsub.com/view/9c63db2a-fa95-4838-8e6e-13deafe47f09',. 'md5': '21c7ff600f545358134fea762a6d42b6',. 'info_dict': {. 'id': '9c63db2a-fa95-4838-8e6e-13deafe47f09',. 'ext': 'flv',. 'title': 'MOTIVATION - "It\'s Possible" Best Inspirational Video Ever',. 'description': 'md5:41af1e273edbbdfe4e216a78b9d34ac6',. 'thumbnail': 're:^https?://dotsub.com/media/9c63db2a-fa95-4838-8e6e-13deafe47f09/p',. 'duration': 198,. 'uploader': 'liuxt',. 'timestamp': 1385778501.104,. 'upload_date': '20131130',. 'view_count': int,. }. }, {. 'url': 'https://dotsub.com/view/747bcf58-bd59-45b7-8c8c-ac312

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DIJFL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12310
Entropy (8bit):	4.242394568683494
Encrypted:	false
SSDEEP:	384:Hs/95D+7UH3+VLzNGNd/zBkeRd/+Tb1/WuUag6N98zFJIDaSYlYT:HrLzNGj/9Fd/41/WDag898zFJIDablYT
MD5:	3AEA12A774E0DAEDB92CFDBD3B354D02
SHA1:	360CC0EFD195D3B3E73216545316AB33CD9905B8
SHA-256:	CE1FC2D9FDED01F311B49202E6D7F1B00112C64941186B6D9C0BE480D5504BB7
SHA-512:	3CB762D713E246D1992FC345769AECA3A975ECC2FC23F50377EBC5DC2D9F838E2F0A717F69263794270B52713FB6BD17E13504DE9F7BE5CBC156873B26A14FAC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. extract_attributes,. ExtractorError,. url_or_none,. urlencode_postdata,. urljoin,.)...class AnimeOnDemandIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?anime-on-demand\.de/anime/(?P<id>\d+)'. _LOGIN_URL = 'https://www.anime-on-demand.de/users/sign_in'. _APPLY_HTML5_URL = 'https://www.anime-on-demand.de/html5apply'. _NETRC_MACHINE = 'animeondemand'. # German-speaking countries of Europe. _GEO_COUNTRIES = ['AT', 'CH', 'DE', 'LI', 'LU']. _TESTS = [{. # jap, OmU. 'url': 'https://www.anime-on-demand.de/anime/161',. 'info_dict': {. 'id': '161',. 'title': 'Grimgar, Ashes and Illusions (OmU)',. 'description': 'md5:6681ce3c07c7189d255ac6ab23812d31',. },. 'playlist_mincount': 4,. }, {. # Film wording is used instead of

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DJT4C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6428
Entropy (8bit):	4.992084691826563
Encrypted:	false
SSDEEP:	192:dXw2Wbk+4OEzTco76nHEUHnNKhPGcpA1HGrP:dXw2WbkbVzwo76nH5nNKhHO1gP
MD5:	5C453942A1845FB1424F92F00B9C2A94
SHA1:	295D848C9F9915883728766015599C02A61E9997
SHA-256:	FC9D770AA7A3826455254DC0099C39F8E18470F95DF9917CF3A9A05470BC7323
SHA-512:	BDC6C43435D3A207937C10F9C3F3E10F787B4C2F3374541C7AE9B039D32A09E82D864D779B7980DEC5A4AA20363930D3EFA0E611C2DDF676161A054C2D122607
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .turner import TurnerBaseIE.from ..utils import url_basename...class CNNIE(TurnerBaseIE):. _VALID_URL = r'''(?x)https?://(?:(?P<sub_domain>edition\|www\|money)\.)?cnn\.com/(?:video/(?:data/.+?\|\?)/)?videos?/. (?P<path>.+?/(?P<title>[^/]+?)(?:\.(?:[a-z\-]+)\|(?=&)))'''.. _TESTS = [{. 'url': 'http://edition.cnn.com/video/?/video/sports/2013/06/09/nadal-1-on-1.cnn',. 'md5': '3e6121ea48df7e2259fe73a0628605c4',. 'info_dict': {. 'id': 'sports/2013/06/09/nadal-1-on-1.cnn',. 'ext': 'mp4',. 'title': 'Nadal wins 8th French Open title',. 'description': 'World Sport\'s Amanda Davies chats with 2013 French Open champion Rafael Nadal.',. 'duration': 135,. 'upload_date': '20130609',. },. 'expected_warnings': ['Failed to download m3u8 information'],. }, {. 'url': 'http://edition.cnn.com/video/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DKSC6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	4.8490288475206675
Encrypted:	false
SSDEEP:	48:wuM4akfoT+XgdV7XywZpBf10gtfdfFbNxr41XUZNB8ByaW2pg6Nrqw:hoT0q1XyuBf1Vfplf6N2w
MD5:	E97BF3D449F568C608A8B3BCF0C8A6C2
SHA1:	3494830720C0A3288B8461B5DA057FB83F6BE6F1
SHA-256:	1BC71450318E18F544A6C9289FFDDD850FAAF5C1FA192FF8EB1A320A9072BA8A
SHA-512:	66DD3C2025CAE6B139BF07B1E2F34DD5211663E22F203F1AE0C6D7002DC9C7AFD722C19148AEA46CA85286DCF3ACE55F0C5B52F4CF379F5899031146AF778049
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import re..from .common import InfoExtractor...class JeuxVideoIE(InfoExtractor):. _VALID_URL = r'https?://.?\.jeuxvideo\.com/./(.*?)\.htm'.. _TESTS = [{. 'url': 'http://www.jeuxvideo.com/reportages-videos-jeux/0004/00046170/tearaway-playstation-vita-gc-2013-tearaway-nous-presente-ses-papiers-d-identite-00115182.htm',. 'md5': '046e491afb32a8aaac1f44dd4ddd54ee',. 'info_dict': {. 'id': '114765',. 'ext': 'mp4',. 'title': 'Tearaway : GC 2013 : Tearaway nous pr.sente ses papiers d\'identit.',. 'description': 'Lorsque les d.veloppeurs de LittleBigPlanet proposent un nouveau titre, on ne peut que s\'attendre . un r.sultat original et fort attrayant.',. },. }, {. 'url': 'http://www.jeuxvideo.com/videos/chroniques/434220/l-histoire-du-jeu-video-la-saturn.htm',. 'only_matching': True,. }].. def _real_extract(self, url):. mobj

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DNI63.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4003
Entropy (8bit):	4.608171637912937
Encrypted:	false
SSDEEP:	96:Rke0u4bXBmCXO8aGAXEmOy1M4ANBT1IwoqnYeflCrc09m6NhtN0E8M90:ye34ZHaGkEmOy1cTT1XJam6NEP
MD5:	EC9BF4996041FE29108D1F2CEB6E374E
SHA1:	3F38E4FA90CF98006A39AB9AC61A5C67D1A6177F
SHA-256:	AF9DCE016E98332B9D37A9C312E4F6E421528A2FA6622EA8069C6B978795C4D1
SHA-512:	96F026B34538D1305DF11A34712177D8B474F6AAA5A62E7489AE15702251C9F305992FC3E425B4AA10AF2AD92D21C093D213A9739E45F83DDB687782D25D239F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. float_or_none,. unified_strdate,.)...class PornoVoisinesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pornovoisines\.com/videos/show/(?P<id>\d+)/(?P<display_id>[^/.]+)'.. _TEST = {. 'url': 'http://www.pornovoisines.com/videos/show/919/recherche-appartement.html',. 'md5': '6f8aca6a058592ab49fe701c8ba8317b',. 'info_dict': {. 'id': '919',. 'display_id': 'recherche-appartement',. 'ext': 'mp4',. 'title': 'Recherche appartement',. 'description': 'md5:fe10cb92ae2dd3ed94bb4080d11ff493',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20140925',. 'duration': 120,. 'view_count': int,. 'average_rating': float,. 'categories': ['D.butante', 'D.butantes', 'Sc.nario', 'Sodomie'],.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DNTCT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	4.6772350512259
Encrypted:	false
SSDEEP:	48:+uH0b0Cjjf/qR1q+jdfFkZV8vEwe3eKunZNEpf3R5hgSFzt/bGcvcT7rBTMAt/8h:AQ2jf/q2+jGTwe3eKunZNEpfB5hg0zZv
MD5:	26043B1FB7BA47076A2764152CA73993
SHA1:	AD296C44CA0EF8F2541F945A5E644B05516A183B
SHA-256:	DB2808E15F540F84BF8979C7F42EB08F7127C0078B28E69D3A0D5C92952F3F70
SHA-512:	6BFA534A3EC587D82652F33D70287F3A71285FEBFEACCB2650DD98F7017AA5A1F632B22518E67658A68C846C616EC0EFE7C08259ACCB5F789BEE4549FC46C08E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. xpath_text,. int_or_none,.)...class WallaIE(InfoExtractor):. _VALID_URL = r'https?://vod\.walla\.co\.il/[^/]+/(?P<id>\d+)/(?P<display_id>.+)'. _TEST = {. 'url': 'http://vod.walla.co.il/movie/2642630/one-direction-all-for-one',. 'info_dict': {. 'id': '2642630',. 'display_id': 'one-direction-all-for-one',. 'ext': 'flv',. 'title': '.... .......: ........',. 'description': 'md5:de9e2512a92442574cdb0913c49bc4d8',. 'thumbnail': r're:^https?://.*\.jpg',. 'duration': 3600,. },. 'params': {. # rtmp download. 'skip_download': True,. }. }.. _SUBTITLE_LANGS = {. '.....': 'heb',. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('i

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DRNUH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4496
Entropy (8bit):	4.635741739896868
Encrypted:	false
SSDEEP:	96:qQt+B1WTQbfverUPmII56ksczypeszpo1ZqdEaCOoGG3GYJdj2aCDJVGIwSAkBT6:bt+BMkv5OV56Gy5Foxe7aA5wShTwt6Ng
MD5:	FD198BA70CB24E4693237F1E139DC3F0
SHA1:	5AB5B468F546A238B5551326098BD9DC1EC116D7
SHA-256:	11F813910694AF88172DF0F1DC199CE57EF94292D14929A54B5D481E4F776E4D
SHA-512:	CEC0E64DBE3F8A3B1D50F3BA96066D01E85CF52E5552515F06F93FFECB10B1854C45F6A0BA6A1491D1DAD1AD4274D73C95A21F26A1F2FA9D73D9F54CC3C7E0F1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_duration,. unified_strdate,.)...class SapoIE(InfoExtractor):. IE_DESC = 'SAPO V.deos'. _VALID_URL = r'https?://(?:(?:v2\|www)\.)?videos\.sapo\.(?:pt\|cv\|ao\|mz\|tl)/(?P<id>[\da-zA-Z]{20})'.. _TESTS = [. {. 'url': 'http://videos.sapo.pt/UBz95kOtiWYUMTA5Ghfi',. 'md5': '79ee523f6ecb9233ac25075dee0eda83',. 'note': 'SD video',. 'info_dict': {. 'id': 'UBz95kOtiWYUMTA5Ghfi',. 'ext': 'mp4',. 'title': 'Benfica - Marcas na Hit.ria',. 'description': 'md5:c9082000a128c3fd57bf0299e1367f22',. 'duration': 264,. 'uploader': 'tiago_1988',. 'upload_date': '20080229',. 'categories': ['benfica', 'cabral', 'desporto', 'futebol', 'geovanni', 'hooijdonk', 'joao', 'karel', 'lisboa', 'miccoli'],.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DTJOP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6559
Entropy (8bit):	4.677169757450537
Encrypted:	false
SSDEEP:	96:Bpjxn1Fun1zn67GQWxb4iFDaEYUQcKOVc3vRmnsJKxCWqKLm1Ac8HPn0SO:Bpjx14n1z67Gb9FWnrYnokb4lKO
MD5:	1B0A49986D4B3CCC73D21368FB39BF80
SHA1:	EA6BCB04EA2BF0979E96708CC1C17E79889D5A1C
SHA-256:	58B9BE0D6FA3288A1C406A87A526E880326608AF835381F579824E145E01265B
SHA-512:	8715E18F26543298F775C2BE3A5D5A87856F914936E41AF53478EE375DF2F38AA0814A4F1512DEAFD2C43E430D3E501E39A6910E22B7F91DF6828511CD698102
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import random.import re..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. orderedSet,. unescapeHTML,. urlencode_postdata,. urljoin,.)...class LinuxAcademyIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:www\.)?linuxacademy\.com/cp/. (?:. courses/lesson/course/(?P<chapter_id>\d+)/lesson/(?P<lesson_id>\d+)\|. modules/view/id/(?P<course_id>\d+). ). '''. _TESTS = [{. 'url': 'https://linuxacademy.com/cp/courses/lesson/course/1498/lesson/2/module/154',. 'info_dict': {. 'id': '1498-2',. 'ext': 'mp4',. 'title': "Introduction to the Practitioner's Brief",. },. 'params': {. 'skip

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-DU49S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9292
Entropy (8bit):	4.703564697175331
Encrypted:	false
SSDEEP:	192:Cnqx0ssOblqRTke7RhJaXrwr3Kd21fVNh3f8fBP+PYCs246Zm3m5NJXq9Xh1pI0:Cqx3sOblqRTke7RhJaXkmd2pVLP8fBWo
MD5:	F75BA0FCF71E5D554CA83E6071218B45
SHA1:	BEAC942B1CEC258175F981F86961EFC9592D5D4E
SHA-256:	03C2EC4DD813B417B25DB98713CA28D33681B608621330E47527CFDBA596C795
SHA-512:	8DC652BB0CF0B9FD2AB719966AFEE9549B6BCEFA41F0B19CDD18DE9E2FB33D529C5348776B7A56DF1C29A58DD60025919AE24CA29F5CD52B8816B71DE26928C2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .once import OnceIE.from ..compat import compat_urllib_parse_unquote.from ..utils import (. ExtractorError,. int_or_none,.)...class VoxMediaVolumeIE(OnceIE):. _VALID_URL = r'https?://volume\.vox-cdn\.com/embed/(?P<id>[0-9a-f]{9})'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. setup = self._parse_json(self._search_regex(. r'setup\s=\s({.+});', webpage, 'setup'), video_id). video_data = setup.get('video') or {}. info = {. 'id': video_id,. 'title': video_data.get('title_short'),. 'description': video_data.get('description_long') or video_data.get('description_short'),. 'thumbnail': video_data.get('brightcove_thumbnail'). }. asset = setup.get('asset') or setup.get('params') or {}.. formats = []. hl

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-E009F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2017
Entropy (8bit):	5.0133036634516355
Encrypted:	false
SSDEEP:	48:+uGfiBdYfDUdxsbKPNUPlODgU/Sb55dfFfVdIhLFCXIOGgBWY7YoFtT:ClWxsbKPDY95b2LEIZPYztT
MD5:	387664FD1CF50438A721650F51803334
SHA1:	EF4A6277E695A180DE8E319D90960F8F648AC8DD
SHA-256:	A53F391BF1C40FA2C8372A2D22B7A70F0EB2A88653B2854855197E8214A4E61E
SHA-512:	B67FB4EE1825F9FCB95D22007A52252467C88ACCDBEDC976AEECCED43FD8711F08C81C3995AC8C8DCE80C2CDC8D7962EE99F45529CA256026E2677073E1DF145
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .brightcove import BrightcoveLegacyIE.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import smuggle_url...class RMCDecouverteIE(InfoExtractor):. _VALID_URL = r'https?://rmcdecouverte\.bfmtv\.com/(?:(?:[^/]+/)*program_(?P<id>\d+)\|(?P<live_id>mediaplayer-direct))'.. _TESTS = [{. 'url': 'https://rmcdecouverte.bfmtv.com/wheeler-dealers-occasions-a-saisir/program_2566/',. 'info_dict': {. 'id': '5983675500001',. 'ext': 'mp4',. 'title': 'CORVETTE',. 'description': 'md5:c1e8295521e45ffebf635d6a7658f506',. 'uploader_id': '1969646226001',. 'upload_date': '20181226',. 'timestamp': 1545861635,. },. 'params': {. 'skip_download': True,. },. 'skip': 'only available for a week',. }, {. # live, geo restricted, bypassable.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-E075M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9621
Entropy (8bit):	5.0767481447847
Encrypted:	false
SSDEEP:	192:GwUr0yjSbiD5jJnuj4ezJX2JEij1UjOa8j6YCW+R9hw1rxhr7ulfS4lahmzON+UX:8mbStuHgLZU78CW+R9hw1rxhr7ulX4hX
MD5:	2F215D43A0FA332B172A4059B9B262B9
SHA1:	C2AEB577B940C2B57163C36C58280E76219D2E3E
SHA-256:	5E3EAD3A916D61464AF491DDA1ADA026CFD9AFC65D9E71CA931061136713514D
SHA-512:	03DFDA01A6CF081DEDF5674383F45FB92AB00D68C59926E9325DAF62A794653B3B5CDB3421D2B5AE76519AAFA045CA047C86F03A4A5B510931878CF8F820BFAD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_iso8601,. remove_end,.)...class LifeNewsIE(InfoExtractor):. IE_NAME = 'life'. IE_DESC = 'Life.ru'. _VALID_URL = r'https?://life\.ru/t/[^/]+/(?P<id>\d+)'.. _TESTS = [{. # single video embedded via video/source. 'url': 'https://life.ru/t/......./98736',. 'md5': '77c95eaefaca216e32a76a343ad89d23',. 'info_dict': {. 'id': '98736',. 'ext': 'mp4',. 'title': '....... ..... .... ..... .......... ......',. 'description': 'md5:3b06b1b39b5e2bea548e403d99b8bf26',. 'timestamp': 1344154740,. 'upload_date': '20120805',. 'view_count': int,. }. }, {. # single video embedded via

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-E0O95.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2803
Entropy (8bit):	4.738978549118892
Encrypted:	false
SSDEEP:	48:+ulAeURf22SXdN2sQf1mu5J7XdNNsfdfFk9a3lkEXnOvbBxAdW5qGl1kieVZVbdr:ZADZ22SXdosQf55J7XdbsftKiOvkdW58
MD5:	F67D412E27A606F2AF919E21B9161522
SHA1:	29D7282748B90EA23037876E0FD0A5E51858C6A9
SHA-256:	6F772EC218AEEC8858CA3C3C2AA08A9FB822942AE3409DC4FDE8E9220C0CB442
SHA-512:	64916B90AD08621B0F248CB7698C8444EF1D25380A92A99940C1DFB34CCDE5AD644CEB92388F54C259769A0E677FCA5E06D532642C2082A7DBCAE9C58A400479
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import urlencode_postdata..import re...class TwitCastingIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?twitcasting\.tv/(?P<uploader_id>[^/]+)/movie/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://twitcasting.tv/ivetesangalo/movie/2357609',. 'md5': '745243cad58c4681dc752490f7540d7f',. 'info_dict': {. 'id': '2357609',. 'ext': 'mp4',. 'title': 'Live #2357609',. 'uploader_id': 'ivetesangalo',. 'description': "Moi! I'm live on TwitCasting from my iPhone.",. 'thumbnail': r're:^https?://.*\.jpg$',. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'https://twitcasting.tv/mttbernardini/movie/3689740',. 'info_dict': {. 'id': '3689740',. 'ext': 'mp4',. 'title': 'Live playing something #3689740',. 'u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-E14A7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2732
Entropy (8bit):	5.104747519661235
Encrypted:	false
SSDEEP:	48:+u2MNur9B+OBu3IyFADZj1jBk/olXadfFkZVmrBQJleBFJ0XnHCKOBDKxFgB1grq:nMrD+O03jFy3lJlXaGXl0SHHgKDAmNj2
MD5:	F1D7D1EF1E68CE0A61F7AEA10FD462E2
SHA1:	2A1E08360CA7D437FA1CA12A88C928140FF7DAF1
SHA-256:	D75AB4D4ABC557F64A2681240695D97F2CA211A3F94EAEDD488CB6E20FE9DB38
SHA-512:	B1A917FF09B1477C44BAFD3390D09EF361585256F3B66AB6D565D881BB32CA8D308C299F6D705A7FF4C92626659600A4B73D66EB1F7B602234F3660A553D37AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,.)...class KontrTubeIE(InfoExtractor):. IE_NAME = 'kontrtube'. IE_DESC = 'KontrTube.ru - ..... .....'. _VALID_URL = r'https?://(?:www\.)?kontrtube\.ru/videos/(?P<id>\d+)/(?P<display_id>[^/]+)/'.. _TEST = {. 'url': 'http://www.kontrtube.ru/videos/2678/nad-olimpiyskoy-derevney-v-sochi-podnyat-rossiyskiy-flag/',. 'md5': '975a991a4926c9a85f383a736a2e6b80',. 'info_dict': {. 'id': '2678',. 'display_id': 'nad-olimpiyskoy-derevney-v-sochi-podnyat-rossiyskiy-flag',. 'ext': 'mp4',. 'title': '... ........... ........ . .... ...... .......... ....',. 'description': 'md5:80edc4c613d5887ae8ccf1d59432be41',. 'thumbnail': 'http://www.kontrtube.ru/contents/videos_screenshots/2000/2678/preview

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-E4M7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.8762301935981505
Encrypted:	false
SSDEEP:	24:zi8lFvWqcO1GEsw6Bznv/crlEbuFf1aeIXjlgtpBDuX9tIVCx/rayxPxlV00L2SP:+uLXsTTcWCFdajXjlkpBDuXbwA/rbPzZ
MD5:	D7D04F62C67601D57B9573541860027B
SHA1:	EE35A47B5859715DADB861EC78BCE67491BEF81A
SHA-256:	E74C3A248A0B6FF3E78CA07566D0B64CAB1E36AA32C35E7D9FD8B5A4807C938A
SHA-512:	A48E81C8E1F5FC34D3D0C6F1D84791F3468F48184D9222C4C99B22EF2017ACAD6C5FB28FEA6E248B3F2929DA5FC6875D9E16AA0C68E3D5D85C4C125A42922A4D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. get_element_by_class,. js_to_json,.)...class TVNoeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?tvnoe\.cz/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.tvnoe.cz/video/10362',. 'md5': 'aee983f279aab96ec45ab6e2abb3c2ca',. 'info_dict': {. 'id': '10362',. 'ext': 'mp4',. 'series': 'No.n. univerzita',. 'title': 'prof. Tom.. Hal.k, Th.D. - N.vrat n.bo.enstv. a st.et civilizac.',. 'description': 'md5:f337bae384e1a531a52c55ebc50fff41',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. iframe_url = self._search_regex(. r'<iframe[^>]+src="([^"]+)"', webpage, 'iframe URL').. ifs_page = self._download_webpage(iframe_url, video_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-E57F7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	14708
Entropy (8bit):	4.6853762420580365
Encrypted:	false
SSDEEP:	384:21PV8WodSSNTXwkJiQOh+hTG6NyJrIiKTYH6NpFY8Jo6DJ9itndhTcdZ6eP:NNTXwkJiQOhuTG8yJrIiKTYH8pzEvhQf
MD5:	ED0A37886A567B5AF561C2EAA4B2B94C
SHA1:	52FD17C02E1E213798333872AE5249BA60DA3F28
SHA-256:	1D2A36E0F89A67975A82D52F9DAD7CB07EB5087BAEEC3524D8B6DBA30DCFC7BB
SHA-512:	73B7B70269ED1F3DFCB9122EC632A4E1CE3787AD1E455DACC5388B42C60A3DA646DD31E529834D34F0F28B02EA1DF1E4FE0C014E0F938618758E61B0202C8913
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time.import itertools..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_str,.).from ..utils import (. dict_get,. ExtractorError,. float_or_none,. int_or_none,. remove_start,. try_get,. urlencode_postdata,.)...class VLiveIE(InfoExtractor):. IE_NAME = 'vlive'. _VALID_URL = r'https?://(?:(?:www\|m)\.)?vlive\.tv/video/(?P<id>[0-9]+)'. _NETRC_MACHINE = 'vlive'. _TESTS = [{. 'url': 'http://www.vlive.tv/video/1326',. 'md5': 'cc7314812855ce56de70a06a27314983',. 'info_dict': {. 'id': '1326',. 'ext': 'mp4',. 'title': "[V LIVE] Girl's Day's Broadcast",. 'creator': "Girl's Day",. 'view_count': int,. },. }, {. 'url': 'http://www.vlive.tv/video/16937',. 'info_dict': {. 'id': '16937',. 'ext': 'mp4',. 'title': '[V

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-E8JRB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.972862146664424
Encrypted:	false
SSDEEP:	24:1R8lFvCGqVEwU5fcz/fZdlAsTc3FHTnD1feIXjlgtishDim0OkkkI:PuIKv5krR5Y3drD1fjXjlkisV7kI
MD5:	4058674FE2F9AC3768D05BCD36F26148
SHA1:	CB7602951AC2D26D7C064E053EE1958C04E65365
SHA-256:	31BFB9E8A05704ADC943CAB941BCE2BCE6D5C74863A08A18226655F361CEB2ED
SHA-512:	9C8228D5D97D3A83C702B16ED48A98DA87F8A2599940E5A9C9A3305353EB0DEBA14E1E00B1898D60587EAA288A6E561AF439806C60BE6AE1F024FB9DBADF330E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from .internetvideoarchive import InternetVideoArchiveIE...class VideoDetectiveIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?videodetective\.com/[^/]+/[^/]+/(?P<id>\d+)'.. _TEST = {. 'url': 'http://www.videodetective.com/movies/kick-ass-2/194487',. 'info_dict': {. 'id': '194487',. 'ext': 'mp4',. 'title': 'KICK-ASS 2',. 'description': 'md5:c189d5b7280400630a1d3dd17eaa8d8a',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). og_video = self._og_search_video_url(webpage). query = compat_urlparse.urlparse(og_video).query. return self.url_result(InternetVideoArchiveIE._build_json_url(query), ie=Interne

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EBDBE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1504
Entropy (8bit):	4.834794435781765
Encrypted:	false
SSDEEP:	24:zi8lFvpGuyJwFRKFn/MFFdlDTwQCYXHNqaeIXjlgtdHXjK0BmZ1UBNyq7leBoy8o:+uv1wNF/MFFn8XYXNqajXjlkd3jbBiuC
MD5:	64CC8CE5A6824791203E19330E058AFF
SHA1:	B1C97ECB396E7ADAECC1ABB6782C29AE8D2213A5
SHA-256:	7B6046FE43326DDFA0F1AE4F7509A61865AEF6022EA10AD4F32B52C26099945D
SHA-512:	536999FC23335BD09C95A236A208C506BD8236D40A0F7CDBF0B670E5B750EF4FE9C1750DAC8FCF7E5F207E471A630C8E97B1F91644C2719E9BBB13BFB69441D3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class OktoberfestTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?oktoberfest-tv\.de/[^/]+/[^/]+/video/(?P<id>[^/?#]+)'.. _TEST = {. 'url': 'http://www.oktoberfest-tv.de/de/kameras/video/hb-zelt',. 'info_dict': {. 'id': 'hb-zelt',. 'ext': 'mp4',. 'title': 're:^Live-Kamera: Hofbr.uzelt [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'thumbnail': r're:^https?://.\.jpg$',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._live_title(self._html_search_regex(. r'<h1><strong>.?</strong>(.?)</h1>', webpage, 'title')).. clip = self._search_regex(. r"clip:\s\{\surl:\s'([^']+)'", webpage,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EBKOL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6349
Entropy (8bit):	4.5557446447381835
Encrypted:	false
SSDEEP:	192:Ta5xh1rj+b0rYUx020M3k23594dYnTfv22K26p36NYZ1ddA/cqN:G/vrj0XL20M3TAdYnTQ36NSrdAjN
MD5:	A858578C17E66E9551AC46BEF10869DC
SHA1:	57CF6156D6A1576D97AC1C408DFE44D0A01635D1
SHA-256:	0B04609581C81D6248D1B21EE558595FC3B2B352F0B343CC924E1ED3F41E8392
SHA-512:	576D35BFD382FB59ECFDC231A8041AB3E6D7F949BEA739A71660F16A614522BD156DF35CFC746DF96E0CB294245DB854B28483EF241596BFABDF21B1E63D1E8D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. unified_strdate,.)...class RadioCanadaIE(InfoExtractor):. IE_NAME = 'radiocanada'. _VALID_URL = r'(?:radiocanada:\|https?://ici\.radio-canada\.ca/widgets/mediaconsole/)(?P<app_code>[^:/]+)[:/](?P<id>[0-9]+)'. _TESTS = [. {. 'url': 'http://ici.radio-canada.ca/widgets/mediaconsole/medianet/7184272',. 'info_dict': {. 'id': '7184272',. 'ext': 'mp4',. 'title': 'Le parcours du tireur capt. sur vid.o',. 'description': 'Images des cam.ras de surveillance fournies par la GRC montrant le parcours du tireur d\'Ottawa',. 'upload_date': '20141023',. },. 'params': {. # m3u8 download. 'skip_download': True,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EDGA4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2297
Entropy (8bit):	4.84660765835018
Encrypted:	false
SSDEEP:	48:+uUDbENfDJkn98MdSXj2adfFkZVmhm6S7X9YeHAK9Qn/HCkqZQG818c/9A:+bENf9kn98MAXj2aG65SJYrK9mfCkivl
MD5:	2D26F5356C0BCD4CD74EF42F3356FFDF
SHA1:	8130EA8105A2C3DC1943A9BE545816B44F7B908E
SHA-256:	954B64E2314DB4290B46CD916954F153CDAF202B7C367B784AE19B5AF9F13D7A
SHA-512:	27D9B927B7F4435696DD21A375B94A194D11535D933C49FC6B5F1725479E585DCDA977B1DE559C07D251E7ADFB9FC18C6F472A3A517C86F312BD6287145BA910
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import parse_duration...class WatchIndianPornIE(InfoExtractor):. IE_DESC = 'Watch Indian Porn'. _VALID_URL = r'https?://(?:www\.)?watchindianporn\.net/(?:[^/]+/)video/(?P<display_id>[^/]+)-(?P<id>[a-zA-Z0-9]+)\.html'. _TEST = {. 'url': 'http://www.watchindianporn.net/video/hot-milf-from-kerala-shows-off-her-gorgeous-large-breasts-on-camera-RZa2avywNPa.html',. 'md5': '249589a164dde236ec65832bfce17440',. 'info_dict': {. 'id': 'RZa2avywNPa',. 'display_id': 'hot-milf-from-kerala-shows-off-her-gorgeous-large-breasts-on-camera',. 'ext': 'mp4',. 'title': 'Hot milf from kerala shows off her gorgeous large breasts on camera',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 226,. 'view_count': int,. 'categories': list,. 'age_limit': 18,. }.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EIHFF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	4.739207253848918
Encrypted:	false
SSDEEP:	24:1R8l9RoGPMX6mwPhnc/8btlwd6BiSXM65w0MTBRw0M6H/eIXjlgtiBKtpSnARusg:Puwu6G8elZXB5BWBRBXH/jXjlkiBkSn5
MD5:	6421EFBE2239971C59A1B951C241CE02
SHA1:	37983809867BDBAB375B2DB1A483E304A2CACAFE
SHA-256:	D52B9A011FDF26610C6E80CE4BAE3BBB8FA007A644930DCE45067386D06D10AA
SHA-512:	A8DCBCB12A7AA2492774AC070AB4378D913658FEE2B775C7C631F201A814089B0D0751D6A8393FE29713924814C2FB3835FF0B6A136B29E47F5DBFF992393454
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .dreisat import DreiSatIE...class PhoenixIE(DreiSatIE):. IE_NAME = 'phoenix.de'. _VALID_URL = r'''(?x)https?://(?:www\.)?phoenix\.de/content/. (?:. phoenix/die_sendungen/(?:[^/]+/)?. )?. (?P<id>[0-9]+)'''. _TESTS = [. {. 'url': 'http://www.phoenix.de/content/884301',. 'md5': 'ed249f045256150c92e72dbb70eadec6',. 'info_dict': {. 'id': '884301',. 'ext': 'mp4',. 'title': 'Michael Krons mit Hans-Werner Sinn',. 'description': 'Im Dialog - Sa. 25.10.14, 00.00 - 00.35 Uhr',. 'upload_date': '20141025',. 'uploader': 'Im Dialog',. }. },. {. 'url': 'http://www.phoenix.de/content/phoenix/die_sendungen/869815',. 'only_matching': True,. },. {. 'url': 'http://www.phoenix.de/content/phoenix/die_sendungen/diskussionen/9

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EKBKO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	4.869500135556992
Encrypted:	false
SSDEEP:	48:Pu0im7f2SAdUYqCv5X1a3xotfjXhkKBxSMAbpUb:Ymj2SAdZDv5FmotfaYSVw
MD5:	CA65F2DDA2C6609787F4F0642C703E61
SHA1:	96590E6AE5B9E46D6491DAF78E92BDC4911C4A68
SHA-256:	B8605DE2EEFD572C2DFE2942CCC76B9381C7AAE79CC336C4768A46A05ADBFD1B
SHA-512:	2DDB3CF2E9953EB0ADA7760B461F991666EBB8912371C3A6211407E8FCF6033E979169F1D092F37C4C2B6F37BE1313C851A5235B173AF56AE7B2B1C08B85C24D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .youtube import YoutubeIE...class WimpIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?wimp\.com/(?P<id>[^/]+)'. _TESTS = [{. 'url': 'http://www.wimp.com/maru-is-exhausted/',. 'md5': 'ee21217ffd66d058e8b16be340b74883',. 'info_dict': {. 'id': 'maru-is-exhausted',. 'ext': 'mp4',. 'title': 'Maru is exhausted.',. 'description': 'md5:57e099e857c0a4ea312542b684a869b8',. }. }, {. 'url': 'http://www.wimp.com/clowncar/',. 'md5': '5c31ad862a90dc5b1f023956faec13fe',. 'info_dict': {. 'id': 'cG4CEr2aiSg',. 'ext': 'webm',. 'title': 'Basset hound clown car...incredible!',. 'description': '5 of my Bassets crawled in this dog loo! www.bellinghambassets.com\n\nFor licensing/usage please contact: licensing(at)jukinmediadotcom',. 'upload_date': '20140303',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EKJ2Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	14684
Entropy (8bit):	4.771635436333247
Encrypted:	false
SSDEEP:	384:9BBt2PfrfS3TdtUs1rUW0vs1oB8n8w+TC6NgtPlf5SPK0Bp74:ToW0s1oB08w+TC8W0P74
MD5:	37FD2477FFD6A834604A65D3A3ED13CB
SHA1:	16646B198568FDB51266606D6673FED92BE1A941
SHA-256:	2CB76745025994131A59D26977603EE3CDF1CB0F15821A2EB516D59343EBDEEE
SHA-512:	CA7E9CC3987C183662D6FE626D965CC1335E38CC4C6DA13731DF7F6D2E0293904A8F3D1A045CC703F458674FF206169576DC5342194C48BF198E4C800CFBB4A1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. float_or_none,. mimetype2ext,. str_or_none,. try_get,. unescapeHTML,. unsmuggle_url,. url_or_none,. urljoin,.)..._ID_RE = r'(?:[0-9a-f]{32,34}\|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12,14})'...class MediasiteIE(InfoExtractor):. _VALID_URL = r'(?xi)https?://[^/]+/Mediasite/(?:Play\|Showcase/(?:default\|livebroadcast)/Presentation)/(?P<id>%s)(?P<query>\?[^#]+\|)' % _ID_RE. _TESTS = [. {. 'url': 'https://hitsmediaweb.h-its.org/mediasite/Play/2db6c271681e4f199af3c60d1f82869b1d',. 'info_dict': {. 'id': '2db6c271681e4f199af3c60d1f82869b1d',. 'ext': 'mp4',. 'title': 'Lecture: Tuesday, September 20, 2016 - Sir Andrew Wiles',. 'description': 'Sir A

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EL2LS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7867
Entropy (8bit):	4.6920686457191225
Encrypted:	false
SSDEEP:	192:ATMoe4vY75BLRuFIvB3IqNqdKbk4Ug+b4TU:ATMoeEY9BLRuFgrNqdKMg4
MD5:	80423BAC321E04B2FEB9910702BFFEC3
SHA1:	78EA9C115A6572C37383EF9E4539938030A5AB3B
SHA-256:	FF4B20D55ACDCDAF53FE0C3FBC9C29DCC99440C9C987B54F3997E909A887EACB
SHA-512:	92A23514C50B63D535959BC4A47662574DD6EB0BEBDAC7C2928748326EF7217AA58B25CA1154D88E33869CB32D98A60D0D8A87E2EDF6F09242E7B8BF954F9767
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import datetime.import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. ExtractorError,. InAdvancePagedList,. orderedSet,. str_to_int,. unified_strdate,.)...class MotherlessIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?motherless\.com/(?:g/[a-z0-9_]+/)?(?P<id>[A-Z0-9]+)'. _TESTS = [{. 'url': 'http://motherless.com/AC3FFE1',. 'md5': '310f62e325a9fafe64f68c0bccb6e75f',. 'info_dict': {. 'id': 'AC3FFE1',. 'ext': 'mp4',. 'title': 'Fucked in the ass while playing PS3',. 'categories': ['Gaming', 'anal', 'reluctant', 'rough', 'Wife'],. 'upload_date': '20100913',. 'uploader_id': 'famouslyfuckedup',. 'thumbnail': r're:http://.*\.jpg',. 'age_limit': 18,. }. }, {. 'url': 'http://motherless.com/532291B',. 'md5': 'bc59a6b47d1f958e61fbd38a4d31b131',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ENJC4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3709
Entropy (8bit):	4.906096810322014
Encrypted:	false
SSDEEP:	96:A1qFM5k3AM5BXjY2c2fRfWWXj9t9VfqplWwO1366WmRisWk9dKNl4ixs8eO6Ng:2qS56zLc2pjXVqThO136HgEeO6Ng
MD5:	4636D65856CB3294F3E784E34B0637DA
SHA1:	E2B6E02C44EDEA1412DB9771C427F12D7C2CA01C
SHA-256:	ED35EC4D93A41807233B637C08D18E48C45BC64A455AD57E69811F8432692A55
SHA-512:	037CA40A2EABD98D000E25EF227AB7C6CDFAEA4D50B4146F42DEB4F6C46068DDF1D6BD85E1F281A74A32465659ACA094CD8C8B086EF8E5BB53D8FB0CCC4B44F8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. unified_timestamp,.)...class MeipaiIE(InfoExtractor):. IE_DESC = '..'. _VALID_URL = r'https?://(?:www\.)?meipai\.com/media/(?P<id>[0-9]+)'. _TESTS = [{. # regular uploaded video. 'url': 'http://www.meipai.com/media/531697625',. 'md5': 'e3e9600f9e55a302daecc90825854b4f',. 'info_dict': {. 'id': '531697625',. 'ext': 'mp4',. 'title': '#..##..##...##....#',. 'description': '#..##..##...##....#',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 152,. 'timestamp': 1465492420,. 'upload_date': '20160609',. 'view_count': 35511,. 'creator': '..-TATA',. 'tags': ['..', '..', '...', '....'],. }. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EQRR9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11719
Entropy (8bit):	4.48191422826993
Encrypted:	false
SSDEEP:	192:IYvn8WSFDVgK9L/LAJo1PVNVnsIy/ynGVyRby6eP0LWej4pFN+EB4Du2dT86N4B:rf8PHgK9DLAJo1PVNVnsonVRby6eP0L4
MD5:	5981DDCF0EE83C4B81214D2BD7DB13C9
SHA1:	DEB79FB00BDE8CF3007486D598AF0EFF0CED1699
SHA-256:	845711926F002BF12B3150C706FE6EB46A864D759729E42F9228562ADAEA4544
SHA-512:	C4078B6D8DC5AA5143E27F6391A5DDEACB49832CC07E4B7A077D5B3EF7441ED2C9258DC0527B3B56D765B5716DFB5919E39E93A56E923326191A6B0AB7F187E1
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse,. compat_urllib_parse_unquote,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. get_element_by_attribute,. mimetype2ext,.)...class MetacafeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?metacafe\.com/watch/(?P<video_id>[^/]+)/(?P<display_id>[^/?#]+)'. _DISCLAIMER = 'http://www.metacafe.com/family_filter/'. _FILTER_POST = 'http://www.metacafe.com/f/index.php?inputType=filter&controllerGroup=user'. IE_NAME = 'metacafe'. _TESTS = [. # Youtube video. {. 'add_ie': ['Youtube'],. 'url': 'http://metacafe.com/watch/yt-_aUehQsCQtM/the_electric_company_short_i_pbs_kids_go/',. 'info_dict': {. 'id': '_aUehQsCQtM',. 'ext': 'mp4',. 'upload_date': '20090102',. 'title': 'T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ERJ9B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14131
Entropy (8bit):	4.669672540552491
Encrypted:	false
SSDEEP:	384:h1u1VKsKrhiVWIC3aqTjvKdPSdVI+HVzIdFvheUom4OmFe9T7SV6NAtsSY6N3:hAC3hJdVI+HVzIdFJeUom4OmFe9T7SV1
MD5:	0088FFBCC4F6FA3BB461D0EC3D587022
SHA1:	34483AFBBF920DB8F7AE53B3B0079AA98A0AB9E8
SHA-256:	48BD33BD16CE81794F3654D5678C90F13E35D3E7D693988BF39D134A362F921E
SHA-512:	4D72EF1AD440DB74B836EB3A3299ADF1CF532C6675647A62B83EC3A3C73C41FECBFF6BBA406DAA660392D7BB7B18976767C54AD312CCBAC63A8EE1F96038EE1E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,. compat_HTTPError,.).from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,.)...class VevoBaseIE(InfoExtractor):. def _extract_json(self, webpage, video_id):. return self._parse_json(. self._search_regex(. r'window\.__INITIAL_STORE__\s=\s({.+?});\s</script>',. webpage, 'initial store'),. video_id)...class VevoIE(VevoBaseIE):. '''. Accepts urls from vevo.com or in the format 'vevo:{id}'. (currently used by MTVIE and MySpaceIE). '''. _VALID_URL = r'''(?x). (?:https?://(?:www\.)?vevo\.com/watch/(?!playlist\|genre)(?:[^/]+/(?:[^/]+/)?)?\|. https?://cache\.vevo\.com/m/html/embed\.html\?video=\|. https?://videoplayer\.vevo\.com/embed/embedded\?videoId=\|. https?://embed\.vevo\.com/.?[?&]isrc=\|.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ES947.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2317
Entropy (8bit):	4.58713378158506
Encrypted:	false
SSDEEP:	48:+ujSFpfRVoWRZ2o6SERttfjXhycdXnkNlDksaALIrnRmZbs6NQp6lBJULEK+EKz:PSPMWRZ36SE1fRtkNlDksaQIrRm9s6ND
MD5:	FB326BDC3766FC20BEC386BF3165DD88
SHA1:	CF8FD96D82B244BABBA27E52DD522C6D5C59676F
SHA-256:	8443738E54FD11219E3E25C81AF951D988AC9A607624F5417EDE7F0C2F94AED2
SHA-512:	76DDFC6304E54F49201C4AB6EC50E1B6A2B891C24D04127A7B1F3BEF48E3050BCD8352FAD78774413EEC2A3B11E0C41A633DD66599DBDCB3A8D3679C69C84405
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import parse_duration...class Canalc2IE(InfoExtractor):. IE_NAME = 'canalc2.tv'. _VALID_URL = r'https?://(?:(?:www\.)?canalc2\.tv/video/\|archives-canalc2\.u-strasbg\.fr/video\.asp\?.*\bidVideo=)(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.canalc2.tv/video/12163',. 'md5': '060158428b650f896c542dfbb3d6487f',. 'info_dict': {. 'id': '12163',. 'ext': 'mp4',. 'title': 'Terrasses du Num.rique',. 'duration': 122,. },. }, {. 'url': 'http://archives-canalc2.u-strasbg.fr/video.asp?idVideo=11427&voir=oui',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(. 'http://www.canalc2.tv/video/%s' % video_id, video_id).. title = self._html_search_regex(. r'(?s)class="[^

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ESJI5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7849
Entropy (8bit):	4.566428662140297
Encrypted:	false
SSDEEP:	192:K+xyIQldcsV/RRU/lesD2aofurLfhi+T2XbxJsuD:NxyIQldcsVpRU/LMf+Zi+T2XbxJdD
MD5:	6B3C3CD42B89641B275ABBE0A9BEB3BC
SHA1:	F01DC2542E356AE7B8E7D8F115D05E84E80E93A4
SHA-256:	16024A7F086BD3FDD16732C2F53A888D3E75AC7C32D06BF68A40E277554D0A20
SHA-512:	90928CA93E8997F7FBFFE44F2F27BF89C4D746B049A2BA67592523F95CE037B9B6A195BF2EB239A72A8C89EF29BCFD082D0D621DE8555537386A485627200D1E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .turner import TurnerBaseIE.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. mimetype2ext,. parse_age_limit,. parse_iso8601,. strip_or_none,. try_get,.)...class AdultSwimIE(TurnerBaseIE):. _VALID_URL = r'https?://(?:www\.)?adultswim\.com/videos/(?P<show_path>[^/?#]+)(?:/(?P<episode_path>[^/?#]+))?'.. _TESTS = [{. 'url': 'http://adultswim.com/videos/rick-and-morty/pilot',. 'info_dict': {. 'id': 'rQxZvXQ4ROaSOqq-or2Mow',. 'ext': 'mp4',. 'title': 'Rick and Morty - Pilot',. 'description': 'Rick moves in with his daughter\'s family and establishes himself as a bad influence on his grandson, Morty.',. 'timestamp': 1543294800,. 'upload_date': '20181127',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'expected_warnin

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ESTIU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9417
Entropy (8bit):	4.852825293035197
Encrypted:	false
SSDEEP:	192:+2+sR4SlQbTsuaFwACoMUD5lP0N5xDMvoWsaixdohLo6zzG1INRZTk6NdVoiN1xm:jJR4SlQbTsTFwAClUD5lMN5xDMvoWsaK
MD5:	4325ADC5FC8925C6E02B48ABD9F5F3CE
SHA1:	8C6FE5C9816FA48D1846893207796FF422EBAF88
SHA-256:	0CEF7CCBCBB53C362F95F8FCFFBF39A79A1167966B5AA00A53343778C83C0EC1
SHA-512:	E5562C4F43523DBB375A331BEB6380B452FAFA7A2EA36B4115E127EAD480E2E1E1E9011E7B32570DE487861FF75A296BA840FCF4966075FF381CF1859EEDF83C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. ExtractorError,. get_element_by_attribute,. orderedSet,.)...class TVPIE(InfoExtractor):. IE_NAME = 'tvp'. IE_DESC = 'Telewizja Polska'. _VALID_URL = r'https?://[^/]+\.tvp\.(?:pl\|info)/(?:video/(?:[^,\s],)\|(?:(?!\d+/)[^/]+/)*)(?P<id>\d+)'.. _TESTS = [{. 'url': 'https://vod.tvp.pl/video/czas-honoru,i-seria-odc-13,194536',. 'md5': 'a21eb0aa862f25414430f15fdfb9e76c',. 'info_dict': {. 'id': '194536',. 'ext': 'mp4',. 'title': 'Czas honoru, odc. 13 . W.adek',. 'description': 'md5:437f48b93558370b031740546b696e24',. },. }, {. 'url': 'http://www.tvp.pl/there-can-be-anything-so-i-shortened-it/17916176',. 'md5': 'b0005b542e5b4de643a9690326ab1257',. 'info_dict': {. 'id': '17916176',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EVHLK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18728
Entropy (8bit):	4.78593162939913
Encrypted:	false
SSDEEP:	384:YVhsHlZGVDA43Fna2NGHTYZjqMsaEfH8dZnTv6NhRz4FJ9n6SG3tbGbcfJtols5j:J4na2BVvgH8dZnTv8k91wrhxyAVJzNdV
MD5:	48C01BE80AC15FFA78EA2186659AE4EF
SHA1:	0C07720A296772AD558FF906E8F8AB8EB63B28F6
SHA-256:	06E71043DE3B8A25E5E8AE84A2DEB815F12AB1536187E9CA9E12A7D20E9115B4
SHA-512:	D63DEFEE47DDBA94FD27A76E1890476C1A9AD3B4E88F95ECB6CEDFAA571C04C8F0A6203DBA8B9D2D6B43767516D720F4AA0E9D6477F2E83326FB325417117B62
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import base64.import json.import re..from .common import InfoExtractor.from .theplatform import ThePlatformIE.from .adobepass import AdobePassIE.from ..compat import compat_urllib_parse_unquote.from ..utils import (. smuggle_url,. try_get,. update_url_query,. int_or_none,.)...class NBCIE(AdobePassIE):. _VALID_URL = r'https?(?P<permalink>://(?:www\.)?nbc\.com/(?:classic-tv/)?[^/]+/video/[^/]+/(?P<id>n?\d+))'.. _TESTS = [. {. 'url': 'http://www.nbc.com/the-tonight-show/video/jimmy-fallon-surprises-fans-at-ben-jerrys/2848237',. 'info_dict': {. 'id': '2848237',. 'ext': 'mp4',. 'title': 'Jimmy Fallon Surprises Fans at Ben & Jerry\'s',. 'description': 'Jimmy gives out free scoops of his new "Tonight Dough" ice cream flavor by surprising customers at the Ben & Jerry\'s scoop shop.',. 'timestamp': 1424246400,. 'upload_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EVHN8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.004254182535107
Encrypted:	false
SSDEEP:	24:zi8lUY2Pf1f7mUiP/AdlkcfytdZPKLPptfeIXjlgtWTk4BS:+ua1fanAnatvKjptfjXjlkWgMS
MD5:	C61999AF1F0900AD24F81076939EA93C
SHA1:	C76FE6652F1C59EA150FDC043B263A0D2976FCDC
SHA-256:	7BEFC7CC6F829554072213656592F396FD209BD79584518F1E8B1563F65B78C7
SHA-512:	B180F9F00CC5C4160B1FCC0ED608DC91280D33FEE8E5EDCB1D3232C26EEB3F5A3E0B06AE0DEE877A8B566882250A9428F106A9C5A2947A79883EFD634E0A1755
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .onet import OnetBaseIE...class VODPlIE(OnetBaseIE):. _VALID_URL = r'https?://vod\.pl/(?:[^/]+/)+(?P<id>[0-9a-zA-Z]+)'.. _TESTS = [{. 'url': 'https://vod.pl/filmy/chlopaki-nie-placza/3ep3jns',. 'md5': 'a7dc3b2f7faa2421aefb0ecaabf7ec74',. 'info_dict': {. 'id': '3ep3jns',. 'ext': 'mp4',. 'title': 'Ch.opaki nie p.acz.',. 'description': 'md5:f5f03b84712e55f5ac9f0a3f94445224',. 'timestamp': 1463415154,. 'duration': 5765,. 'upload_date': '20160516',. },. }, {. 'url': 'https://vod.pl/seriale/belfer-na-planie-praca-kamery-online/2c10heh',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). info_dict = self._extract_from_id(self._search_mvp_id(webpage), webpage). info_dict['id'] = vi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-EVQK2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.174414913724853
Encrypted:	false
SSDEEP:	24:1R8lFv8GrdXuzqfwFXjzoT/5rdltYps8OF7Ki/fzy6U3ZzVzyWVfLPwFXVIYwVLV:PuGGdXu2f+XjzoLpKs8OH/f8zy4r+XI5
MD5:	A749B00970FC9B2DD7AF1B38FEB04F9A
SHA1:	9D603548770AFDBA3A1CF1218FF0FEBCB47F50F5
SHA-256:	CCB7D0173BDB3FABA2B20EF0CAFBF4B1C96076DF4703230C3D7BB5F31A1A840A
SHA-512:	BAEAFA5D995C5F9540A6779B17624D431DB26008A0DAF8F8AA8C2DE06ED8EBAFF5924CFC1EA3414E0FBEF74B7D8D0A2134B9AADD63F349495B8EF8C780262BB5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class AlJazeeraIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?aljazeera\.com/(?:programmes\|video)/.*?/(?P<id>[^/]+)\.html'.. _TESTS = [{. 'url': 'http://www.aljazeera.com/programmes/the-slum/2014/08/deliverance-201482883754237240.html',. 'info_dict': {. 'id': '3792260579001',. 'ext': 'mp4',. 'title': 'The Slum - Episode 1: Deliverance',. 'description': 'As a birth attendant advocating for family planning, Remy is on the frontline of Tondo\'s battle with overcrowding.',. 'uploader_id': '665003303001',. 'timestamp': 1411116829,. 'upload_date': '20140919',. },. 'add_ie': ['BrightcoveNew'],. 'skip': 'Not accessible from Travis CI server',. }, {. 'url': 'http://www.aljazeera.com/video/news/2017/05/sierra-leone-709-carat-diamond-auctioned-170511100111930.html',. 'only_matching

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-F25GS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	4.883999796069656
Encrypted:	false
SSDEEP:	48:+ubl87eRxwwiqWpTjXjlkdVThVTUeVUBEBAOmVazfzkaH1mtryTL6Noe9bCF+:u7e7wgQTqoHPOWS4C1mtryTL6Noed
MD5:	E12F563EB31E58496B32E50E6AC4CD44
SHA1:	9CAD7B10F24F561F676D7A67673B4354D7996E2F
SHA-256:	4867257D8492CA2BDEC3AEDBBC2A40E7DAC9A34AAFA25D6C654216884523EB4C
SHA-512:	13F0AB0795B0F1023DB32F85E96B82B3992FA6242756A335CD8CE35BB29039578F3C058B88154EDC335AF1556815BF64EBCA2DC3C6554EDFCC60462D01C93D16
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import js_to_json...class MegaphoneIE(InfoExtractor):. IE_NAME = 'megaphone.fm'. IE_DESC = 'megaphone.fm embedded players'. _VALID_URL = r'https://player\.megaphone\.fm/(?P<id>[A-Z0-9]+)'. _TEST = {. 'url': 'https://player.megaphone.fm/GLT9749789991?"',. 'md5': '4816a0de523eb3e972dc0dda2c191f96',. 'info_dict': {. 'id': 'GLT9749789991',. 'ext': 'mp3',. 'title': '#97 What Kind Of Idiot Gets Phished?',. 'thumbnail': r're:^https://.\.png.$',. 'duration': 1776.26375,. 'author': 'Reply All',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._og_search_property('audio:title', webpage). author = self._og_search_property('audio:artist', webpage). thumb

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-F2B86.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5250
Entropy (8bit):	4.73514617157872
Encrypted:	false
SSDEEP:	96:8vOTpTnnwt45fAvt0eQffQLG3rm1tdfUN/KETTZ7gtD0QIGwAysbnKbK1vv:hTpbwtYIvt0eQ3QLArwUTZ7vgwhQKbKl
MD5:	94FC7A04F300AD8BECBEBE0FE703E9B8
SHA1:	FCF38BD20F5F3897F917A47686E0D3C9DFB85253
SHA-256:	93523A3325BDCFBB3DFEAE8F8E088920CEC55BC9C6CABA890E08431AF9C48937
SHA-512:	AF15A60DE8412AA90EAB2D57087745BE0283F10D54BC068BE5727BEA460DAF5A9F77D0BE37B3F5CE321B2559C77B12BA9CA6BA6DC4AB7FC84D6439CB326F6AAD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import functools..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. clean_html,. float_or_none,. int_or_none,. try_get,. unified_timestamp,. OnDemandPagedList,.)...class ACastIE(InfoExtractor):. IE_NAME = 'acast'. _VALID_URL = r'''(?x). https?://. (?:. (?:(?:embed\|www)\.)?acast\.com/\|. play\.acast\.com/s/. ). (?P<channel>[^/]+)/(?P<id>[^/#?]+). '''. _TESTS = [{. 'url': 'https://www.acast.com/sparpodcast/2.raggarmordet-rosterurdetforflutna',. 'md5': '16d936099ec5ca2d5869e3a813ee8dc4',. 'info_dict': {. 'id': '2a92b283-1a75-4ad8-8396-499c641de0d9',. 'ext': 'mp3',. 'title': '2. Raggarmordet - R.ster ur det f.rflutna',. 'description': '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-F66CR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6250
Entropy (8bit):	4.473286912003052
Encrypted:	false
SSDEEP:	192:TGJ4LNBDqvmEYLORIAlQGiTOt+Hil8TodTT79JCjOvPoKgw+V6Ng:SJ4LLevmzLOSsQROt+HiGodTTRgjOvPi
MD5:	4B1441FFBCA519D2510F65128E936A16
SHA1:	2B6C6704756831F2564D433828E02298F93F03BC
SHA-256:	E64C5C2FE93D040635547885A603187A345A38E0F8002F2998B7AFDB7598C2DC
SHA-512:	EAECAE1B882D40BBED77CF3B19565310C99B4DC3601BA5293D6F4B38F0CB6D7269EABEE5CA51DA86801153B1A3078B0B7BA9E69068F502DAC7E38FC58561A1CF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. unified_strdate,. HEADRequest,. int_or_none,.)...class WatIE(InfoExtractor):. _VALID_URL = r'(?:wat:\|https?://(?:www\.)?wat\.tv/video/.*-)(?P<id>[0-9a-z]+)'. IE_NAME = 'wat.tv'. _TESTS = [. {. 'url': 'http://www.wat.tv/video/soupe-figues-l-orange-aux-epices-6z1uz_2hvf7_.html',. 'info_dict': {. 'id': '11713067',. 'ext': 'mp4',. 'title': 'Soupe de figues . l\'orange et aux .pices',. 'description': 'Retrouvez l\'.mission "Petits plats en .quilibre", diffus.e le 18 ao.t 2014.',. 'upload_date': '20140819',. 'duration': 120,. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'expected_warnings

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-F8OEK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3490
Entropy (8bit):	4.604896251649444
Encrypted:	false
SSDEEP:	96:a5p0O/Xgp7ogZ8yXjCcKDqFhfae4b6yOb+0MibFGBTUx36Ng:eGxp7FZqv+Fpaes6yOb+0MibFiTUl6Ng
MD5:	ED0F59401F0BCB6132B8631377967D2F
SHA1:	7188471D1215743E654B3A00B3FF4CEC42BFCBE6
SHA-256:	DFA3E4CA41BF8961D660BFDF30C57038D26CB9B4099E8046A00373BC1C013A02
SHA-512:	7F2A21DAA771B7D1C0C2804E63BA5A99D7B2F38D09A7DC1B2A70E0655102C703B795E1321C6AA492200D3E3BBA08CE8A23E992CAED9728A4199F4A04C80CF50A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .canvas import CanvasIE.from .common import InfoExtractor...class KetnetIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ketnet\.be/(?:[^/]+/)(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.ketnet.be/kijken/zomerse-filmpjes',. 'md5': '6bdeb65998930251bbd1c510750edba9',. 'info_dict': {. 'id': 'zomerse-filmpjes',. 'ext': 'mp4',. 'title': 'Gluur mee op de filmset en op Pennenzakkenrock',. 'description': 'Gluur mee met Ghost Rockers op de filmset',. 'thumbnail': r're:^https?://.\.jpg$',. }. }, {. # mzid in playerConfig instead of sources. 'url': 'https://www.ketnet.be/kijken/nachtwacht/de-greystook',. 'md5': '90139b746a0a9bd7bb631283f6e2a64e',. 'info_dict': {. 'id': 'md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'display_id': 'md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'ext': 'f

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FADFS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19413
Entropy (8bit):	4.41428319684233
Encrypted:	false
SSDEEP:	384:pNddIVTfsWfgWeNNStV7tuYaNOVruvd2zgzLAit+Z9cTQV6NV6F0Yg:4VBfYNSzZRaNOVruvd2zgzLAi8Z9cTQ8
MD5:	E5C21C5CE8F71FDA99DF2882B7AFBEB0
SHA1:	6FC7FA0A38309E5975CF94B6125EF67ECB8D3184
SHA-256:	FA1C5361AB1B4BD71D747D25A40A8796C1F26334EC13D5081B3E5CA899B94CF4
SHA-512:	276FF805B74EF482A4E3A25A0A7BCB4EE4810E271921D596BD9BE1890DBF8D6E78A0B1730AB2DCBBF64DD6492ABDAAC11C63A7E16DDC0D6BA6EF074AF95B8B69
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_kwargs,. compat_str,. compat_urllib_request,. compat_urlparse,.).from ..utils import (. determine_ext,. extract_attributes,. ExtractorError,. float_or_none,. int_or_none,. js_to_json,. sanitized_Request,. try_get,. unescapeHTML,. url_or_none,. urlencode_postdata,.)...class UdemyIE(InfoExtractor):. IE_NAME = 'udemy'. _VALID_URL = r'''(?x). https?://. (?:[^/]+\.)?udemy\.com/. (?:. [^#]+\#/lecture/\|. lecture/view/?\?lectureId=\|. [^/]+/learn/v4/t/lecture/. ). (?P<id>\d+). '''. _LOGIN_URL = 'https://www.udemy.com/join/login-popup/?displayType=ajax&showSkipButton=1'. _ORIGIN_URL = 'https://ww

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FEMCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1258
Entropy (8bit):	4.70875208862107
Encrypted:	false
SSDEEP:	24:1R8lWUwtZ0MYBYaF51YXieRsQGPsierkC6BEYgCDhnfXCfCcxKRp0v:Pu8XrYBYabpeRsQGperIWgfXC6cxKRG
MD5:	2832786542D2DE7105820335D1D7E8AE
SHA1:	D2B726F46C655FEE3B5DBA1F61F5488D078A1E8B
SHA-256:	CFACBF2E258304764172E31E4FBEDD1CFF747BB628EF10145FA620D44429A018
SHA-512:	212668B33DD7A7BE48DAE89A00B2DA95EDCE276493832CFF71537FDE563B8E73649BE9BBF99DEEDC9316C3479A7369111AAC546332092EE3C6858D7677B24469
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..try:. from .lazy_extractors import . from .lazy_extractors import _ALL_CLASSES. _LAZY_LOADER = True.except ImportError:. _LAZY_LOADER = False. from .extractors import .. _ALL_CLASSES = [. klass. for name, klass in globals().items(). if name.endswith('IE') and name != 'GenericIE'. ]. _ALL_CLASSES.append(GenericIE)...def gen_extractor_classes():. """ Return a list of supported extractors.. The order does matter; the first extractor matched is the one handling the URL.. """. return _ALL_CLASSES...def gen_extractors():. """ Return a list of an instance of every supported extractor.. The order does matter; the first extractor matched is the one handling the URL.. """. return [klass() for klass in gen_extractor_classes()]...def list_extractors(age_limit):. """. Return a list of extractors that are suitable for the given age,. sorted by extractor ID.. """.. return sor

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FH08A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3323
Entropy (8bit):	4.8911573714337955
Encrypted:	false
SSDEEP:	96:MHBkmyfT9kvmXGVQnuffpoP7k7kMzJPO8gi8y3BT06N23:wBCTavHVQeTkMzRO8gi8AT06NW
MD5:	770C8A51F1369F5DC73BBD5E80DC2BD2
SHA1:	96CACE1F4CD8A3EF6CA792D4C374D4FEA9374D54
SHA-256:	C98FC1FFE6D3AAD9470FCFADA9D31DC3B465D41B64521D9E86EFB09DE541183C
SHA-512:	4EA26B68513EBF8248F40EB30EEE6D9EE6DA8E4D22CF79B45C91A67ADCD6149628DC20F9CB8BC99D0E52335B537E827031159652720172C42BBB36B785A7E4EF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class BloombergIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bloomberg\.com/(?:[^/]+/)*(?P<id>[^/?#]+)'.. _TESTS = [{. 'url': 'http://www.bloomberg.com/news/videos/b/aaeae121-5949-481e-a1ce-4562db6f5df2',. # The md5 checksum changes. 'info_dict': {. 'id': 'qurhIVlJSB6hzkVi229d8g',. 'ext': 'flv',. 'title': 'Shah\'s Presentation on Foreign-Exchange Strategies',. 'description': 'md5:a8ba0302912d03d246979735c17d2761',. },. 'params': {. 'format': 'best[format_id^=hds]',. },. }, {. # video ID in BPlayer(...). 'url': 'http://www.bloomberg.com/features/2016-hello-world-new-zealand/',. 'info_dict': {. 'id': '938c7e72-3f25-4ddb-8b85-a9be731baa74',. 'ext': 'flv',. 'title': 'Meet the Real-Life Tech Wizards of Middle Earth',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FH820.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	23622
Entropy (8bit):	4.811907792779558
Encrypted:	false
SSDEEP:	384:rauu1Onrj12X7jjMeim7UyVOWvoW6w/aE9UC+02i7iOlb2gcYdBPHyC76U+1ZYzI:rauu1OnhyVOWvoW6w/aE9UC+02i7iOlu
MD5:	43DE221222B7CDED45B54893D9E7D6AF
SHA1:	E62B39AEDB15D247EDCC556B8CFBFAAB36183516
SHA-256:	9DB690EA5A0D4D6DF1845EBDF8D553AD7D5F36EDE5BEA925F093A24D735820A0
SHA-512:	1EC9B418BF517024292C252DC83FE96F6B9C66FC372EEFA8304A7284D1E6D02DDD501D5B4D9C489C181E141DCE76C665B442715CB81F1C0A22B491500383BFEA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. determine_ext,. dict_get,. ExtractorError,. float_or_none,. int_or_none,. remove_end,. try_get,. xpath_text,.)..from .periscope import PeriscopeIE...class TwitterBaseIE(InfoExtractor):. def _extract_formats_from_vmap_url(self, vmap_url, video_id):. vmap_data = self._download_xml(vmap_url, video_id). video_url = xpath_text(vmap_data, './/MediaFile').strip(). if determine_ext(video_url) == 'm3u8':. return self._extract_m3u8_formats(. video_url, video_id, ext='mp4', m3u8_id='hls',. entry_protocol='m3u8_native'). return [{. 'url': video_url,. }].. @staticmethod. def _search_dimensions_in_video_url(a_format, video_url):. m = re.search(r'/(?P<width>\d+)x(?P<height>\d+)/', video_url). if m:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FHDK8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3050
Entropy (8bit):	4.675218005963205
Encrypted:	false
SSDEEP:	48:+uXAKcu74AI51B9I5dJGmgqnuYadfFBXb74eHvVb9xkFzEB9Huu/pLN8EaB6IYB0:zAKl74t51Y5d4mznuYaR7PPkzIldN8EU
MD5:	D7031F2BBCC679C5F1F1EDD545E53760
SHA1:	B73116BB039EE35033C03293AC84B720F23528FF
SHA-256:	6122F2C4FA2C92F1EEBBB993FE76C6B3DE406333D53CBD8AFC6813F306D76611
SHA-512:	58FEF9D078F2B394245FCA693FF157B0A410E29C97FAD607EA48A9A30D37AD5A1E68F8148DD396ADD2E9732A1ABEC1EE099FB44D9DEC70384E21ED5D6EFEB5C4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. js_to_json,. parse_iso8601,.)...class NetzkinoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?netzkino\.de/\#!/(?P<category>[^/]+)/(?P<id>[^/]+)'.. _TEST = {. 'url': 'http://www.netzkino.de/#!/scifikino/rakete-zum-mond',. 'md5': '92a3f8b76f8d7220acce5377ea5d4873',. 'info_dict': {. 'id': 'rakete-zum-mond',. 'ext': 'mp4',. 'title': 'Rakete zum Mond (Endstation Mond, Destination Moon)',. 'comments': 'mincount:3',. 'description': 'md5:1eddeacc7e62d5a25a2d1a7290c64a28',. 'upload_date': '20120813',. 'thumbnail': r're:https?://.*\.jpg$',. 'timestamp': 1344858571,. 'age_limit': 12,. },. 'params': {. 'skip_download': 'Download only works from Germany',. }. }.. def _r

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FJ8D3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3833
Entropy (8bit):	4.909891678616098
Encrypted:	false
SSDEEP:	96:KOIc3Ojz6n1dxUXEakvqfQGNh5ETcxE5GLTdgEz+0LkzcBTeKhSt46NZchsz8zcg:HR6ax5kQs5EgxE5ATdgEz+0Lkz0Tbf6e
MD5:	15A9EF73790F58B8BCA71D1356D2CDA6
SHA1:	0CD89B8C335BA776F7491E52957E85F39447A63E
SHA-256:	F5171F0163546A19D4EEA3AD616CAA3C1C085F13941E7D0AF81092E8A5DF7893
SHA-512:	86E236D64BC074F742FD2D7660608337FE43FFE90B782D2607260BB2FC54A6966C483B936719638FA7D6788ED86F30175DFB064E5DBDFD3B9B53960C1B69027B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. xpath_text,.)...class WebcasterIE(InfoExtractor):. _VALID_URL = r'https?://bl\.webcaster\.pro/(?:quote\|media)/start/free_(?P<id>[^/]+)'. _TESTS = [{. # http://video.khl.ru/quotes/393859. 'url': 'http://bl.webcaster.pro/quote/start/free_c8cefd240aa593681c8d068cff59f407_hd/q393859/eb173f99dd5f558674dae55f4ba6806d/1480289104?sr%3D105%26fa%3D1%26type_id%3D18',. 'md5': '0c162f67443f30916ff1c89425dcd4cd',. 'info_dict': {. 'id': 'c8cefd240aa593681c8d068cff59f407_hd',. 'ext': 'mp4',. 'title': '...... - ........... ...... ....... ....... .......',. 'thumbnail': r're:^https?://.*\.jpg$',. },. }, {. 'url': 'http://bl.webcaster.pro/media/start/free_6246c7a4453ac4c42b4398f840d13100_hd/2_2991109016/e8d0d82587ef435480118

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FKHSS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15696
Entropy (8bit):	4.499991049023078
Encrypted:	false
SSDEEP:	384:IoeRW2eiGPKqMpE6Hi8g5aEcLKOWqi8V+TLf6NMqEukpuKHsefuSQ7M7M4uCyl:IoeRW2eiGPKqMpE6Hi8iaEcLKOWqi8Vn
MD5:	D2FE053EE0ED9F30C30434919E186F75
SHA1:	8808EB28FF487D9628B14DC5DAB06A29D0736254
SHA-256:	77058658EC1312D3395CB4630BAF12F7E02E654D3DD16E698C3D456618040DB9
SHA-512:	8AB3F7B7A10C63B5F1F1364E575988FAAAB629086A37094C43DBFC7E6F4C2DAA8370F66B4CA5DE949CB667524D6906020D334762AAC6EB3B1B6699B36C83D254
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. smuggle_url,. try_get,. unsmuggle_url,. ExtractorError,.)...class LimelightBaseIE(InfoExtractor):. _PLAYLIST_SERVICE_URL = 'http://production-ps.lvp.llnw.net/r/PlaylistService/%s/%s/%s'. _API_URL = 'http://api.video.limelight.com/rest/organizations/%s/%s/%s/%s.json'.. @classmethod. def _extract_urls(cls, webpage, source_url):. lm = {. 'Media': 'media',. 'Channel': 'channel',. 'ChannelList': 'channel_list',. }.. def smuggle(url):. return smuggle_url(url, {'source_url': source_url}).. entries = []. for kind, video_id in re.findall(. r'LimelightPlayer\.doLoad(Media\|Channel\|ChannelList)\(["\'](?P<id>[a-z0-9]{32})',. webpage):. entries

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FLFTL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4044
Entropy (8bit):	4.858410482605622
Encrypted:	false
SSDEEP:	96:SDP3bOx0O1JcLurEKtU9K2EX5jlnTWfWFBrEolX3/PhSa6JY1tNR:ArLZaU9Kfc3oF/PYjY/
MD5:	7D01061A5FE8B956DA75494E098688F4
SHA1:	8641A1738CED8E03CA6BFCB696E8626AABE9CAE9
SHA-256:	C0680066C0B9EEB0618E42DBD237FD077FDD332843F31584BD6AA24478B103C1
SHA-512:	70226AFA07313595E54DD876F06E8FF0FA7B5C5F8635EB2A4190C0435FBA35853BFCDDA099A117088FFCB96BDC4FF7D37B869349163664EE130F73C0B07A3ABE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .cbs import CBSIE.from ..utils import int_or_none...class CBSInteractiveIE(CBSIE):. _VALID_URL = r'https?://(?:www\.)?(?P<site>cnet\|zdnet)\.com/(?:videos\|video(?:/share)?)/(?P<id>[^/?]+)'. _TESTS = [{. 'url': 'http://www.cnet.com/videos/hands-on-with-microsofts-windows-8-1-update/',. 'info_dict': {. 'id': 'R49SYt__yAfmlXR85z4f7gNmCBDcN_00',. 'display_id': 'hands-on-with-microsofts-windows-8-1-update',. 'ext': 'mp4',. 'title': 'Hands-on with Microsoft Windows 8.1 Update',. 'description': 'The new update to the Windows 8 OS brings improved performance for mouse and keyboard users.',. 'uploader_id': '6085384d-619e-11e3-b231-14feb5ca9861',. 'uploader': 'Sarah Mitroff',. 'duration': 70,. 'timestamp': 1396479627,. 'upload_date': '20140402',. },. 'params': {. # m3u8 do

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FO5SV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10734
Entropy (8bit):	4.6932483481457545
Encrypted:	false
SSDEEP:	192:sXiAADymxRqpqUUvSvAJNu63lBTbCx6NOA4l0CrGMD/hJaIvl9tpTGEwJa3EijSG:sX/ADymxRqpqUECAJNB3lBT+x6N3s0p8
MD5:	DDAEEA884CA50E7B64CFC42E24C0C0EA
SHA1:	ED97B178A581530F5D25F86D4D65FDE493D17279
SHA-256:	D34C8213ACECFD6F780019AB4AF4634DA6BE3A1507DD7AFB612A288C3233D126
SHA-512:	5742000ECCDB3D48CE9C88E74E7A98D537751AA67F86D723FB1C12F6FEEFC52F3B79B11A9DCA7215B68DDBC73680F3AAFD3B449C54C84AC8BCDFE42A7647341C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. orderedSet,. parse_duration,. str_or_none,. unified_strdate,. url_or_none,. xpath_element,. xpath_text,.)...class VideomoreIE(InfoExtractor):. IE_NAME = 'videomore'. _VALID_URL = r'''(?x). videomore:(?P<sid>\d+)$\|. https?://(?:player\.)?videomore\.ru/. (?:. (?:. embed\|. [^/]+/[^/]+. )/\|. [^/]\?.?\btrack_id=. ). (?P<id>\d+). (?:[/?#&]\|\.(?:xml\|json)\|$). '''. _TESTS = [{. 'url': 'http://videomore.ru/kino_v_detalayah/5_sezon/367617',. 'md5': '44455a346edc0d509ac5b5a5b531dc35',. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FOB5F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3876
Entropy (8bit):	4.547501276569046
Encrypted:	false
SSDEEP:	96:4OVqcg8BvFcvf3l3lLSY/G/gGJKJUoNGu+Or+EVXBPMBTg6Nv8rd:N0bGvFy3Z9aOr+E5dkTg6N05
MD5:	5C743916395E5EE49DF5BDE26DF7C183
SHA1:	1AA5C1A06B55EB5AF4FFE474C33B2D27E91B0B82
SHA-256:	D11D207A146BA17F376E5509392235ACDDF23A05DFC19E7EC56D5CBC786E478B
SHA-512:	9E576AA379E9659374AD542CD779AE12AE465E0A752245EF07AD838DAD357E575A77CC1D3328EC7D9D3DF9A100246664906B1FFAF8AFD6D48A64AA5A611EA3DC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote.from ..utils import (. clean_html,. determine_ext,. ExtractorError,. int_or_none,. parse_duration,.)...class XVideosIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. (?:www\.)?xvideos\.com/video\|. flashservice\.xvideos\.com/embedframe/\|. static-hw\.xvideos\.com/swf/xv-player\.swf\?.*?\bid_video=. ). (?P<id>[0-9]+). '''. _TESTS = [{. 'url': 'http://www.xvideos.com/video4588838/biker_takes_his_girl',. 'md5': '14cea69fcb84db54293b1e971466c2e1',. 'info_dict': {. 'id': '4588838',. 'ext': 'mp4',. 'title': 'Biker Takes his Girl',. 'duration': 108,. 'age_limit': 18,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FPTC4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3192
Entropy (8bit):	4.840244227579824
Encrypted:	false
SSDEEP:	96:6x0wsY7JKrpUdsjSEDzZAbdpMxEzmSiDYTQy:ynNKecYbfkQkDoQy
MD5:	13588B76729DE2B4F6D3DBEB96290E19
SHA1:	07003E547A78EA7B8F2F4F6B07D92BA88B16C786
SHA-256:	FCC828AEF454A2071DAC9C3453912B71988E267D8FADC073CBDAEA4F38142692
SHA-512:	8B6E29E5E987457534E323F097362AC90F6FE36ED2C0DC0644C5EF40C8302617A1BFCF77AE26077B8AFE94ECED0BE57D13712A7D3FC1261373F905771AC157A9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor..from ..utils import (. extract_attributes,.)...class BostonGlobeIE(InfoExtractor):. _VALID_URL = r'(?i)https?://(?:www\.)?bostonglobe\.com/.*/(?P<id>[^/]+)/\w+(?:\.html)?'. _TESTS = [. {. 'url': 'http://www.bostonglobe.com/metro/2017/02/11/tree-finally-succumbs-disease-leaving-hole-neighborhood/h1b4lviqzMTIn9sVy8F3gP/story.html',. 'md5': '0a62181079c85c2d2b618c9a738aedaf',. 'info_dict': {. 'title': 'A tree finally succumbs to disease, leaving a hole in a neighborhood',. 'id': '5320421710001',. 'ext': 'mp4',. 'description': 'It arrived as a sapling when the Back Bay was in its infancy, a spindly American elm tamped down into a square of dirt cut into the brick sidewalk of 1880s Marlborough Street, no higher than the first bay window of the new brownstone behind it.',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FSJCI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5327
Entropy (8bit):	4.669288048357848
Encrypted:	false
SSDEEP:	96:rOqAeAKnRbVcteU7wj42UaqYtou6kfEMh7OqyPDoruSAoBTIp2Ll6NDpA2QIaOmq:a9elccyu6SEMhnoDoruDoTE2h6NDWR7q
MD5:	7816E6DE9B3D20C41FC612FCEA2D8053
SHA1:	720A937A0299BFCEEF64EC5AD8D143D32162A260
SHA-256:	9D259AF5E62CE92DB65EFD61F6D14ABEB0631E7C2B98BE946DA85DEDF025950C
SHA-512:	8CFB303BD56984335EB9560679591E965FB3B5982E15217F1D340935FC1ECEDEB2C409378C7080DF6179DEE951308D2DFDB195735C17A94C860DA723034F2ACE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. int_or_none,. unified_timestamp,.)...class VineIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vine\.co/(?:v\|oembed)/(?P<id>\w+)'. _TESTS = [{. 'url': 'https://vine.co/v/b9KOOWX7HUx',. 'md5': '2f36fed6235b16da96ce9b4dc890940d',. 'info_dict': {. 'id': 'b9KOOWX7HUx',. 'ext': 'mp4',. 'title': 'Chicken.',. 'alt_title': 'Vine by Jack',. 'timestamp': 1368997951,. 'upload_date': '20130519',. 'uploader': 'Jack',. 'uploader_id': '76',. 'view_count': int,. 'like_count': int,. 'comment_count': int,. 'repost_count': int,. },. }, {. 'url': 'https://vine.co/v/e192BnZnZ9V',. 'info_dict': {. 'id': 'e192BnZnZ9V',. 'e

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FTBUO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1958
Entropy (8bit):	5.004791128444898
Encrypted:	false
SSDEEP:	48:+uy+mq3kqXrWksLuia9QbWBTCXBE3fzcfvKfFILa5j9dkI/RR:uFq3k4W8ioBTCXSvzcfvnm8I/RR
MD5:	3D71DF35A5150DBCB5AD12118D6189BC
SHA1:	EADBD9675637E3C4A306C5A79B91699E7E5A3EBA
SHA-256:	1CC95014E85E8ABEA50629EA6771FFDAB4B45E4A0E727B35686646217E0271DE
SHA-512:	37B8290438204798BF0E80A0A81B500193B9E6684057E1263A2AEE6E4D9EC0E1376E8A8097EAEBC44CBD7636B1713244C6B8FCDC4088E7AA62F15CCC549CD905
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_parse_qs.from ..utils import ExtractorError...class BokeCCBaseIE(InfoExtractor):. def _extract_bokecc_formats(self, webpage, video_id, format_id=None):. player_params_str = self._html_search_regex(. r'<(?:script\|embed)[^>]+src="http://p\.bokecc\.com/player\?([^"]+)',. webpage, 'player params').. player_params = compat_parse_qs(player_params_str).. info_xml = self._download_xml(. 'http://p.bokecc.com/servlet/playinfo?uid=%s&vid=%s&m=1' % (. player_params['siteid'][0], player_params['vid'][0]), video_id).. formats = [{. 'format_id': format_id,. 'url': quality.find('./copy').attrib['playurl'],. 'preference': int(quality.attrib['value']),. } for quality in info_xml.findall('./video/quality')].. self._sort_formats(formats).. return

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FU44R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2310
Entropy (8bit):	4.850053854109523
Encrypted:	false
SSDEEP:	48:+uf7oflwGvdT7dWflwG6tTKwGnjXjZukdV5VEeVxJJKaVTtXpcuX7VZa6AtNfA6u:nKWedT7dWfWpje7oOJKqf7gtNfA6Ng
MD5:	451B818EF5563F000B5E77340986170F
SHA1:	F88A7D41D21F5DF9A92C000529C8A3ECDD5BB7F7
SHA-256:	3359D8759CD15E0A4A3D5CB695402236BA06A341953833FC456EE9B685364E96
SHA-512:	D9E791C0549810C5E6C36555975A0304063A39D7925B1E9FFDBF9736875ECF0B2278FF100A2A5D4E204B24010799C2DEE62223C8F573C9F15650C5C5F1989E8F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. js_to_json,. mimetype2ext,.)...class MusicPlayOnIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?musicplayon\.com/play(?:-touch)?\?(?:v\|pl=\d+&play)=(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://en.musicplayon.com/play?v=433377',. 'md5': '00cdcdea1726abdf500d1e7fd6dd59bb',. 'info_dict': {. 'id': '433377',. 'ext': 'mp4',. 'title': 'Rick Ross - Interview On Chelsea Lately (2014)',. 'description': 'Rick Ross Interview On Chelsea Lately',. 'duration': 342,. 'uploader': 'ultrafish',. },. }, {. 'url': 'http://en.musicplayon.com/play?pl=102&play=442629',. 'only_matching': True,. }].. _URL_TEMPLATE = 'http://en.musicplayon.com/play?v=%s'.. def _real_extract(self, url):. video_id = self._mat

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-FV945.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1850
Entropy (8bit):	4.808888443573978
Encrypted:	false
SSDEEP:	48:+ug126CnAZBXoz8ajXjlkCBwV4GNKsCEQEIZN1RD18vH4s:e26CnAZBXoz8aqlVtIFdEON1MvH5
MD5:	25BF6C2695974CF2A527DE23AFEFB29A
SHA1:	CA0AF50E5883E3C90352B3F308D56652233935BC
SHA-256:	5E9B3EAFCA7371BD858368AB00AC46900BB34C9763B2E59910B4116890475D24
SHA-512:	7FAADA3B53C48205DB982572EFD13D6B92146AB421D6E53604181A3945E4F78AB3BB4BC03308EB7171E80174880D6986A98FE47D5A22288C8DA0248744A4CB18
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_duration,. parse_iso8601,.)...class HuajiaoIE(InfoExtractor):. IE_DESC = '....'. _VALID_URL = r'https?://(?:www\.)?huajiao\.com/l/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.huajiao.com/l/38941232',. 'md5': 'd08bf9ac98787d24d1e4c0283f2d372d',. 'info_dict': {. 'id': '38941232',. 'ext': 'mp4',. 'title': '#.....#',. 'description': 're:.',. 'duration': 2424.0,. 'thumbnail': r're:^https?://.\.jpg$',. 'timestamp': 1475866459,. 'upload_date': '20161007',. 'uploader': 'Penny_...',. 'uploader_id': '75206005',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. feed_json = self._search_regex(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-G25F2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2686
Entropy (8bit):	4.785109406373677
Encrypted:	false
SSDEEP:	48:PuBYWNfrCeCUPe/CUPHeRzXrEmK6xC3tfdfFfu1dhXf5MqGMkbBCVSmXn0UcNeVL:DCr+76WeFXrEmKuOfbuFP5MdMJ05NR4V
MD5:	F1D2C449DA9CAEAF787FD208CFDB79E6
SHA1:	0813D179ADD0A2A8CC399CF4E49D6FAE98A36B3F
SHA-256:	62E8FC1D7269A5BD54A101A77126A5D7DAF2EF8B2C46F8D8130205D5D98F4A38
SHA-512:	2C7D43538464F27EEE57497E9BF8AD2920A9488233E11F7B2E29BC28702E5CB48BCA30C9E8EE9E2DBB37F62DEA994B8F49F6F838AAE83D9212DFC23A7895CEDA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,. int_or_none,. unified_timestamp,.)...class PopcornTVIE(InfoExtractor):. _VALID_URL = r'https?://[^/]+\.popcorntv\.it/guarda/(?P<display_id>[^/]+)/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://animemanga.popcorntv.it/guarda/food-wars-battaglie-culinarie-episodio-01/9183',. 'md5': '47d65a48d147caf692ab8562fe630b45',. 'info_dict': {. 'id': '9183',. 'display_id': 'food-wars-battaglie-culinarie-episodio-01',. 'ext': 'mp4',. 'title': 'Food Wars, Battaglie Culinarie \| Episodio 01',. 'description': 'md5:b8bea378faae4651d3b34c6e112463d0',. 'thumbnail': r're:^https?://.*\.jpg$',. 'timestamp': 1497610857,. 'upload_date': '20170616',. 'duration': 1440,. 'view_count': int,. },. }, {. 'url': 'https://cinema.popcorn

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-G2L9T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	888
Entropy (8bit):	4.97015592308401
Encrypted:	false
SSDEEP:	24:1R8lQvNGkw5WU3V/uldlmyBUVukcSeIXhgtwBQYtI5WVE:PuQlL8tulqyBWPvjXhkwBDlE
MD5:	D9BFA38F328444CB9B5230A71A02AF80
SHA1:	74A0285FA6C4A42F3A686993900A0B8DD5A230A8
SHA-256:	8B70F24EDC9D07DECB476A9F78F3EFC71C2EF69F4229125A74F65C041626FB1F
SHA-512:	63CF8F90C701D6E457AA75D8C9D576EA4A6340D57E3C4A39236E50E25946061221847AC5CC449FBA76671FFFDB98B7B52ECF9B37A940BAD78CDF4CF4371BF335
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .nuevo import NuevoBaseIE...class AnitubeIE(NuevoBaseIE):. IE_NAME = 'anitube.se'. _VALID_URL = r'https?://(?:www\.)?anitube\.se/video/(?P<id>\d+)'.. _TEST = {. 'url': 'http://www.anitube.se/video/36621',. 'md5': '59d0eeae28ea0bc8c05e7af429998d43',. 'info_dict': {. 'id': '36621',. 'ext': 'mp4',. 'title': 'Recorder to Randoseru 01',. 'duration': 180.19,. },. 'skip': 'Blocked in the US',. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). key = self._search_regex(. r'src=["\']https?://[^/]+/embed/([A-Za-z0-9_-]+)', webpage, 'key').. return self._extract_nuevo(. 'http://www.anitube.se/nuevo/econfig.php?key=%s' % key, video_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-G38VG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4554
Entropy (8bit):	4.838735892546165
Encrypted:	false
SSDEEP:	96:lOP2uHQaCvP6/aBez3fBKmNI7JTEwarRlSdpLOl3wGCoBT06NVjxpM3EYV+NMVRb:0+0JCvP6/aBeTBDI78C3LOl3wvoT06N2
MD5:	04808F307E248E4E92BEDB323E4FEABD
SHA1:	95F41D8CE8CD3CC5DE38255019BEE572EB475668
SHA-256:	C136541F4DA7D076F635EC384ADE99AD48C40A5132D919E37123980CF1DAED4B
SHA-512:	C8BE993D86D105B4366CD5D6E8A246C634BA9C01B7F1D66FBD2B94224AD9A4D88763CE458F3EA211FFACFD4E119507A3B0E9138CA67D00B095B8A6FF5BF65A2F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. mimetype2ext,. parse_duration,. qualities,. url_or_none,.)...class ImdbIE(InfoExtractor):. IE_NAME = 'imdb'. IE_DESC = 'Internet Movie Database trailers'. _VALID_URL = r'https?://(?:www\|m)\.imdb\.com/(?:video\|title\|list).+?[/-]vi(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.imdb.com/video/imdb/vi2524815897',. 'info_dict': {. 'id': '2524815897',. 'ext': 'mp4',. 'title': 'No. 2 from Ice Age: Continental Drift (2012)',. 'description': 'md5:87bd0bdc61e351f21f20d2d7441cb4e7',. }. }, {. 'url': 'http://www.imdb.com/video/_/vi2524815897',. 'only_matching': True,. }, {. 'url': 'http://www.imdb.com/title/tt1667889/?ref_=ext_shr_eml_vi#lb-vi2524815897',. 'only_matching': True,. }, {. 'url': 'http://www.imdb.com/title/tt1667889/#lb-vi252481

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-G4FR5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10837
Entropy (8bit):	4.973651487064187
Encrypted:	false
SSDEEP:	192:X3vCZHbEJbBOKbxEFbGnEN/bK/4H4RcAqGoQ4yH3GmZ82Rt4/AadJqRvirVuqY5B:X6ZHG5oCO/bKSRAqGoQXXr82RtOAaJqt
MD5:	CD82DB2F362BC38C5362A6ACF02ED8FD
SHA1:	2D8FF49F77BDFB68CABC50D9D37EA183D2792E34
SHA-256:	B530F4FF5EE36E9791F4B899D540C2E1B8C8058FFDCBD4B1C39D489F6C07BBB1
SHA-512:	722679D2E34FD41F96E121B34166336176C673859EF2B695E8662581A5A3683F546EB8E9C5D0424C0698F62B16836BAFBB06EE4DEC94B66FEDF67C8A7AFD7F7C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .mtv import MTVServicesInfoExtractor.from ..utils import update_url_query...class NickIE(MTVServicesInfoExtractor):. # None of videos on the website are still alive?. IE_NAME = 'nick.com'. _VALID_URL = r'https?://(?P<domain>(?:(?:www\|beta)\.)?nick(?:jr)?\.com)/(?:[^/]+/)?(?:videos/clip\|[^/]+/videos)/(?P<id>[^/?#.]+)'. _FEED_URL = 'http://udat.mtvnservices.com/service1/dispatch.htm'. _GEO_COUNTRIES = ['US']. _TESTS = [{. 'url': 'http://www.nick.com/videos/clip/alvinnn-and-the-chipmunks-112-full-episode.html',. 'playlist': [. {. 'md5': '6e5adc1e28253bbb1b28ab05403dd4d4',. 'info_dict': {. 'id': 'be6a17b0-412d-11e5-8ff7-0026b9414f30',. 'ext': 'mp4',. 'title': 'ALVINNN!!! and The Chipmunks: "Mojo Missing/Who\'s The Animal" S1',. 'description': 'Alvin is convinced his mojo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-G9RIF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4244
Entropy (8bit):	4.600681394565451
Encrypted:	false
SSDEEP:	96:YOH8pwIBwXj3biKo8c3znj8/l3s1odXLOr3v09mvBTXVN1NlWt/8Z6Ng:tcpLBeeKuj+yWpLOr3v09oTXzZ6Ng
MD5:	1B1393C5563772DA3F1F17E638DAD53C
SHA1:	BB1C088CBF8FF1F05313AB149963C32A2255E4BF
SHA-256:	2FC65FEE98B7EA6554E10E8FC2AA591CB6D263D4238555B4D4D7CB2416307B60
SHA-512:	8E82E29AE3BA0E638881104D6F11009A9210436E137BBE4E44476EDBDEFA17960CC582141566C875E6F01535F47F58C82271799DCB2A4F09648D269DCA4B1E0E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. xpath_text,. qualities,.)...class PladformIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. (?:. out\.pladform\.ru/player\|. static\.pladform\.ru/player\.swf. ). \?.*\bvideoid=\|. video\.pladform\.ru/catalog/video/videoid/. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'https://out.pladform.ru/player?pl=64471&videoid=3777899&vk_puid15=0&vk_puid34=0',. 'md5': '53362fac3a27352da20fa2803cc5cd6f',. 'info_dict': {. 'id': '3777899',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GB1QD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4651
Entropy (8bit):	4.551468860224716
Encrypted:	false
SSDEEP:	96:TOjuso9Tl7tdwGT1+iCTCidveZ2d+2dkBFGMSQ7bwIpgDq6:ixk/NZalv+I+2wjSpBq6
MD5:	B25E0666BB2F998775F5F8731E322920
SHA1:	E456F7AD30C0E1072D05013FC15F78EA596C04D1
SHA-256:	BA898D1591CDB12F2DF23AF5F53C1A1BC9B30CA6848B9097F96279A218F4D16B
SHA-512:	43BDD2AAE568584BD9537FE34A697BF0E4F395E8DD24A7DEBE71E652BD47ECDE204BBC052A1360BBF79D696C49B44F12004396EF3D78F127E2A65C0E65C0A010
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. int_or_none,. parse_iso8601,.)...class PatreonIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?patreon\.com/(?:creation\?hid=\|posts/(?:[\w-]+-)?)(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.patreon.com/creation?hid=743933',. 'md5': 'e25505eec1053a6e6813b8ed369875cc',. 'info_dict': {. 'id': '743933',. 'ext': 'mp3',. 'title': 'Episode 166: David Smalley of Dogma Debate',. 'description': 'md5:713b08b772cd6271b9f3906683cfacdf',. 'uploader': 'Cognitive Dissonance Podcast',. 'thumbnail': 're:^https?://.*$',. 'timestamp': 1406473987,. 'upload_date': '20140727',. },. }, {. 'url': 'http://www.patreon.com/creation?hid=754133',. 'md5': '3eb09345bf44bf60451b8b0b81759d0a',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GBASL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.947523952925114
Encrypted:	false
SSDEEP:	48:Puz2f2xrTwwdcfidhol153tfjXjl3ZDUwnR87SI/B8T3:O2exHuidhq159fbDDRISIaT3
MD5:	89C3F0A2DC61F86D5B98116B9F8B2E8E
SHA1:	01800362E2D486585C41EB8B5D5A98D65C313D11
SHA-256:	1D1890F2C48961DB29D6C705E6264528A4A7AF2B9D64CEA286785EB1A42C3BC0
SHA-512:	F9B67BBF507A0BB09D16CA63CC841F85EE326684219E1C411A2D199511EBECF5185D96A711AD9516F522525B0FAE01C32BE7919EF15E9048BE7B28CA848FD182
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class ParliamentLiveUKIE(InfoExtractor):. IE_NAME = 'parliamentlive.tv'. IE_DESC = 'UK parliament videos'. _VALID_URL = r'(?i)https?://(?:www\.)?parliamentlive\.tv/Event/Index/(?P<id>[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12})'.. _TESTS = [{. 'url': 'http://parliamentlive.tv/Event/Index/c1e9d44d-fd6c-4263-b50f-97ed26cc998b',. 'info_dict': {. 'id': '1_af9nv9ym',. 'ext': 'mp4',. 'title': 'Home Affairs Committee',. 'uploader_id': 'FFMPEG-01',. 'timestamp': 1422696664,. 'upload_date': '20150131',. },. }, {. 'url': 'http://parliamentlive.tv/event/index/3f24936f-130f-40bf-9a5d-b3d6479da6a4',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. 'http://vodplayer.parliamentlive.tv/?mid='

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GD7TM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3460
Entropy (8bit):	4.679129901210338
Encrypted:	false
SSDEEP:	96:YBaY7a4owMQCdIfQdd98cy9rwl3i2PWBTeKy2Ne3t/8Z6Ng:YBv7KwMQKIfQP4rwl3bPyTbyaZ6Ng
MD5:	A218DEC032C6E606EC1107A4DCC80D57
SHA1:	D2BBD02FD0082E4C5C79BD49E853CF90B8E94E6D
SHA-256:	87D672AC0B5ED0D4142EFCC4E84C7DCCA384B88C944D578596299909B804DD9D
SHA-512:	F4EA74E80B861248EC35A95E4ACBE85BC0E1EF0EBB1552244170A0894F061DBB38572D036237C0303CA4A9BFAF363F509CD2E442BB9B813922C11D0054AD2E89
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. mimetype2ext,. parse_codecs,. xpath_element,. xpath_text,.)...class VideaIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. videa(?:kid)?\.hu/. (?:. videok/(?:[^/]+/)[^?#&]+-\|. player\?.?\bv=\|. player/v/. ). (?P<id>[^?#&]+). '''. _TESTS = [{. 'url': 'http://videa.hu/videok/allatok/az-orult-kigyasz-285-kigyot-kigyo-8YfIAjxwWGwT8HVQ',. 'md5': '97a7af41faeaffd9f1fc864a7c7e7603',. 'info_dict': {. 'id': '8YfIAjxwWGwT8HVQ',. 'ext': 'mp4',. 'title': 'Az .r.lt k.gy.sz 285 k.gy.t enged szabadon',. 'thumbnail': r're:^https?://.*',. 'duration': 21

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GH73C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3238
Entropy (8bit):	5.311647166796592
Encrypted:	false
SSDEEP:	96:tnG9of7fy9KXJGWT5XOdYfJaCv7jaq8qaIV7DAIV/tc:tyofO9yGWTcdOJaqva
MD5:	7E221AD80F205D9AA3D9DF60D2B4F509
SHA1:	F748D738FFD8D9C1A3FCAE83A1C4EBAC26EA76CB
SHA-256:	67B6B86533A6F7A756A25097BB6E5650E73CE3B29C17DF968796D93FA2736056
SHA-512:	7AC8725AE627AEFF28F038AB71895FBC4762511D9B8A28CEB6C7C613590038D73AFD13D219CAE6ED44ACD9929890369564F1958EEC2B73872D6CAC764ACC9FA0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlparse,. compat_parse_qs,.).from ..utils import (. clean_html,. remove_start,.)...class Varzesh3IE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?video\.varzesh3\.com/(?:[^/]+/)+(?P<id>[^/]+)/?'. _TESTS = [{. 'url': 'http://video.varzesh3.com/germany/bundesliga/5-%D9%88%D8%A7%DA%A9%D9%86%D8%B4-%D8%A8%D8%B1%D8%AA%D8%B1-%D8%AF%D8%B1%D9%88%D8%A7%D8%B2%D9%87%E2%80%8C%D8%A8%D8%A7%D9%86%D8%A7%D9%86%D8%9B%D9%87%D9%81%D8%AA%D9%87-26-%D8%A8%D9%88%D9%86%D8%AF%D8%B3/',. 'md5': '2a933874cb7dce4366075281eb49e855',. 'info_dict': {. 'id': '76337',. 'ext': 'mp4',. 'title': '. ..... .... ................. .. .........',. 'description': '... ....-....',. 'thumbnail': r're:^https?://.*\.jpg$',. },. 'skip': 'HTT

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GHDTC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8981
Entropy (8bit):	4.447365122621252
Encrypted:	false
SSDEEP:	192:R8a7MtzyGwZfevZXHuOKYuOmxD+c2iVTqdV6BzWBLIaA4XHR5VTehaV6Ng:97MtzVCfevZXHu2uOmxDD2iVedV6BzWX
MD5:	4E2B5452382382232F62E4C944DFB22B
SHA1:	2460775232399D8B557884C4224C0B96929E7FB9
SHA-256:	F9ABFD2114488EE2A42145C070EE86F79D0E6955D5A3123158CDC9E2ACA7D161
SHA-512:	8FA064CE16F869F3C94AB1AB83CED4C9AA188062C719B4FDB31409A565646EAE04CB7819392801CB67552015E3E5A41F060BB461A3B9A777278B94A9AB6BDFD4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_urllib_parse_unquote,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_iso8601,. sanitized_Request,. HEADRequest,. url_basename,.)...class ViewsterIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?viewster\.com/(?:serie\|movie)/(?P<id>\d+-\d+-\d+)'. _TESTS = [{. # movie, Type=Movie. 'url': 'http://www.viewster.com/movie/1140-11855-000/the-listening-project/',. 'md5': 'e642d1b27fcf3a4ffa79f194f5adde36',. 'info_dict': {. 'id': '1140-11855-000',. 'ext': 'mp4',. 'title': 'The listening Project',. 'description': 'md5:bac720244afd1a8ea279864e67baa071',. 'timestamp': 1214870400,. 'upload_date': '20080701',. 'duration': 4680,. },. }, {. # series episode, Type=E

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GICQM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	24502
Entropy (8bit):	4.663376994553551
Encrypted:	false
SSDEEP:	384:nG0eeiETgSN6NNeWyT/V6NYRlhEKvTM+HunVyM4CJ4nYp0TQnlCynlD6/fbun4ed:nG0eeiETgSN8NeWyT/V8YRzEW+/CaDEG
MD5:	2D6F6914347AD1A993CF39CCF70FBC2D
SHA1:	DF582AF8A888C1D3E3D553A27F273980C4AFB45D
SHA-256:	2C70F69EAF55DD77F24B14BA53ECD479525EDE51BE7BA8ABD45D562DDCAF8F1B
SHA-512:	A7134F3664F9D94853625594B36B0750BCAB6D9FA683DB342F8E662DA3F198F8C96C728D4B3AD3C8F98C1D8CCB8760B448998256AA87FC8C407D842FFE4F0BD7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urllib_parse_unquote,.).from ..utils import (. ExtractorError,. int_or_none,. JSON_LD_RE,. NO_DEFAULT,. parse_age_limit,. parse_duration,. try_get,.)...class NRKBaseIE(InfoExtractor):. _GEO_COUNTRIES = ['NO'].. _api_host = None.. def _real_extract(self, url):. video_id = self._match_id(url).. api_hosts = (self._api_host, ) if self._api_host else self._API_HOSTS.. for api_host in api_hosts:. data = self._download_json(. 'http://%s/mediaelement/%s' % (api_host, video_id),. video_id, 'Downloading mediaelement JSON',. fatal=api_host == api_hosts[-1]). if not data:. continue. self._api_host = api_host. break.. title = data.get('fullTitle') or data.get('mainTitle') or data['title'].

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GOP6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3886
Entropy (8bit):	4.557597588637339
Encrypted:	false
SSDEEP:	96:giS7ozXjCexAcvJD8CjPGSlCC2ty3zN1TZrTVjV8F6Ng:P3HJDjPGCCRty3Xo6Ng
MD5:	E44AC4225AADF3D2AA1C026B69B14D59
SHA1:	4CA4BC48309497E784C1EE548DF21C1333F8AD52
SHA-256:	6E600C12A89AB67A4670C07B2B5183BB575FA83BCE9E76AC0079C7B7A76A7333
SHA-512:	A4AE676672A571FEA9A1E0978CAC2E68080A2B8B4023C5FDBEBC8C82E7A82F6DDE1532DD2D3E2EE4208E42D2775EA44729FEF5743E5FC95216B0986DAB61F894
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. float_or_none,. int_or_none,. unified_timestamp,. url_or_none,.)...class DctpTvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?dctp\.tv/(?:#/)?filme/(?P<id>[^/?#&]+)'. _TESTS = [{. # 4x3. 'url': 'http://www.dctp.tv/filme/videoinstallation-fuer-eine-kaufhausfassade/',. 'info_dict': {. 'id': '95eaa4f33dad413aa17b4ee613cccc6c',. 'display_id': 'videoinstallation-fuer-eine-kaufhausfassade',. 'ext': 'flv',. 'title': 'Videoinstallation f.r eine Kaufhausfassade',. 'description': 'Kurzfilm',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 71.24,. 'timestamp': 1302172322,. 'upload_date': '20110407',. },. 'params': {. # rtmp download. 'skip_download': True,. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GPFC6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	4.732353398879731
Encrypted:	false
SSDEEP:	96:xLA9X4tni7oGSaNdH9F/yCos5HD5yPk1DNC2fFAghwILOaxgGhktwIfJWcEqyZ3/:VA9X4tnnnedbyCoilyPm08SgPmT/JWcs
MD5:	415C7AF752AD219516483F3E94025C62
SHA1:	9FF34EDF26DF66EA55CB45C89FE9541AC4F58C56
SHA-256:	0DBBFAA09B643BB5E9CEFF7B8B7A9F80A595E054C963877DF6DE17E69BC828E2
SHA-512:	3A8609D568538B874FDE18523B3BF9CC76C6A813EF9C5BAA9C7A87F11C9679A17E3938B33AC98E1DDCFC8ADF6CEA8919CC84D1DA0555DFB817AA4499A81B915F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .brightcove import (. BrightcoveLegacyIE,. BrightcoveNewIE,.).from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. sanitized_Request,.)...class NownessBaseIE(InfoExtractor):. def _extract_url_result(self, post):. if post['type'] == 'video':. for media in post['media']:. if media['type'] == 'video':. video_id = media['content']. source = media['source']. if source == 'brightcove':. player_code = self._download_webpage(. 'http://www.nowness.com/iframe?id=%s' % video_id, video_id,. note='Downloading player JavaScript',. errnote='Unable to download player JavaScript'). bc_url = BrightcoveLegacyIE._extract_brightcove_url(player_code).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GR7BO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1962
Entropy (8bit):	4.777094994310256
Encrypted:	false
SSDEEP:	48:Puwc46OsO1A8X8Lx5XBgR1fJoXhhuBwAlBamVzVCeVHzltF3PAtN0f:zc46DO1DXwx5XBgzJaE2RgHF3ItN0f
MD5:	F9ED2C9772E85637F886A9ACA2BEEEF9
SHA1:	93D32E4EF11ABE903BC650CED035603A6094FA6C
SHA-256:	B7DEF5353D8EB1369ED94B39ECEBFF83DA772E754648A3D938E52B2A5688D9D8
SHA-512:	F6152EEFBD4DE87F3F3124083299074D683117275C8B3121BCFC61591800E7F031D10B6D3EA59D44B63D53AD97674560E2C05BDD3F11716C938B0883F281FDF0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import unified_strdate...class ATTTechChannelIE(InfoExtractor):. _VALID_URL = r'https?://techchannel\.att\.com/play-video\.cfm/([^/]+/)(?P<id>.+)'. _TEST = {. 'url': 'http://techchannel.att.com/play-video.cfm/2014/1/27/ATT-Archives-The-UNIX-System-Making-Computers-Easier-to-Use',. 'info_dict': {. 'id': '11316',. 'display_id': 'ATT-Archives-The-UNIX-System-Making-Computers-Easier-to-Use',. 'ext': 'flv',. 'title': 'AT&T Archives : The UNIX System: Making Computers Easier to Use',. 'description': 'A 1982 film about UNIX is the foundation for software in use around Bell Labs and AT&T.',. 'thumbnail': r're:^https?://.\.jpg$',. 'upload_date': '20140127',. },. 'params': {. # rtmp download. 'skip_download': True,. },. }.. def _real_extract(self, url):. di

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GTTRC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	4.937956033539768
Encrypted:	false
SSDEEP:	48:+u9xfOe7xSrM7KYMvwM74My6jXjlkaCaaXoVB70q6jWBT06N1vf:bfrVSrWKYMvwW4My6qqa33jWBT06N13
MD5:	04045B930E243668BE1DF77BEF5A3403
SHA1:	21D03EE7CBE34D641F003ECB55B9E993F9741CF6
SHA-256:	A09D5DF9CE88C72D4611785D79FCAE8C628324EAB7FCA07B99708453B06C5533
SHA-512:	7B763F5840B9E601CF63735B0878464030A03308B724242E99ADC863F96FDA5617D988069EBF0451076BC1A83CF4161CA2D0A4DB4D4FE68C59F86982CC427100
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote_plus...class YnetIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?ynet\.co\.il/(?:.+?/)?0,7340,(?P<id>L(?:-[0-9]+)+),00\.html'. _TESTS = [. {. 'url': 'http://hot.ynet.co.il/home/0,7340,L-11659-99244,00.html',. 'info_dict': {. 'id': 'L-11659-99244',. 'ext': 'flv',. 'title': '... .. .... ..... ....',. 'thumbnail': r're:^https?://.\.jpg',. }. }, {. 'url': 'http://hot.ynet.co.il/home/0,7340,L-8859-84418,00.html',. 'info_dict': {. 'id': 'L-8859-84418',. 'ext': 'flv',. 'title': "...: ...... ...... .. .....' ...... .......",. 'thumbnail': r're:^https?://.\.jpg',. }.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GUNU2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2728
Entropy (8bit):	4.645016957800249
Encrypted:	false
SSDEEP:	48:PuSRVgWwu4XGxQkw6BlP/wOXkrQwtBGLpBa1s4V7og+Pu7ssr5jtOb:jW97XGxTwoSOXlqByBenVlfr5jtk
MD5:	4A72015D36F35E8EAD3D37C53A7E73CE
SHA1:	C3532A086FA79724392FAFF4F824DBD237EE240D
SHA-256:	42E1C6B8F07321F791D6B12CB4F04B29FA75CE61D7F28B50447500317F242982
SHA-512:	28BB74CBFF8C824A6A632ED111A0AA6864D28784D1E680A59D2A0033F18664C0B8EEEC3440B6897E361E3D9EAED6CAC3AAD5B6AA611E6EBBBC87FD7BB92F7D86
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals.import os.path..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,.)...class MySpassIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?myspass\.de/.*'. _TEST = {. 'url': 'http://www.myspass.de/myspass/shows/tvshows/absolute-mehrheit/Absolute-Mehrheit-vom-17022013-Die-Highlights-Teil-2--/11741/',. 'md5': '0b49f4844a068f8b33f4b7c88405862b',. 'info_dict': {. 'id': '11741',. 'ext': 'mp4',. 'description': 'Wer kann in die Fu\u00dfstapfen von Wolfgang Kubicki treten und die Mehrheit der Zuschauer hinter sich versammeln? Wird vielleicht sogar die Absolute Mehrheit geknackt und der Jackpot von 200.000 Euro mit nach Hause genommen?',. 'title': 'Absolute Mehrheit vom 17.02.2013 - Die Highlights, Teil 2',. },. }.. def _real_extract(self, url):. META_DATA_URL_TEMPLATE = 'http://www.m

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-GV9OK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5657
Entropy (8bit):	4.598539019853051
Encrypted:	false
SSDEEP:	96:kurPnYKxnXBNKHJZbC4B8cyLUS6tvTyjMBcWu7zRPifau4D40mRONcEaoNu0BTex:ZPYKyZbC4PF1cXNQaHc0mRONcEaoNu80
MD5:	A93A0BABDB70BC856E9266B81825B5F3
SHA1:	08F3ED5B068840AB0E7FA99795B26C3057CB660B
SHA-256:	50760F93C930D2A88008DEB948FAEC7CFA291773368C92E7B0C5749251C7B275
SHA-512:	0654B8A185C2A4BEA47834A00FCF709A7E376CB4393737EAA770C1D8D0503C9A561546ACB34079109532D94A04FDA2995B7C6CD6D533EF03CDBC640039DA1BE6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. parse_iso8601,. sanitized_Request,.)...class VesselIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vessel\.com/(?:videos\|embed)/(?P<id>[0-9a-zA-Z-_]+)'. _API_URL_TEMPLATE = 'https://www.vessel.com/api/view/items/%s'. _LOGIN_URL = 'https://www.vessel.com/api/account/login'. _NETRC_MACHINE = 'vessel'. _TESTS = [{. 'url': 'https://www.vessel.com/videos/HDN7G5UMs',. 'md5': '455cdf8beb71c6dd797fd2f3818d05c4',. 'info_dict': {. 'id': 'HDN7G5UMs',. 'ext': 'mp4',. 'title': 'Nvidia GeForce GTX Titan X - The Best Video Card on the Market?',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20150317',. 'description': 'Did Nvidia pull out all the stops on the Titan X, or does its performance leave something to be desired?',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-H1HSV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6327
Entropy (8bit):	4.801049665608095
Encrypted:	false
SSDEEP:	96:qx5Hdg0h+P0QM0qMBlJlJRpOBOAAjrJojaCgjtIPT2WXMJTmnj2rmTccH9:qnHdt3Q/9DkOAAj2jJx8QnsRcd
MD5:	1846046168EB6457261ED813C345AAF9
SHA1:	B4AF91D5EE0475BB10896B56B252516F210EA026
SHA-256:	ADE12147DEA28AD7827C2B00F8C7BCF62E4AE7D08ABE324B9481B611DFCA191A
SHA-512:	F1E73B178AC45A8EA51D1736D7D5A4397328344FE431C688E1646CC0D42F167FF02C8AA3B23C7F135542A0AB4EA60476317BA6518FF2A1D9690208938C22FBE8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import (. # compat_str,. compat_HTTPError,.).from ..utils import (. clean_html,. ExtractorError,. # remove_end,. str_or_none,. strip_or_none,. unified_timestamp,. # urljoin,.)...class PacktPubBaseIE(InfoExtractor):. # _PACKT_BASE = 'https://www.packtpub.com'. _STATIC_PRODUCTS_BASE = 'https://static.packt-cdn.com/products/'...class PacktPubIE(PacktPubBaseIE):. _VALID_URL = r'https?://(?:(?:www\.)?packtpub\.com/mapt\|subscription\.packtpub\.com)/video/[^/]+/(?P<course_id>\d+)/(?P<chapter_id>[^/]+)/(?P<id>[^/]+)(?:/(?P<display_id>[^/?&#]+))?'.. _TESTS = [{. 'url': 'https://www.packtpub.com/mapt/video/web-development/9781787122215/20528/20530/Project+Intro',. 'md5': '1e74bd6cfd45d7d07666f4684ef58f70',. 'info_dict': {. 'id': '20530',. 'ext': 'mp4',. 'title': 'Project Intro',. 'th

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-H6NC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3705
Entropy (8bit):	4.783626567278515
Encrypted:	false
SSDEEP:	96:nhdkY7fwNUMN2bXjDF+xdyXddlhEHpFGzflZtG1Xn:hR7QGXPFkd4ddlyHPcNZ8Xn
MD5:	5E8B267AAB6D0F078D7902F79EDACE41
SHA1:	4B134AEF879AB8006C809019DC6C23C30F79C919
SHA-256:	F5B2C53D41F683B466CCBB06518A2A1424824CAE8BD2382826033780318B0561
SHA-512:	D98DEBBCF86BD0578A4E4851BB1D4FBD63AF15A6BD30750E2357D8D246E4AFDFA999E0984678DF411AEE728C65604D62F15821F852B5E0AFB1BB1F3D255E62F9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import hashlib.import re..from .aws import AWSIE.from .anvato import AnvatoIE.from ..utils import (. smuggle_url,. urlencode_postdata,. xpath_text,.)...class ScrippsNetworksWatchIE(AWSIE):. IE_NAME = 'scrippsnetworks:watch'. _VALID_URL = r'''(?x). https?://. watch\.. (?P<site>geniuskitchen)\.com/. (?:. player\.[A-Z0-9]+\.html\#\|. show/(?:[^/]+/){2}\|. player/. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://watch.geniuskitchen.com/player/3787617/Ample-Hills-Ice-Cream-Bike/',. 'info_dict': {. 'id': '4194875',. 'ext': 'mp4',. 'title': 'Ample Hills Ice Cream Bike',. 'description': 'Courtney Rada churns up a signature

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-H6O2O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4336
Entropy (8bit):	4.475244681127321
Encrypted:	false
SSDEEP:	96:abf6u6uZjiQ0YCRJloSPQwCMfOe5eceT/MQXpGmdpTw+aArOxBtXXSv7FoBTzJDl:sfg82roLECoQZGmdpTw+aArOxBtXSv7E
MD5:	D8B7690F513DEB9415AC697E094F9C27
SHA1:	2A3639D68C37976D3419CDF8097B3688A509B86E
SHA-256:	D577FF1B7AC98A0D60FBCFD2107766E076E0400F1916990A06BC3B710EF147CA
SHA-512:	FDF169D337665D79B3F1BB758583249B05A22601EE8E6BF9D00EDA8DADDDF2E4885A23BDE4E15E25B9CA20182EF403B06F2F9B60518725D80D1C5F811E7F170D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. qualities,.)...class NprIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?npr\.org/(?:sections/[^/]+/)?\d{4}/\d{2}/\d{2}/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.npr.org/sections/allsongs/2015/10/21/449974205/new-music-from-beach-house-chairlift-cmj-discoveries-and-more',. 'info_dict': {. 'id': '449974205',. 'title': 'New Music From Beach House, Chairlift, CMJ Discoveries And More'. },. 'playlist_count': 7,. }, {. 'url': 'https://www.npr.org/sections/deceptivecadence/2015/10/09/446928052/music-from-the-shadows-ancient-armenian-hymns-and-piano-jazz',. 'info_dict': {. 'id': '446928052',. 'title': "Songs We Love: Tigran Hamasyan, 'Your Mercy is Boundless'". },. 'playlist': [{. 'md5': '12fa60cb2d3ed932f53609d4aeceabf1',. 'info_dict': {

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-H962Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9342
Entropy (8bit):	4.773019689144555
Encrypted:	false
SSDEEP:	192:H6DnAw6iAjaxe6sFKjoFOxTDh6N6COb+0mZbuFz/dnMPHk82yU99f3KtJL7P3LOX:inn6iAjh6sFKjoFOxTDh6N6NbTm4Fz/J
MD5:	4B39FA8BE38C2BC26D9B553509B3D6B4
SHA1:	FD12E284197FBD7B6A34AA31FAF033265F86FD1E
SHA-256:	61D5365D6B7B261BFF45308A637C89E4A7A8A53079CBDB3B40AF8D834A30E821
SHA-512:	25A420FE64877EC8837797CDFB7758F4F240BAA6A3FA066A136AE2EB9AD18CADE9369AAC50ECC771D49496F5F0F3F71CE202DA9E77F050BDD36EEE1360612EBE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. float_or_none,. get_element_by_class,. int_or_none,. js_to_json,. NO_DEFAULT,. parse_iso8601,. remove_start,. strip_or_none,. url_basename,.)...class OnetBaseIE(InfoExtractor):. def _search_mvp_id(self, webpage):. return self._search_regex(. r'id=(["\'])mvp:(?P<id>.+?)\1', webpage, 'mvp id', group='id').. def _extract_from_id(self, video_id, webpage=None):. response = self._download_json(. 'http://qi.ckm.onetapi.pl/', video_id,. query={. 'body[id]': video_id,. 'body[jsonrpc]': '2.0',. 'body[method]': 'get_asset_detail',. 'body[params][ID_Publikacji]': video_id,. 'body[params][Service]': 'www.onet.pl',. 'content-type': 'application/jsonp',. 'x-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-H9H7D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2089
Entropy (8bit):	4.694446177416249
Encrypted:	false
SSDEEP:	48:+uvl/ATog2DvjlwfF3kbXlCXLAXYh23WXhJRSp9mp3jxQBT06NK9:DSTog2vjlZZAvh23ISp9mpzSBT06Nu
MD5:	77133CA626CE35B8F22C79FCD1299B26
SHA1:	9B47168C1977D418866ACE03C0C80E07CF4450AA
SHA-256:	24C7441F6B9C7EFC36362279F3E1DC5CE1268E06C02148A587A3B5409AD3178A
SHA-512:	84B8095C1421590BD17784978F0D527C504579F9B20E55FE484A33645090DD56C00C7CD18F363796F19B3A8E6963FBE44FED4A7C978E7BDEEE52E3069470478B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class RadioFranceIE(InfoExtractor):. _VALID_URL = r'^https?://maison\.radiofrance\.fr/radiovisions/(?P<id>[^?#]+)'. IE_NAME = 'radiofrance'.. _TEST = {. 'url': 'http://maison.radiofrance.fr/radiovisions/one-one',. 'md5': 'bdbb28ace95ed0e04faab32ba3160daf',. 'info_dict': {. 'id': 'one-one',. 'ext': 'ogg',. 'title': 'One to one',. 'description': "Plut.t que d'imaginer la radio de demain comme technologie ou comme cr.ation de contenu, je veux montrer que quelles que soient ses .volutions, j'ai l'intime conviction que la radio continuera d'.tre un grand m.dia de proximit. pour les auditeurs.",. 'uploader': 'Thomas Hercou.t',. },. }.. def _real_extract(self, url):. m = re.match(self._VALID_URL, url). video_id = m.group('id').. webpage = self._download_webpage(url,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HEEFN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	4.595753703155703
Encrypted:	false
SSDEEP:	48:+u6Y76wL4qQCxKajXXRjdepAsqgNCMtTUb5HOj+Drif3BT/T6Nq:+Y76wL4qQCxKatjdMAsBCMtTM5HOj+HQ
MD5:	3A6095C4E3BC4B257E0272EDF254ED78
SHA1:	F388FA8C283BB9C4C89E5D8655495EDF5A2E9009
SHA-256:	5A5F148E1284A8245D0849DD8B9CEEB92E7FB75F04FF702D387D331C3536E033
SHA-512:	C452744ECFC2397551903830823A5AA2FC208BDB9945513FBA76FA85395534FBC3D750CC283841B7741E9D870371D8A985D9C96B12BDFE2A2EA8E384ED351B26
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import ExtractorError...class RTVNHIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rtvnh\.nl/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.rtvnh.nl/video/131946',. 'md5': 'cdbec9f44550763c8afc96050fa747dc',. 'info_dict': {. 'id': '131946',. 'ext': 'mp4',. 'title': 'Grote zoektocht in zee bij Zandvoort naar vermiste vrouw',. 'thumbnail': r're:^https?:.*\.jpg$'. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. meta = self._parse_json(self._download_webpage(. 'http://www.rtvnh.nl/video/json?m=' + video_id, video_id), video_id).. status = meta.get('status'). if status != 200:. raise ExtractorError(. '%s returned error code %d' % (self.IE_NAME, status), expected=True).. formats = []. rtmp_forma

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HFSTH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (311)
Category:	dropped
Size (bytes):	7933
Entropy (8bit):	4.603747934624686
Encrypted:	false
SSDEEP:	192:sAcNYdabdXkBz46zPWz16NDZAQvmNusY2JSu6:SNqYdXkBz46zPWz16NtrvmW2m
MD5:	0E7F6170FD7C5503DEA4EDE6505106B5
SHA1:	01C9CC9B3B7314AAA9DB42980399DEF07CD4A0D4
SHA-256:	820BB73932AD828C3F00E568B00DD353C7F8052664351106F43962FC9FD7B54B
SHA-512:	B3B90BBF86D8EB556ED6FF823FF53A6B38EDFD0506A4C7D8A5DFC9F147D7C7F50AF342F923CAA6EA121AB32067E85C38997546945F1101030B20641F3AFF5013
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. strip_jsonp,.)...class WashingtonPostIE(InfoExtractor):. IE_NAME = 'washingtonpost'. _VALID_URL = r'(?:washingtonpost:\|https?://(?:www\.)?washingtonpost\.com/video/(?:[^/]+/)*)(?P<id>[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12})'. _EMBED_URL = r'https?://(?:www\.)?washingtonpost\.com/video/c/embed/[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}'. _TEST = {. 'url': 'https://www.washingtonpost.com/video/c/video/480ba4ee-1ec7-11e6-82c2-a7dcb313287d',. 'md5': '6f537e1334b714eb15f9563bd4b9cdfa',. 'info_dict': {. 'id': '480ba4ee-1ec7-11e6-82c2-a7dcb313287d',. 'ext': 'mp4',. 'title': 'Egypt finds belongings, debris from plane crash',. 'description': 'md5:a17ceee432f215a5371388c1f680bd86',. 'upload_date': '20160520',. 'uploader': 'Reut

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HHE01.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2761
Entropy (8bit):	4.612141670996685
Encrypted:	false
SSDEEP:	48:PurnrphC79lloajXjBJYDZxygckiGMzXyfuWBTXVmeVUezlKZOSfYZ+XtN0gly7L:GnrnC79voaUDZxyg3iGMzXyfuWBTcoIq
MD5:	64021E4DAD9394149B12EBA23608D2B2
SHA1:	40E5C0818C8B13865388DFC77AFCAD71599FAB76
SHA-256:	DF62EACD2E25249A6D83783092DC677A32A228B4080C7700F8447429D5F05098
SHA-512:	26B2C5A013C17E8A0A9D2447AC2144A42109CF923B789143560EFE6750EA62E052854D227840CC1E9F425D46DD8407627B2049EA482D1290B482470135E89A90
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_resolution,. str_to_int,. unified_strdate,. urlencode_postdata,. urljoin,.)...class RadioJavanIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?radiojavan\.com/videos/video/(?P<id>[^/]+)/?'. _TEST = {. 'url': 'http://www.radiojavan.com/videos/video/chaartaar-ashoobam',. 'md5': 'e85208ffa3ca8b83534fca9fe19af95b',. 'info_dict': {. 'id': 'chaartaar-ashoobam',. 'ext': 'mp4',. 'title': 'Chaartaar - Ashoobam',. 'thumbnail': r're:^https?://.*\.jpe?g$',. 'upload_date': '20150215',. 'view_count': int,. 'like_count': int,. 'dislike_count': int,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. download_host = self._download_json(. 'https://www.radiojavan.com/videos/video_host', video_id,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HHRM8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9454
Entropy (8bit):	4.6613182077658655
Encrypted:	false
SSDEEP:	192:XGhSDI0VFImeMTsvqsI8ohcgIszZ3cNi6NOAIJs2sSizP/zjJZ38y6NLsvKoPsJP:2hS80VFImeMTsCsXohlzZ3cA6NO626zk
MD5:	45DB0C2E53BFA014A221B26A2837DE12
SHA1:	A9A25CDDCA71855ABBAE9CC4FDDD020DE67E6FE7
SHA-256:	FA3292788F0781DC31AD5CDFF41F7CBC0ADC722DBDC5CDC43A7928814BC3AAAB
SHA-512:	09CD480BCF91021D61FA349F716D9F57110A4298B3745A38E65C870919636D3F0C25F4E79E927C956AC150005304285A4BB3638C8B03BABDFCC8F2286540C4FC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. unified_strdate,. urlencode_postdata,. xpath_element,. xpath_text,. update_url_query,. js_to_json,.)...class Laola1TvEmbedIE(InfoExtractor):. IE_NAME = 'laola1tv:embed'. _VALID_URL = r'https?://(?:www\.)?laola1\.tv/titanplayer\.php\?.*?\bvideoid=(?P<id>\d+)'. _TESTS = [{. # flashvars.premium = "false";. 'url': 'https://www.laola1.tv/titanplayer.php?videoid=708065&type=V&lang=en&portal=int&customer=1024',. 'info_dict': {. 'id': '708065',. 'ext': 'mp4',. 'title': 'MA Long CHN - FAN Zhendong CHN',. 'uploader': 'ITTF - International Table Tennis Federation',. 'upload_date': '20161211',. },. }].. def _extract_token_url(self, stream_access_url, video_id, data):. return self._download_json(. self._proto_rel

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HMVRU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5200
Entropy (8bit):	4.47058605342563
Encrypted:	false
SSDEEP:	96:aaTIdgDrDVSBQ1RPquzTOaAkBTnu0/6NavvHD7gaPfaGvd93NhBTUS6Ng:JI+DrDewPq8TOFsTf/6Nqvj7DnaGvd97
MD5:	0B17A9D57A3794C1DAE752DD58A2F192
SHA1:	2CCBB78A35A345978E719229DCE3398432654F80
SHA-256:	26484D1F31B402E72FF4C431385CA49D45E3072AD3304635D69D07A19F628840
SHA-512:	D16FB10505DAB1DEDDABDB681D15A83E6AB409FC754685CA4E5BFB914F178FC04F28314ADE80B177797A9D2C0A7F01F5D723FFDB0983862A648C01664F2C184E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. js_to_json,. try_get,. update_url_query,. urlencode_postdata,.)...class PicartoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www.)?picarto\.tv/(?P<id>[a-zA-Z0-9]+)(?:/(?P<token>[a-zA-Z0-9]+))?'. _TEST = {. 'url': 'https://picarto.tv/Setz',. 'info_dict': {. 'id': 'Setz',. 'ext': 'mp4',. 'title': 're:^Setz [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'timestamp': int,. 'is_live': True. },. 'skip': 'Stream is offline',. }.. @classmethod. def suitable(cls, url):. return False if PicartoVodIE.suitable(url) else super(PicartoIE, cls).suitable(url).. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). channel_id = mobj.group('id').. metadata = se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HO371.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3524
Entropy (8bit):	4.834221531604108
Encrypted:	false
SSDEEP:	96:KDhFvbn/Ifc8VrfWBTe7Oot/8V6Ng+zleNuajbBH95F:KDXz2hyTZV6NgZNuajvT
MD5:	70C2581DF06F7F519DB57221C184488A
SHA1:	F84FE64D10EDFEA6713AA6787FB77EE8DB7FA6FA
SHA-256:	EB57F73905ECB2A381E2AA3796D02CE6FF5942C13B30FA215A6D8DCE59E955D0
SHA-512:	10116A6B13D17075C64AEC7348DAF25B01BBA89C366783376F19777CDD52EC4F8F6837046D69DA9812B9F9E5561431285B42ADBD18C1C010A9D72DA657223D47
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. float_or_none,. int_or_none,. try_get,.)..from .videomore import VideomoreIE...class CarambaTVIE(InfoExtractor):. _VALID_URL = r'(?:carambatv:\|https?://video1\.carambatv\.ru/v/)(?P<id>\d+)'. _TESTS = [{. 'url': 'http://video1.carambatv.ru/v/191910501',. 'md5': '2f4a81b7cfd5ab866ee2d7270cb34a2a',. 'info_dict': {. 'id': '191910501',. 'ext': 'mp4',. 'title': '[BadComedian] - ........ . ...... (.......... .....)',. 'thumbnail': r're:^https?://.*\.jpg',. 'duration': 2678.31,. },. }, {. 'url': 'carambatv:191910501',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. video = self._download_json(. 'http://video1.carambatv.ru/v/%s/video

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HO99B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4471
Entropy (8bit):	4.594928874415439
Encrypted:	false
SSDEEP:	96:IQKfI9DxHznXrjHXIlNm+XbCDnG6OSs0DNi/xlLyKQ5naxKHsJzUbBTLtX918J6u:Sf4xHz7zIDmc0nG6OSwxphZJQNTOJ6Ng
MD5:	87384237B03B31C10E4C52E26D8D093A
SHA1:	AFBDF47E83EC7F12B8B88197EF6E394780EF8DCD
SHA-256:	AFB44991B3A3BDF039BBA72E16F43786F76FA35E25233BF61EEFB089B57633A6
SHA-512:	E3E873C9228CE6AF57F1A462ED3912ACDE2334A47356B5404B4B679BE7B93FE7D84FAFD1E1902DC65ABFD061044DCE948479784F57D5C76545C1F4363F812908
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. parse_duration,. str_to_int,. urljoin,.)...class VpornIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vporn\.com/[^/]+/(?P<display_id>[^/]+)/(?P<id>\d+)'. _TESTS = [. {. 'url': 'http://www.vporn.com/masturbation/violet-on-her-th-birthday/497944/',. 'md5': 'facf37c1b86546fa0208058546842c55',. 'info_dict': {. 'id': '497944',. 'display_id': 'violet-on-her-th-birthday',. 'ext': 'mp4',. 'title': 'Violet on her 19th birthday',. 'description': 'Violet dances in front of the camera which is sure to get you horny.',. 'thumbnail': r're:^https?://.*\.jpg$',. 'uploader': 'kileyGrope',. 'categories': ['Masturbation', 'Teen'],. 'duration': 393,. 'age_limit': 18,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HP5T0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.927334957531084
Encrypted:	false
SSDEEP:	24:zi8lFvp/GCswYBuWO7/mddlGDOvHbF0eIXjlgtWFOzRXC:+u7DsPBUzmdyybyjXjlk/NXC
MD5:	77ADFEB3318EF77C8D250BF9E956B13B
SHA1:	AF412B2136EDDA2C3C5B04DD44446B8F470C906D
SHA-256:	01A43939070F8034A445F6FAAC670F8A7D1BCA63126BE09D6D9920D917A129BE
SHA-512:	354C817615774299D15AC37BBA245A8257325F04945454466737F93F80560F5CCB55F4E39554A841ED77829DD361AE8D42CB78798D4543F4DAA5113F0396FD36
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class LearnrIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?learnr\.pro/view/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.learnr.pro/view/video/51624-web-development-tutorial-for-beginners-1-how-to-build-webpages-with-html-css-javascript',. 'md5': '3719fdf0a68397f49899e82c308a89de',. 'info_dict': {. 'id': '51624',. 'ext': 'mp4',. 'title': 'Web Development Tutorial for Beginners (#1) - How to build webpages with HTML, CSS, Javascript',. 'description': 'md5:b36dbfa92350176cdf12b4d388485503',. 'uploader': 'LearnCode.academy',. 'uploader_id': 'learncodeacademy',. 'upload_date': '20131021',. },. 'add_ie': ['Youtube'],. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. return {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HPNEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	4.861720594489512
Encrypted:	false
SSDEEP:	96:/94ccn6fKVzIXWEfwiIYkyPoKub9qMgdbBTP8V6N1ti:/ucnQywEkyPFEEtdNTUV6NW
MD5:	10625D0FE8EA4D9E1BB801AF86F2C31D
SHA1:	2630D4E4F74040266DFC39EA09E1464F5B1FAB6F
SHA-256:	2F040A729A0019E411EC88771E52DDAF5D5B8A3288F681AD50850C241CF65393
SHA-512:	77BD7130863D828EAD32A3250A6E83B23D9C14745A0E515636CACDE1CE2A619F7DA806B289D1B03828026156CE4910F0B7C93F4039B0213FD3C97D95A0DD26F8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random.import re..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote_plus.from ..utils import (. int_or_none,. float_or_none,. timeconvert,. update_url_query,. xpath_text,.)...class KUSIIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?kusi\.com/(?P<path>story/.+\|video\?clipId=(?P<clipId>\d+))'. _TESTS = [{. 'url': 'http://www.kusi.com/story/32849881/turko-files-refused-to-help-it-aint-right',. 'md5': '4e76ce8e53660ce9697d06c0ba6fc47d',. 'info_dict': {. 'id': '12689020',. 'ext': 'mp4',. 'title': "Turko Files: Refused to Help, It Ain't Right!",. 'duration': 223.586,. 'upload_date': '20160826',. 'timestamp': 1472233118,. 'thumbnail': r're:^https?://.*\.jpg$'. },. }, {. 'url': 'http://kusi.com/video?clipId=12203019',. 'only_matching': True,. }]..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HQQ7H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4694
Entropy (8bit):	4.735958733633537
Encrypted:	false
SSDEEP:	96:u0g/notJYh7lr+BhsfwwniNVizy9LODLcUP7NiXiBTg6NgBNBWB+x9cOLftTMacV:rg/oQdlr+Bhawk2VizOLOfcUj0XmTg6F
MD5:	F3457CBD3BD2E24C7AE2E8B8F7231586
SHA1:	922D0A7DB98E1CFCA9923EF2945760F12ECAF797
SHA-256:	F7B3A24EC31205E2A1DFDE2B9657B502DEE55DE100BC711741253C1DB828B4FD
SHA-512:	3AF357AD977C1964FE5FC74EDF575C0AB706DA559B655E654DB2A308B40CE61038F3BDFA015DA01ACFE391AFCFD61A97E1CF8F31D8BE98135C04DB4A0E0F2AC9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. float_or_none,. unified_strdate,.)...class WSJIE(InfoExtractor):. _VALID_URL = r'''(?x). (?:. https?://video-api\.wsj\.com/api-video/player/iframe\.html\?.*?\bguid=\|. https?://(?:www\.)?(?:wsj\|barrons)\.com/video/(?:[^/]+/)+\|. wsj:. ). (?P<id>[a-fA-F0-9-]{36}). '''. IE_DESC = 'Wall Street Journal'. _TESTS = [{. 'url': 'http://video-api.wsj.com/api-video/player/iframe.html?guid=1BD01A4C-BFE8-40A5-A42F-8A8AF9898B1A',. 'md5': 'e230a5bb249075e40793b655a54a02e4',. 'info_dict': {. 'id': '1BD01A4C-BFE8-40A5-A42F-8A8AF9898B1A',. 'ext': 'mp4',. 'upload_date': '20150202',. 'uploader_id': 'jdesai',. 'creator': 'j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HUQPK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5772
Entropy (8bit):	4.836396498816189
Encrypted:	false
SSDEEP:	96:Cw2smdjvXej/ERCjsXMYTpsliZwqfabNKPLyjQUPdEeNB0kHi5TIANmooId3D6ou:/2s0eERKyiA3audTz3DKaU2C
MD5:	D93EB84E4E17968FB28F33E0080B1C70
SHA1:	AFBD5A12A4E50AA7304AD8ED3A953AAF1B2C838E
SHA-256:	125DE3C23A5DC5F6447FB26F1AFD9AA8F320367DF001C7B9946113E85299416F
SHA-512:	78FBA6109B7A422EDAB7628877E2E90CF779F5EC9549ADB175CC5F516705CF4EA92BA7F51AF64DEEF8D4C8B79BD9FA8352D983DEBA3A87D5E0B7CA4774D73097
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_urlparse,.).from ..utils import (. clean_html,. parse_duration,. str_to_int,. unified_strdate,.)...class CamdemyIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?camdemy\.com/media/(?P<id>\d+)'. _TESTS = [{. # single file. 'url': 'http://www.camdemy.com/media/5181/',. 'md5': '5a5562b6a98b37873119102e052e311b',. 'info_dict': {. 'id': '5181',. 'ext': 'mp4',. 'title': 'Ch1-1 Introduction, Signals (02-23-2012)',. 'thumbnail': r're:^https?://.*\.jpg$',. 'creator': 'ss11spring',. 'duration': 1591,. 'upload_date': '20130114',. 'view_count': int,. }. }, {. # With non-empty description. # webpage returns "No permission or not login". 'url': 'http://www.camdemy.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HVSTM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3353
Entropy (8bit):	4.7926963830522
Encrypted:	false
SSDEEP:	96:q5WEIi3V4IN003r/uFZqIWKlH1tmlfGlxbBpd93NhBTVxoEa6Ng:Pzi3N0EYZqc11twGvbzd93NvTVM6Ng
MD5:	32E096A2A13A5B4ADA8B324602A251C3
SHA1:	88BC0B43C861F9A9FA6FD40B018E1270A5CD7DAD
SHA-256:	198C7B546F29A4B42B4F4B4D6CDAA3E346F199184B9D305BB8746F69ABC7C139
SHA-512:	6C955CA352055B2E39F2375380FEF6ACF5E2DCD13E515AC2AFBE626F199BDB6637A8CDA01E6005D48EAEC2EFA0D9206FD26D8A543944DB1ED9622C34F9BB06EC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import parse_duration...class BYUtvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?byutv\.org/(?:watch\|player)/(?!event/)(?P<id>[0-9a-f-]+)(?:/(?P<display_id>[^/?#&]+))?'. _TESTS = [{. # ooyalaVOD. 'url': 'http://www.byutv.org/watch/6587b9a3-89d2-42a6-a7f7-fd2f81840a7d/studio-c-season-5-episode-5',. 'info_dict': {. 'id': 'ZvanRocTpW-G5_yZFeltTAMv6jxOU9KH',. 'display_id': 'studio-c-season-5-episode-5',. 'ext': 'mp4',. 'title': 'Season 5 Episode 5',. 'description': 'md5:1d31dc18ef4f075b28f6a65937d22c65',. 'thumbnail': r're:^https?://.*',. 'duration': 1486.486,. },. 'params': {. 'skip_download': True,. },. 'add_ie': ['Ooyala'],. }, {. # dvr. 'url': 'https://www.byutv.org/player/8f1dab9b-b243-47c8-b525-3e2d021a3451/byu-softball-p

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-HVTDL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2281
Entropy (8bit):	4.869218463370929
Encrypted:	false
SSDEEP:	48:+u9AOpfuOQgzZ8vnt8cyquyOwBAqbBdp8/tBmHlVnjXh1XbVXn+6e6BJUz:y4uCzZ8vt8cyyOdGlt/1Be6BJG
MD5:	C3417B98B3522576C093CD3283CA34F3
SHA1:	F168D7F39A0F438D33A47C8F12B98521C81E7C5B
SHA-256:	876F4CD429E619C94923DD3EB3886BF22CCD0851EAE1F5EFB56F025EBDC4F9C7
SHA-512:	B6E7AD82A69115CE6B8CEA685B2E39899A63C440818BE9B3484B9F9FF5257AC1751F39864B97FE3FE8200DE3CB7D1528B17D45F26E5EC750D1FDB625F1D8DD8D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_chr.from ..utils import (. decode_packed_codes,. ExtractorError,.)...class VShareIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vshare\.io/[dv]/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://vshare.io/d/0f64ce6',. 'md5': '17b39f55b5497ae8b59f5fbce8e35886',. 'info_dict': {. 'id': '0f64ce6',. 'title': 'vl14062007715967',. 'ext': 'mp4',. }. }, {. 'url': 'https://vshare.io/v/0f64ce6/width-650/height-430/1',. 'only_matching': True,. }].. @staticmethod. def _extract_urls(webpage):. return re.findall(. r'<iframe[^>]+?src=["\'](?P<url>(?:https?:)?//(?:www\.)?vshare\.io/v/[^/?#&]+)',. webpage).. def _extract_packed(self, webpage):. packed = self._search_regex(. r'(eval\(function.+)', webpage, 'packed code').

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-I0T8K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2866
Entropy (8bit):	4.724212501670217
Encrypted:	false
SSDEEP:	48:+um2vBiwpWnm6ZX2oJoXjlhmtTfltoxuABy1qrdp4hmXgHu9lC:aybQnmOGoJs2lMu11Ogh1Ou
MD5:	13876ED2AC8CD1A26072E24164C21338
SHA1:	A9068F7EAB548F15D7597D8791B14D7BE2A853F4
SHA-256:	8EC37D915A0803E0BD44A724EE183065B2697315C12C6305FF114491A866CB8C
SHA-512:	D033A6B54C265116C16BD54D446348BDF8319A4DD9952CA2BEBA64E12251455349A25FE486ED26568046FE2ED190E867C5D03913D8642B9C529FF370D1DD4242
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .adobepass import AdobePassIE.from ..utils import (. extract_attributes,. smuggle_url,. update_url_query,.)...class USANetworkIE(AdobePassIE):. _VALID_URL = r'https?://(?:www\.)?usanetwork\.com/(?:[^/]+/videos\|movies)/(?P<id>[^/?#]+)'. _TEST = {. 'url': 'http://www.usanetwork.com/mrrobot/videos/hpe-cybersecurity',. 'md5': '33c0d2ba381571b414024440d08d57fd',. 'info_dict': {. 'id': '3086229',. 'ext': 'mp4',. 'title': 'HPE Cybersecurity',. 'description': 'The more we digitize our world, the more vulnerable we are.',. 'upload_date': '20160818',. 'timestamp': 1471535460,. 'uploader': 'NBCU-USA',. },. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id).. player_params = extract_attributes(self._search_regex(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-I1DG7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	15609
Entropy (8bit):	4.487260362491979
Encrypted:	false
SSDEEP:	384:O74ycqtX7OO2Ai2BiEutTQyTt6NzXGEghp8h8yLoirMOrpTgV6NYzH8pP8SLoibv:QVOO2Ai2BiEutTQyTt898yLoirMOrpTl
MD5:	E76D027E62B626D5BE8B5E099986719C
SHA1:	7307708D5C5E8D9B9210283570FF8CFBAEA988CB
SHA-256:	A3615A70AF300224D566F6E0A84DA166BAC069EB62DEF78A442F3FEA922AF820
SHA-512:	7C0BB1DA3B3189DD1B4549F575E08E7CADBD557F35C7B6D092C1C321C6949F73455D2D97460241BA40E1BFFDE04498E66BDAF18431972947C60F688B54ED89FC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. float_or_none,. HEADRequest,. int_or_none,. orderedSet,. remove_end,. strip_jsonp,. unescapeHTML,. unified_strdate,. url_or_none,.)...class ORFTVthekIE(InfoExtractor):. IE_NAME = 'orf:tvthek'. IE_DESC = 'ORF TVthek'. _VALID_URL = r'https?://tvthek\.orf\.at/(?:[^/]+/)+(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://tvthek.orf.at/program/Aufgetischt/2745173/Aufgetischt-Mit-der-Steirischen-Tafelrunde/8891389',. 'playlist': [{. 'md5': '2942210346ed779588f428a92db88712',. 'info_dict': {. 'id': '8896777',. 'ext': 'mp4',. 'title': 'Aufgetischt: Mit der Steirischen Tafelrunde',. 'description': 'md5:c1272f0245537812d4e36419c207b67d',. 'duration': 2668,. 'upload_dat

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-I43GT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10571
Entropy (8bit):	4.620298443780807
Encrypted:	false
SSDEEP:	192:Kzaw5PP5DBdVdi1x3wxHZyV6N0grxjcTWF/4/xS1/N3awg:Kzaw5PP5FdVdi1x3wxHZyV6N0grxjcT7
MD5:	C6F9201DC5E2BC62EB21F958198EF253
SHA1:	37AA8150144B650D7B29018703D2D036EE81352E
SHA-256:	0832E50AB4943A6B5DA24E7578E443B2BDC33ADB0766C85657BEEA9ABA8A00D4
SHA-512:	BA54F2A0EBA5DFA66C16C47BA3F1365DB4F91531C6D17D62C991E6C39CEA8AEF31108346193991C3DA573C0187783267E45A270B1CDC41A6C4E8931BE2A63520
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. float_or_none,. sanitized_Request,. unescapeHTML,. update_url_query,. urlencode_postdata,. USER_AGENTS,.)...class CeskaTelevizeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ceskatelevize\.cz/ivysilani/(?:[^/?#&]+/)(?P<id>[^/#?]+)'. _TESTS = [{. 'url': 'http://www.ceskatelevize.cz/ivysilani/ivysilani/10441294653-hyde-park-civilizace/214411058091220',. 'info_dict': {. 'id': '61924494877246241',. 'ext': 'mp4',. 'title': 'Hyde Park Civilizace: .ivot v Gr.nsku',. 'description': 'md5:3fec8f6bb497be5cdb0c9e8781076626',. 'thumbnail': r're:^https?://.\.jpg',. 'duration': 3350,. },. 'params': {. # m3u8 download. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-I8OUN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7782
Entropy (8bit):	4.834605131417687
Encrypted:	false
SSDEEP:	192:Xku6+OYTx947Gn4pdSXJ9IDOSyTThlQ+umewHdwOK6Ng:Xk3+OYTx934/M90OSyTThe+um/Hdk6Ng
MD5:	790C2CD17B011820C0F7563B7CA2FC69
SHA1:	79084A247B77F97D0789201A292ACF1AF4A809A7
SHA-256:	D65F6B40E249B9E1E7E2E2ADE2D862D8560546EC333D61797A92019E9274A9CE
SHA-512:	DEE80F4D43764D627F44AB6B6D648BA9AB42DDE39E6CFC14DB9CC6008BFDC4CE63C155669F3F8544A3808476C5F88277E17B17E6D64DFE635DFD2A7F58D80DE4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. sanitized_Request,. str_to_int,. unescapeHTML,. unified_strdate,. url_or_none,.).from ..aes import aes_decrypt_text...class YouPornIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?youporn\.com/watch/(?P<id>\d+)/(?P<display_id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://www.youporn.com/watch/505835/sex-ed-is-it-safe-to-masturbate-daily/',. 'md5': '3744d24c50438cf5b6f6d59feb5055c2',. 'info_dict': {. 'id': '505835',. 'display_id': 'sex-ed-is-it-safe-to-masturbate-daily',. 'ext': 'mp4',. 'title': 'Sex Ed: Is It Safe To Masturbate Daily?',. 'description': 'Love & Sex Answers: http://bit.ly/DanAndJenn -- Is It Unhealthy To Masturbate Daily?',. 'thumbnail': r're:^https?://.*\.jpg$',. 'uploader': 'Ask Dan And Jennifer',. 'upload_date': '2010

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IAA03.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.642009071913589
Encrypted:	false
SSDEEP:	48:PuKdqQP0U2cO0iN0R1qadfFQVFSKhYYrCsOId0SSP9WBs:n4QPV2/0iN02aCduIqSSFWBs
MD5:	B963221E24579D4981FE40872E4FC2E6
SHA1:	74BADDECA3A59F390B3FDDEA567D8F209D395CE2
SHA-256:	D478BD820C0802675F3352DCDAFE27453C3EC6EEF76914BC1E1B3CF22713B660
SHA-512:	E77D2A5B71CCA9B9C3985DFBF0FC723997705DA664771F91B5B9467EFAD9BDED855DB0792456D961B3059E34BBD4FD22B7BBDA7366DBD7D7F58DC8D322788AC8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import unified_strdate, determine_ext...class RoxwelIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?roxwel\.com/player/(?P<filename>.+?)(\.\|\?\|$)'.. _TEST = {. 'url': 'http://www.roxwel.com/player/passionpittakeawalklive.html',. 'info_dict': {. 'id': 'passionpittakeawalklive',. 'ext': 'flv',. 'title': 'Take A Walk (live)',. 'uploader': 'Passion Pit',. 'uploader_id': 'passionpit',. 'upload_date': '20120928',. 'description': 'Passion Pit performs "Take A Walk\" live at The Backyard in Austin, Texas. ',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). filename = mobj.group('filename'). info_url = 'http://www.roxwel.com/api/videos/%s' %

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ICEF6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	4.668208560940972
Encrypted:	false
SSDEEP:	24:zi8lFvPC6fqFSU/7Yl2ydHe4D1qHPiA0NSgtfeIXhgtdhDcHLhDCuqgNYaqUjWdo:+u1zf8t7C1R1qviFNBtfjXhkdVuVlqgD
MD5:	AC2421C539964FA5BCEEAD23FF95A136
SHA1:	1D8A8E357FEEE2BEF9961278BF05A8DC9F11E652
SHA-256:	31DC50E2A83BDAFAC1CD290198FF1FD61D115A52B0A269859B765447740E8069
SHA-512:	2FD08115EB9ABF4E1D5B85B05E7D8AFDC5570856DE76012F0A495CFE2F0746098F1D9C50C45A4C47B8BE6C18B064EF28930EF207A6AE8772C3CE2D91126CF77E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class RestudyIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\|portal)\.)?restudy\.dk/video/[^/]+/id/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://www.restudy.dk/video/play/id/1637',. 'info_dict': {. 'id': '1637',. 'ext': 'flv',. 'title': 'Leiden-frosteffekt',. 'description': 'Denne video er et eksperiment med flydende kv.lstof.',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }, {. 'url': 'https://portal.restudy.dk/video/leiden-frosteffekt/id/1637',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. title = self._og_search_title(webpage).strip(). description = self._og_search_description(webpage).strip().. formats = self

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IE5P1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3714
Entropy (8bit):	4.442212108930139
Encrypted:	false
SSDEEP:	96:tO0WAIn+NfnCdf4bS3YH18Up6DpvTyOabFTiSXLOr3vWBTEZNKlaL8/6Ng:c3AQKfC94b3H1e5a5jLOr3vyTd/6Ng
MD5:	785B5EE373C4F682AB9A6A66636F17AD
SHA1:	273B0E5FAE63E721B01195AACC5D5FBF13A85CD9
SHA-256:	BC63BE80898CFEAC1D063A65C5E5537EE3C43A6A5BE1A8A72C3000474AC00B06
SHA-512:	09D3CA744C4B3A002894927643DB506A85F8D010C393903BBE7A78FE3B7D3DCC59CF70E380CC7A18E0413AFA8885850BA99AD7333D1790D2389BB2552BF589BB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. try_get,. urlencode_postdata,.)...class YandexDiskIE(InfoExtractor):. _VALID_URL = r'https?://yadi\.sk/[di]/(?P<id>[^/?#&]+)'.. _TESTS = [{. 'url': 'https://yadi.sk/i/VdOeDou8eZs6Y',. 'md5': '33955d7ae052f15853dc41f35f17581c',. 'info_dict': {. 'id': 'VdOeDou8eZs6Y',. 'ext': 'mp4',. 'title': '4.mp4',. 'duration': 168.6,. 'uploader': 'y.botova',. 'uploader_id': '300043621',. 'view_count': int,. },. }, {. 'url': 'https://yadi.sk/d/h3WAXvDS3Li3Ce',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. status = self._download_webpage(. 'https://disk.yandex.com/auth/status', video_id, query={.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IFGP4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2946
Entropy (8bit):	4.913385487357782
Encrypted:	false
SSDEEP:	48:+uIdldC7fZRtBNqvgVpX0tfeXhjZkBLt2c0CB662iCBok06MukKwBZ6WkgAQ8cXJ:SldCjZRtBsvgVVKfoZE2Z6B2CKF/gJ8s
MD5:	89002E9993398316CBC64B4207771313
SHA1:	BCFDDEA73965250D1D270BF632010E6C59F7ED0E
SHA-256:	FC506AD642C2632F2A41C40516297CE86223A39CF75FBBADAD02D1911ED13FBA
SHA-512:	6A8A6ED9B4786C54C797CE4D2847FAC2BB3B0B81B85C4338AB2F9D97D7441DFD47ACE786D151E6C8058BECAAE7E5319498ACA80F39609D568EE84A992D69865E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_b64decode.from ..utils import parse_duration...class ChirbitIE(InfoExtractor):. IE_NAME = 'chirbit'. _VALID_URL = r'https?://(?:www\.)?chirb\.it/(?:(?:wp\|pl)/\|fb_chirbit_player\.swf\?key=)?(?P<id>[\da-zA-Z]+)'. _TESTS = [{. 'url': 'http://chirb.it/be2abG',. 'info_dict': {. 'id': 'be2abG',. 'ext': 'mp3',. 'title': 'md5:f542ea253f5255240be4da375c6a5d7e',. 'description': 'md5:f24a4e22a71763e32da5fed59e47c770',. 'duration': 306,. 'uploader': 'Gerryaudio',. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'https://chirb.it/fb_chirbit_player.swf?key=PrIPv5',. 'only_matching': True,. }, {. 'url': 'https://chirb.it/wp/MN58c2',. 'only_matching': True,. }].. def _real_extract(self, url):. audio_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IHA3L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	5.0813648680703345
Encrypted:	false
SSDEEP:	48:+uq1F5fb/eitXgvbnXbutfjX/CprFdXFEreB5d9BHjtz8j:O/LeitXgvrYfWfTErqRjtz8j
MD5:	F31F0168CFD8BCBF7F9E6FBAC2052CCF
SHA1:	55C6EE6284F6CE9009753552049388E4F72B28D1
SHA-256:	CDF2A73CF8DDA2A6DEF587CF220006F19FCE0D173310E1AC0067ED89128C44CB
SHA-512:	E622B16D143E11885B4B040C9892AB863108E54ACD5E6CBA716549428FA1FA96C77EE0C8E77B3C6AAED4E345985300BBC440597E1EFAB9CACCDD7255749636EF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. decode_packed_codes,. sanitized_Request,.)...class VideoMegaIE(InfoExtractor):. _VALID_URL = r'(?:videomega:\|https?://(?:www\.)?videomega\.tv/(?:(?:view\|iframe\|cdn)\.php)?\?ref=)(?P<id>[A-Za-z0-9]+)'. _TESTS = [{. 'url': 'http://videomega.tv/cdn.php?ref=AOSQBJYKIDDIKYJBQSOA',. 'md5': 'cc1920a58add3f05c6a93285b84fb3aa',. 'info_dict': {. 'id': 'AOSQBJYKIDDIKYJBQSOA',. 'ext': 'mp4',. 'title': '1254207',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }, {. 'url': 'http://videomega.tv/cdn.php?ref=AOSQBJYKIDDIKYJBQSOA&width=1070&height=600',. 'only_matching': True,. }, {. 'url': 'http://videomega.tv/view.php?ref=090051111052065112106089103052052103089106112065052111051090',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-II61T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16832
Entropy (8bit):	4.783652033629825
Encrypted:	false
SSDEEP:	384:SAu9oLg9G3W7nzzJg7ielSgqtHjxUjVoLq3nVXHHmIm8XKam7NXpJZrWpJycNulK:WzJ5bcNulbrch5c4f
MD5:	596AEBD47E9BC0FAEA7DBF155420B55F
SHA1:	8506544EF89203156C556D27133F04D36DF9F07C
SHA-256:	620CDB128ADDB5CFA81D747B669E74CF77C268749C4EF5A86157CCF4E7E64D22
SHA-512:	FBB916D5D0014881AC1FDAC0AB729DED2629B570F51D6CA84810125AF68D256CBDC6E1DFEE4683C32BF2D5435CBF935A9B9DF6E45BB00CD15D282E045932B3C7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import os.import re.import subprocess.import tempfile..from .common import InfoExtractor.from ..compat import (. compat_urlparse,. compat_kwargs,.).from ..utils import (. check_executable,. determine_ext,. encodeArgument,. ExtractorError,. get_element_by_id,. get_exe_version,. is_outdated_version,. std_headers,.)...def cookie_to_dict(cookie):. cookie_dict = {. 'name': cookie.name,. 'value': cookie.value,. }. if cookie.port_specified:. cookie_dict['port'] = cookie.port. if cookie.domain_specified:. cookie_dict['domain'] = cookie.domain. if cookie.path_specified:. cookie_dict['path'] = cookie.path. if cookie.expires is not None:. cookie_dict['expires'] = cookie.expires. if cookie.secure is not None:. cookie_dict['secure'] = cookie.secure. if cookie.discard is not None:. cookie_dict['discard'] = cookie.discard.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IJ5U4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	4.8345636207242935
Encrypted:	false
SSDEEP:	96:f7eI5wXjG+B8cyN2aDZLZeBFOYzAgJNPl6BTNt/mo6Ng:f7V5NB2atZ81JRlOTR6Ng
MD5:	BF8F6AA339B22D939F6A25ADDB0A18BF
SHA1:	9FBA095D239D08A40A8A8E4A6350098CF23239AB
SHA-256:	DED1AE6FF97AA65D17D870E95C10E2815C0C408436C8F18471DF172326B39CAC
SHA-512:	623E05CA561B59EF4CD179D9E3EA91320DBA7AA9AA9398291B17DABD5EA2C6E142BC0A525D60E775CF4DAF9E845E16BFE6A2A4393F7B3D1E306C1726DF79678A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. qualities,. unescapeHTML,. url_or_none,.)...class YapFilesIE(InfoExtractor):. _YAPFILES_URL = r'//(?:(?:www\|api)\.)?yapfiles\.ru/get_player/\?.?\bv=(?P<id>\w+)'. _VALID_URL = r'https?:%s' % _YAPFILES_URL. _TESTS = [{. # with hd. 'url': 'http://www.yapfiles.ru/get_player/?v=vMDE1NjcyNDUt0413',. 'md5': '2db19e2bfa2450568868548a1aa1956c',. 'info_dict': {. 'id': 'vMDE1NjcyNDUt0413',. 'ext': 'mp4',. 'title': '..... ...... ...... WIFI',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 72,. },. }, {. # without hd. 'url': 'https://api.yapfiles.ru/get_player/?uid=video_player_1872528&plroll=1&adv=1&v=vMDE4NzI1Mjgt690b',. 'only_matching': True,. }].. @staticmethod. def _extra

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IOIEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6470
Entropy (8bit):	4.634291726519435
Encrypted:	false
SSDEEP:	192:9zWfdvCBl4Z3eUlXdyezdyieayaT56J67mKEg9Tjmaww6NT:9zWfdKBl4FeUlXdRzdVenaF6J6KKEg9e
MD5:	D0F9FDC1203D76DE068A651A0249D99D
SHA1:	FB6E74B5AD4F75852E05A04479DDF7A94C77A9D8
SHA-256:	EC13BCBD0E0F791C602792D2A397A306957E4447E7B64B978FB813BEFEC4F841
SHA-512:	615D4632655BFE1F279A896E2CE0E311CB1E0CECD2CA92844FB00FC124B9948D55C8202BC7A1458669300674BE8DDF5DA243776D52EAD9259AE8EF2298ACD161
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .theplatform import ThePlatformBaseIE.from ..compat import (. compat_parse_qs,. compat_str,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. update_url_query,.)...class MediasetIE(ThePlatformBaseIE):. _TP_TLD = 'eu'. _VALID_URL = r'''(?x). (?:. mediaset:\|. https?://. (?:(?:www\|static3)\.)?mediasetplay\.mediaset\.it/. (?:. (?:video\|on-demand)/(?:[^/]+/)+[^/]+_\|. player/index\.html\?.*?\bprogramGuid=. ). )(?P<id>[0-9A-Z]{16}). '''. _TESTS = [{. # full episode. 'url': 'https://www.mediasetplay.mediaset.it/video/hellogoodbye/quarta-puntata_FAFU000000661824',. 'md5': '9b75534d42c44ecef7bf1ffea

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IQK22.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6025
Entropy (8bit):	4.727139228911961
Encrypted:	false
SSDEEP:	96:/V0t4CpKdIOuovERYHMZn8qZY6NFtpsbTMcpJd0NQyxHro5xFnOCvYqSEy6R3CDO:t0iwK0ocRYHMZn8B6NqHN0hxHc5jOCw0
MD5:	6473544E9C6215C64B4345168075240C
SHA1:	B753F4DBC5CF9604848C7BC5DE1FF428707F7B97
SHA-256:	6B0ED363F6993EF9F0A70B569A9A0E4B6706C6C77780B1B62F39047F0008A480
SHA-512:	C0575C4147FA78B959D6814CD83A5FC791AE688F09C18569BD6518B87848A394DC5F0263B1E9A3BC3F3893C43B65D095170891153E8ADEA97B6AAABDA221F7BD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from .youtube import YoutubeIE.from ..utils import (. clean_html,. ExtractorError,. get_element_by_id,.)...class TechTVMITIE(InfoExtractor):. IE_NAME = 'techtv.mit.edu'. _VALID_URL = r'https?://techtv\.mit\.edu/(?:videos\|embeds)/(?P<id>\d+)'.. _TEST = {. 'url': 'http://techtv.mit.edu/videos/25418-mit-dna-learning-center-set',. 'md5': '00a3a27ee20d44bcaa0933ccec4a2cf7',. 'info_dict': {. 'id': '25418',. 'ext': 'mp4',. 'title': 'MIT DNA and Protein Sets',. 'description': 'md5:46f5c69ce434f0a97e7c628cc142802d',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). raw_page = self._download_webpage(. 'http://techtv.mit.edu/videos/%s' % video_id, video_id). clean_page = re.compile(r' .*?-->', re.S).sub('', raw_page).. base_url = self._proto_r

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IQL7M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2794
Entropy (8bit):	4.650703893966094
Encrypted:	false
SSDEEP:	48:+uvWOzx1YyrfsnZzjzX3elXAt8c3WBYaRnjXoBlN7eNdPLOt4PLW9iXncBTN/DI4:KOzx1YyTsnZzfXOpm8c3WBY0nkN7cdPW
MD5:	51C8ADF794FD215FD6BCBB874DD15BCE
SHA1:	C4BCAD008E8B50D3C448981B10023680B1329CDD
SHA-256:	FD65904D7148512F74DEC6C5845B1DBB0CCA498B1753EF53366B43CDB3A91D04
SHA-512:	D67194EFCC12F62B814808321BE875BBE708FAB73DACFCCA4CA5F84B9736AE339E2744B24F0DDC9751CDB4D174DCEBB6DDB3A686922632A62D9FFA174DD71DA5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. float_or_none,. mimetype2ext,.)...class OnionStudiosIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?onionstudios\.com/(?:video(?:s/[^/]+-\|/)\|embed\?.\bid=)(?P<id>\d+)(?!-)'.. _TESTS = [{. 'url': 'http://www.onionstudios.com/videos/hannibal-charges-forward-stops-for-a-cocktail-2937',. 'md5': '719d1f8c32094b8c33902c17bcae5e34',. 'info_dict': {. 'id': '2937',. 'ext': 'mp4',. 'title': 'Hannibal charges forward, stops for a cocktail',. 'thumbnail': r're:^https?://.\.jpg$',. 'uploader': 'The A.V. Club',. 'uploader_id': 'the-av-club',. },. }, {. 'url': 'http://www.onionstudios.com/embed?id=2855&autoplay=true',. 'only_matching': True,. }, {. 'url': 'http://www.onionstudios.com/video/6139.json',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IRJNM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	4.847597353053954
Encrypted:	false
SSDEEP:	24:zi8lFvIHGlzaCZY/jE4dlwikT8BXHNqaeIXhgtBBfqLhUPGhDcehDWqUdlsSpK:+ugrCZYjE4sTKXNqajXhkBBIOGVzVWqf
MD5:	520DD5C8DC5B671E3C4BCCE2429CF163
SHA1:	014DEF5BFA35735BF830EEC364C5E925FC330B1B
SHA-256:	3FAE365D8BAE03BC0162CEC34100B878B3621B14C2035DC014A926228FE2BB6E
SHA-512:	4D4441097BF26BB69869AC85FB1BCD5AEADC6F097556AA967C73A8166D61BE74642CEB9F5D8A13454EDCDF7AB6976175C50E0B70B8E92F6E897DFDC74EC0EBEC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class SkylineWebcamsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?skylinewebcams\.com/[^/]+/webcam/(?:[^/]+/)+(?P<id>[^/]+)\.html'. _TEST = {. 'url': 'https://www.skylinewebcams.com/it/webcam/italia/lazio/roma/scalinata-piazza-di-spagna-barcaccia.html',. 'info_dict': {. 'id': 'scalinata-piazza-di-spagna-barcaccia',. 'ext': 'mp4',. 'title': 're:^Live Webcam Scalinata di Piazza di Spagna - La Barcaccia [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': 'Roma, veduta sulla Scalinata di Piazza di Spagna e sulla Barcaccia',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. stream_url = self._search_regex(. r

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IRUG7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	16197
Entropy (8bit):	4.589600955335941
Encrypted:	false
SSDEEP:	384:3+Q2rZjd+vISZ3ghTyoN6NitY78i2OclOS2fJOJ8r0TP6NaX1MedsrbyTo6NLuZM:HISZ3ghT9N8itYgi2OcoS2fJS8oTP8aV
MD5:	3302E07FDA6035D9C71976F44790C5B8
SHA1:	92C714ADF715CC4FFDA54701A2B2D688E3F6B3AF
SHA-256:	BE339E7F8EC84D4C24DCF31B2BD9DB6DCEBE6FA739638A5CDE4BD26D3CE833B4
SHA-512:	98428A2B12DE6A435F594D986CEF528A199AA52736CFDED74A1D2888A35D85325728E64BEE70D467332E2790F46A55A52A65D4E075BDFE67248AF16EB41A929C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .generic import GenericIE.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_duration,. qualities,. str_or_none,. try_get,. unified_strdate,. unified_timestamp,. update_url_query,. url_or_none,. xpath_text,.).from ..compat import compat_etree_fromstring...class ARDMediathekIE(InfoExtractor):. IE_NAME = 'ARD:mediathek'. _VALID_URL = r'^https?://(?:(?:(?:www\|classic)\.)?ardmediathek\.de\|mediathek\.(?:daserste\|rbb-online)\.de\|one\.ard\.de)/(?:./)(?P<video_id>[0-9]+\|[^0-9][^/\?]+)[^/\?](?:\?.*)?'.. _TESTS = [{. # available till 26.07.2022. 'url': 'http://www.ardmediathek.de/tv/S%C3%9CDLICHT/Was-ist-die-Kunst-der-Zukunft-liebe-Ann/BR-Fernsehen/Video?bcastId=34633636&documentId=44726822',. 'info_dict': {. 'id': '44726822',. 'ext': 'mp4',. 'title': 'Was ist die Ku

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ITVAO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4801
Entropy (8bit):	4.597570238126891
Encrypted:	false
SSDEEP:	96:fZUUeBJgvXjzFL2vonCqXjwVp7Hu23UfrCwjafpZ4xHWoBTdLI91pb9w6Ng:2XpvoCvi23CrCwja3gWoTdLl6Ng
MD5:	B0FA1810480F46A300FD5F377AA2D6CB
SHA1:	D167C58F03D9E008D187860ABC6C7A20574D7268
SHA-256:	3EDE93C9C853743280F9E035069F4549C18AF35BCC5958B82782AD68B5E1F328
SHA-512:	F2A8C45EF319763429FAFF59469CD67C1D9471B74D4299A621B308FD3E7086D82A1F52383DA40A14777D1891A8249FA166334144331A087AEB12E43E6F9C3B80
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. float_or_none,. parse_duration,. str_to_int,. urlencode_postdata,.)...class PandoraTVIE(InfoExtractor):. IE_NAME = 'pandora.tv'. IE_DESC = '...TV'. _VALID_URL = r'''(?x). https?://. (?:. (?:www\.)?pandora\.tv/view/(?P<user_id>[^/]+)/(?P<id>\d+)\| # new format. (?:.+?\.)?channel\.pandora\.tv/channel/video\.ptv\?\| # old format. m\.pandora\.tv/?\? # mobile. ). '''. _TESTS = [{. 'url': 'http://jp.channel.pandora.tv/channel/video.ptv?c1=&prgid=53294230&ch_userid=mikakim&ref=main&lot=cate_01_2',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-IUOUA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2640
Entropy (8bit):	4.660585640534153
Encrypted:	false
SSDEEP:	48:Pu/+LEfWWUHny1ZEoK1ivGEFDx0j98va6JtfdfFk2D2Jr2ZD9AL6keo7t/8ci:anWW4n2ZlK1ivGEFDx0j98vasfqE993L
MD5:	D4D878C647F43E72A5FB24C8EE8E489C
SHA1:	D139063130B563A575EAB39BF717B81F8414AC1D
SHA-256:	0708A8093ECB8C22009CC8A2A90A2EB09A741172384DAA886EB50308FFEC5ADE
SHA-512:	55D0EC831DE80547E3FFA2720081B293D9B0E042BE2D416F27890D0F2AFE87D75F59BAE5A6C271B41BF31928A0DBB2461DA54F28DBC2E02962A1C4E3C9981F28
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import int_or_none...class PodomaticIE(InfoExtractor):. IE_NAME = 'podomatic'. _VALID_URL = r'''(?x). (?P<proto>https?)://. (?:. (?P<channel>[^.]+)\.podomatic\.com/entry\|. (?:www\.)?podomatic\.com/podcasts/(?P<channel_2>[^/]+)/episodes. )/. (?P<id>[^/?#&]+). '''.. _TESTS = [{. 'url': 'http://scienceteachingtips.podomatic.com/entry/2009-01-02T16_03_35-08_00',. 'md5': '84bb855fcf3429e6bf72460e1eed782d',. 'info_dict': {. 'id': '2009-01-02T16_03_35-08_00',. 'ext': 'mp3',. 'uploader': 'Science Teaching Tips',. 'uploader_id': 'scienceteachingtips',. 'title': '64. When the Moon Hits Your Eye',. 'duration': 446,. }. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-J3PL1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3336
Entropy (8bit):	4.783132233557643
Encrypted:	false
SSDEEP:	96:D2LzCLd0ulX/Jmt5sALHaAiUNX9fb8qdl3NhBT/HWpIzNl4t78t6Ng:D902mt5sqriUHDdl3NvTLt6Ng
MD5:	AFC0246EFC8A4231EBD4E6A0CEA4711E
SHA1:	7404CBB8EDFA7DB6F21AD17BCBFCE519D9DE3AC6
SHA-256:	460FDA0BE87F30EDDE264B4640E13EBAFB367A6FA778DD6B46AD510A301E249C
SHA-512:	4202C931FEDE58465AA907CC7611B270C67D095DDF22DE7F8344FDD09132EAD0519171DC22A6A09BD6C10213AD47DE72FF003B8B25F3BA3CAAF1607619F37A04
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. url_or_none,.)...class YandexVideoIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. yandex\.ru(?:/portal/(?:video\|efir))?/?\?.*?stream_id=\|. frontend\.vh\.yandex\.ru/player/. ). (?P<id>[\da-f]+). '''. _TESTS = [{. 'url': 'https://yandex.ru/portal/video?stream_id=4dbb262b4fe5cf15a215de4f34eee34d',. 'md5': '33955d7ae052f15853dc41f35f17581c',. 'info_dict': {. 'id': '4dbb262b4fe5cf15a215de4f34eee34d',. 'ext': 'mp4',. 'title': '. ...-..... ..... . ........ .......... .. ....... . .......... .. .......',. 'description': '',. 'thumbnail': r're:^https?:/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-J6FUM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.158670729717652
Encrypted:	false
SSDEEP:	24:zi8lDGGew7fXbKxV/7dlSvNCdNV5PXbBl3tf9lfFIigkWK:+uDGCfY7QKtP3tf9lfFIigkr
MD5:	8D24ADFB83002B01975E01BCC3834B91
SHA1:	7E14AE4D3C2A7E4CE5EAF2A6D672B217616F75F6
SHA-256:	F40ADE3D698D742C5D7F073683397C699A49C2D2483E6A13CAD665837C103B53
SHA-512:	6F9318025B5BF91A2A881CD71AE79D9B4E583C4CDFCB7309BFB9EC77A6D3DCA547D20C5EEE7751EF822AC33C90F74D4423F80657F19099AA33ABA65A8970F327
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .hbo import HBOBaseIE...class CinemaxIE(HBOBaseIE):. _VALID_URL = r'https?://(?:www\.)?cinemax\.com/(?P<path>[^/]+/video/[0-9a-z-]+-(?P<id>\d+))'. _TESTS = [{. 'url': 'https://www.cinemax.com/warrior/video/s1-ep-1-recap-20126903',. 'md5': '82e0734bba8aa7ef526c9dd00cf35a05',. 'info_dict': {. 'id': '20126903',. 'ext': 'mp4',. 'title': 'S1 Ep 1: Recap',. },. 'expected_warnings': ['Unknown MIME type application/mp4 in DASH manifest'],. }, {. 'url': 'https://www.cinemax.com/warrior/video/s1-ep-1-recap-20126903.embed',. 'only_matching': True,. }].. def _real_extract(self, url):. path, video_id = re.match(self._VALID_URL, url).groups(). info = self._extract_info('https://www.cinemax.com/%s.xml' % path, video_id). info['id'] = video_id. return info.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JA0OV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5817
Entropy (8bit):	4.2236397890715836
Encrypted:	false
SSDEEP:	96:BQZP/JvTZKIQrYSen0Zm4NRQkulcuhOh+BDXQPBT726N1+K69b:OFJ7ofrS0ZykulcuhOh+BDXQZT726Nza
MD5:	30FB51EDC58EF5CA77A4B243328512F5
SHA1:	5AA44B04C54B891C8028011784F9EDDBBB22946E
SHA-256:	A756E4D494E2F5711BD1D65FE380126544AB5565442B3CF8433EA32469D64808
SHA-512:	39206E5EC4534EEFF954C59D7B65638ABABF7A673EB00862759E2098706EA67AF21C203E9AFE5B2FB324D484B5BE8B2A86C4AA1387987CF651F9E8CDD00B69A7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. str_or_none,.)...class VVVVIDIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vvvvid\.it/(?:#!)?(?:show\|anime\|film\|series)/(?P<show_id>\d+)/[^/]+/(?P<season_id>\d+)/(?P<id>[0-9]+)'. _TESTS = [{. # video_type == 'video/vvvvid'. 'url': 'https://www.vvvvid.it/#!show/434/perche-dovrei-guardarlo-di-dario-moccia/437/489048/ping-pong',. 'md5': 'b8d3cecc2e981adc3835adf07f6df91b',. 'info_dict': {. 'id': '489048',. 'ext': 'mp4',. 'title': 'Ping Pong',. },. 'params': {. 'skip_download': True,. },. }, {. # video_type == 'video/rcs'. 'url': 'https://www.vvvvid.it/#!show/376/death-note-live-action/377/482493/episodio-01',. 'md5': '33e0edfba720ad73a8782157fdebc648',. 'info_dict': {. 'id': '48249

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JA8LC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2586
Entropy (8bit):	4.889857615322385
Encrypted:	false
SSDEEP:	48:+uOSs50efsRu3gOqnwlXSU/Sty5dfFFlvTDwrSBcxdFCuOGoISCT:CSG0YsRu39qnUSI5rX4FZ0CT
MD5:	6698FEAB37322F3680DAE5BFFB6F96A8
SHA1:	49ADB51EBB684E7D2F8EF9301B883DD6A74CE31D
SHA-256:	ADCA3D46661304CAA56BA2973DF364F8B32C6415AAA3B9235C72AE5D0316637E
SHA-512:	63A957C121C864ED5CD92F7868415586C4DED07192F655E6E21C90C8DFB9D8667F3156C232A0114852E81540DEE58132218833C39848C8B001C7952A3E0C026C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .brightcove import BrightcoveLegacyIE.from .dplay import DPlayIE.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import smuggle_url...class DiscoveryNetworksDeIE(DPlayIE):. _VALID_URL = r'''(?x)https?://(?:www\.)?(?P<site>discovery\|tlc\|animalplanet\|dmax)\.de/. (?:. .\#(?P<id>\d+)\|. (?:[^/]+/)videos/(?P<display_id>[^/?#]+)\|. programme/(?P<programme>[^/]+)/video/(?P<alternate_id>[^/]+). )'''.. _TESTS = [{. 'url': 'http://www.tlc.de/sendungen/breaking-amish/videos/#3235167922001',. 'info_dict': {. 'id': '3235167922001',. 'ext': 'mp4',. 'title': 'Breaking Amish: Die Welt da drau.en',. 'description': (. 'Vier Amische und eine Mennonitin wagen in New York'. ' den Sprung

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JE2OF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5558
Entropy (8bit):	4.614158567797813
Encrypted:	false
SSDEEP:	96:kUz7EnAd4kYJ3AyKyPyfzCzYzoQcz/yn21ROgTE1OcrcosUmKoYkHnBTch9e6NeA:TnEAd4dAXw8GMErO1OcrcosUmKoYETKL
MD5:	BF744BB038D2705691EBA74302285FC2
SHA1:	7216B09EDF7657986CDC20A0C2329A9A4E2A0B95
SHA-256:	F2454CEB98932F16B768A7D0879A57B9A595FE4675EC9D764DAF2E75C8FA4DE5
SHA-512:	F29FA531CC38392152AAA9F3A484ABE66B03DBCD2519A6B1B9CF24C8569B0C3AB3971BAC73B0A9A372125C19935B4BA0EE89F9E861880A05B42EBA9D349A1855
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. strip_or_none,.)...class RTBFIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://(?:www\.)?rtbf\.be/. (?:. video/[^?]+\?.\bid=\|. ouftivi/(?:[^/]+/)[^?]+\?.\bvideoId=\|. auvio/[^/]+\?.\b(?P<live>l)?id=. )(?P<id>\d+)'''. _TESTS = [{. 'url': 'https://www.rtbf.be/video/detail_les-diables-au-coeur-episode-2?id=1921274',. 'md5': '8c876a1cceeb6cf31b476461ade72384',. 'info_dict': {. 'id': '1921274',. 'ext': 'mp4',. 'title': 'Les Diables au coeur (.pisode 2)',. 'description': '(du 25/04/2014)',. 'duration': 3099.54,. 'upload_date': '20140425',. 'timestamp': 1398456300,. }. }, {. # geo restricted. 'url': 'http://www.rtbf.be/ouftivi/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JE3M9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4229
Entropy (8bit):	4.725492290147779
Encrypted:	false
SSDEEP:	96:P3GRtVXVqXkzgwJPBRj6G5+8TYHrJqagyZGu2mEBV6/BTLt/8Z6Ng:/aEkbJ7j6G5TYLVzGu2pETmZ6Ng
MD5:	34807E602EDBF3A27DF873990E70D6EB
SHA1:	8F4026548A24ED275213020F2B18D8298DA9725C
SHA-256:	7B8C84A058FAAB9C4A46AB51FF58C2450FC8829BE1490E31B6651619791C3668
SHA-512:	530EEAE6B80D8AE163994B14BE1F4A62B351AB1658AA545990970DA650FCD4BB4B49289D3BF9F946B8F5FE0257955AEE8C8B4A27AA79F2B18046DAE99ED55265
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. parse_age_limit,.)...class TvigleIE(InfoExtractor):. IE_NAME = 'tvigle'. IE_DESC = '........-........... Tvigle.ru'. _VALID_URL = r'https?://(?:www\.)?(?:tvigle\.ru/(?:[^/]+/)+(?P<display_id>[^/]+)/$\|cloud\.tvigle\.ru/video/(?P<id>\d+))'.. _GEO_BYPASS = False. _GEO_COUNTRIES = ['RU'].. _TESTS = [. {. 'url': 'http://www.tvigle.ru/video/sokrat/',. 'md5': '36514aed3657d4f70b4b2cef8eb520cd',. 'info_dict': {. 'id': '1848932',. 'display_id': 'sokrat',. 'ext': 'flv',. 'title': '......',. 'description': 'md5:d6b92ffb7217b4b8ebad2e7665253c17',. 'duration': 6586,. 'age_limit': 12,. },. 'skip': 'georestricted'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JH6HA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8481
Entropy (8bit):	4.57472913122836
Encrypted:	false
SSDEEP:	192:tYBwL3dH64vSd3T1TrjRnyTH6N85JT66d3TuKVzHJaUq0:tL3dH64vSd31jtyTH6N85l66BzwUq0
MD5:	8756AAF85E5D2052E2FB971960A8F794
SHA1:	91F0540E31BAE7164B15690AAAE74C0DF435E857
SHA-256:	2A81BD1585E1941568ED6F6AC93D72A9759E14C820A093590B3ADA57A5C933D3
SHA-512:	BE2F294218CAAB6574D52A76E0C3060532EC8712624AF8A7920B57637AD3549759F4D9055BBD883A35F408927EE2C271F667CE10DE5F58B5828D24355A03161B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. clean_html,. determine_ext,. ExtractorError,. float_or_none,. int_or_none,. str_or_none,. url_or_none,. urlencode_postdata,. urljoin,.)...class LecturioBaseIE(InfoExtractor):. _API_BASE_URL = 'https://app.lecturio.com/api/en/latest/html5/'. _LOGIN_URL = 'https://app.lecturio.com/en/login'. _NETRC_MACHINE = 'lecturio'.. def _real_initialize(self):. self._login().. def _login(self):. username, password = self._get_login_info(). if username is None:. return.. # Sets some cookies. _, urlh = self._download_webpage_handle(. self._LOGIN_URL, None, 'Downloading login popup').. def is_logged(url_handle):. return self._LOGIN_URL not in compat_str(url_handle.geturl()).. # Already logged in. if is_logged(urlh):.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JICKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3123
Entropy (8bit):	4.56756002568932
Encrypted:	false
SSDEEP:	96:lOBjNn0zJvcBff5TEleWC9CWXLOr3l7v6NQ56VKNI8Z:0ZN0FvcJ5aeWaLOr3l7v6NQwKZ
MD5:	A36FA3E952414F8ECB019AE0C005503D
SHA1:	46304502ECD9919B874125EDC2B2D3D29D68B1C1
SHA-256:	E04AE5F107EE447F771E11B5CF7052F7F91BE9B4FD9503B00A96AF6B5F97F231
SHA-512:	E2BD37586B5B4D1E40C546106AA0125A72EFD7AAC705029DA83D64420A2A9C74FFF9F4736EEF21368403E58F91EACFCBB4D8DB2B673FC9937CDEA29595ACDC3E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. parse_duration,. url_or_none,.)...class YouJizzIE(InfoExtractor):. _VALID_URL = r'https?://(?:\w+\.)?youjizz\.com/videos/(?:[^/#?]*-(?P<id>\d+)\.html\|embed/(?P<embed_id>\d+))'. _TESTS = [{. 'url': 'http://www.youjizz.com/videos/zeichentrick-1-2189178.html',. 'md5': 'b1e1dfaa8bb9537d8b84eeda9cf4acf4',. 'info_dict': {. 'id': '2189178',. 'ext': 'mp4',. 'title': 'Zeichentrick 1',. 'age_limit': 18,. 'duration': 2874,. }. }, {. 'url': 'http://www.youjizz.com/videos/-2189178.html',. 'only_matching': True,. }, {. 'url': 'https://www.youjizz.com/videos/embed/31991001',. 'only_matching': True,. }].. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id') or mobj.gro

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JIS3N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18984
Entropy (8bit):	4.740260857191167
Encrypted:	false
SSDEEP:	384:esfKm735EX9EOLPlRTsbCV9CzjTI6NL8RrXlyX07Fxe59/Q7j7clEaQO2dxOw8T7:esfKm35EX9EOLPlRTsbCV9CzjTI8L8Rm
MD5:	5698F064F22BB90BD74E5C1426E3B97E
SHA1:	994A8F438698EB8E3DC980E9951372F72B389DAB
SHA-256:	5FBF52BC555553D0958BA4C7E6B628931689F2FB5B78A956D5959CBE43F39AA9
SHA-512:	420EF080680639597DFC3AA40C2D58EE57A8AA65D8D3C8BBAEDB954E30C546B8C51C2D4F30DAD80E21259F7509012F151A3C4FF60BF665BC51919015284E6D6C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_xpath,.).from ..utils import (. ExtractorError,. find_xpath_attr,. fix_xml_ampersands,. float_or_none,. HEADRequest,. RegexNotFoundError,. sanitized_Request,. strip_or_none,. timeconvert,. try_get,. unescapeHTML,. update_url_query,. url_basename,. xpath_text,.)...def _media_xml_tag(tag):. return '{http://search.yahoo.com/mrss/}%s' % tag...class MTVServicesInfoExtractor(InfoExtractor):. _MOBILE_TEMPLATE = None. _LANG = None.. @staticmethod. def _id_from_uri(uri):. return uri.split(':')[-1].. @staticmethod. def _remove_template_parameter(url):. # Remove the templates, like &device={device}. return re.sub(r'&[^=]?={.?}(?=(&\|$))', '', url).. def _get_feed_url(self, uri):. return self._FEED_URL.. def _get_thumbnail_url(self, uri, itemdoc):. search_path

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JIUFM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.028972935818782
Encrypted:	false
SSDEEP:	24:zi8lFvLyb89aBHx/xD/hrdlBw+XDnQLdZBHTnD1MlsiZ9pw1gNfeIXjlOsZlvUE:+uL98zx9LqhrD16si/Se5jXjlvUE
MD5:	62DED1DC820F51499830996B7F38CF34
SHA1:	F7767D1A992354143C1DD81904BBA80D9D380B5A
SHA-256:	DBD8ACEC73064736B3D71FB75908662131D2BF311041E88B681B13EBD2EB1246
SHA-512:	E53CE37DB9A2125DF95AFF0239113EA7F735457E327D4D318A90C823A037C8F49023EFF0C87BD8107AC7D3D7FFD5DC894FC9B0726BDC500501AB87299F4740E5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class UKTVPlayIE(InfoExtractor):. _VALID_URL = r'https?://uktvplay\.uktv\.co\.uk/.+?\?.*?\bvideo=(?P<id>\d+)'. _TEST = {. 'url': 'https://uktvplay.uktv.co.uk/shows/world-at-war/c/200/watch-online/?video=2117008346001',. 'md5': '',. 'info_dict': {. 'id': '2117008346001',. 'ext': 'mp4',. 'title': 'Pincers',. 'description': 'Pincers',. 'uploader_id': '1242911124001',. 'upload_date': '20130124',. 'timestamp': 1359049267,. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'expected_warnings': ['Failed to download MPD manifest']. }. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/1242911124001/H1xnMOqP_default/index.html?videoId=%s'.. def _real_extract(self, url):. video_id = self._match_id(url). return se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JJR5T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4489
Entropy (8bit):	4.621998385855776
Encrypted:	false
SSDEEP:	96:VW9QNLd6va8cylZo20HoFivEJF/HJ8BTegY/MKEBfA9ZtN0E8R6ND:sMkv9ZoZHwcE/pUT1BysR6ND
MD5:	B1184ED4A4AF333E69ECDCC0DB77CDC0
SHA1:	FF217EC5DA3D711569B6ED628B9884B6473A527B
SHA-256:	BBF18E138C5DBF421172F55621B8875CFB476ECF7FCD3F46AB07394B69F9AE5A
SHA-512:	97E91107995AB4DC518B464ABA822FC3D50215E78C25DD2982C82934E66509F8FDB9A0A403A95889DB09E056BFBAE62C34894E38B34A33164157B2A8F48D1ACF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. merge_dicts,. str_to_int,. unified_strdate,. url_or_none,.)...class RedTubeIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.\|de.)?redtube\.com/\|embed\.redtube\.com/\?.*?\bid=)(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.redtube.com/66418',. 'md5': 'fc08071233725f26b8f014dba9590005',. 'info_dict': {. 'id': '66418',. 'ext': 'mp4',. 'title': 'Sucked on a toilet',. 'upload_date': '20110811',. 'duration': 596,. 'view_count': int,. 'age_limit': 18,. }. }, {. 'url': 'http://embed.redtube.com/?bgcolor=000000&id=1443286',. 'only_matching': True,. }].. @staticmethod. def _extract_urls(webpage):. return re.findall(. r'<iframe[^>]+?src=["\'](?P<url>(?:https?:)?//embed\.redtube\.co

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JOGMR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4061
Entropy (8bit):	4.272039533387268
Encrypted:	false
SSDEEP:	96:YORydH37k3084WFrGqwR5p5dflxCydSiktPLOWgXBTy66/NU6Ng:tROFVNlxh8ikJLOWgxTye6Ng
MD5:	CC1BE0BC18C44C15593BADA1422ABD2F
SHA1:	A2CD93C20B53C13C118AC7E08E8BB37C70EECE3C
SHA-256:	7A6B0F674623308B91D79800BBC128469210E75D21AD3498D3F529758980C951
SHA-512:	710D78AE622465A421BD071234AA37EB350F39558629B0A76B0518F60DA8D5A44FF49F1C44D681CDF560E6BF4E713F8C662E4243BAFFB8B8EF1413E244A3D44C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. mimetype2ext,. parse_iso8601,. url_or_none,.)...class AMPIE(InfoExtractor):. # parse Akamai Adaptive Media Player feed. def _extract_feed_info(self, url):. feed = self._download_json(. url, None, 'Downloading Akamai AMP feed',. 'Unable to download Akamai AMP feed'). item = feed.get('channel', {}).get('item'). if not item:. raise ExtractorError('%s said: %s' % (self.IE_NAME, feed['error'])).. video_id = item['guid'].. def get_media_node(name, default=None):. media_name = 'media-%s' % name. media_group = item.get('media-group') or item. return media_group.get(media_name) or item.get(media_name) or item.get(name, default).. thumbnails = []. media_thumbnail = get_media_node('thumbnail').

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JSESA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	4.681680564846151
Encrypted:	false
SSDEEP:	192:TqFdAXB/uzmAmvHeTCHQRzM3MyTlN5RWpjUZTqj5uo1dQ+KmCuuIX3Tdh6No:+FdWB/uzmAeHe+HQRzI1TlN5opqTqj5t
MD5:	30B215E71817AD7125B978E4BE213532
SHA1:	F58DB76461C24C95908CA53E724FDC5F53C45461
SHA-256:	987DDE928D61553E706297DA4D1E94F09ED5D6E97C0A1B87D6F17480E6676EA8
SHA-512:	6679F504C5D773D84C4572B28D09A3DD3A3E45F3C1901EF215CAA1D7117A4B99895052F78BD9691FC690518DE5918422DA03403861E279ACBCD60113149B2564
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_strdate,. compat_str,. determine_ext,. ExtractorError,. update_url_query,.)...class DisneyIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://(?P<domain>(?:[^/]+\.)?(?:disney\.[a-z]{2,3}(?:\.[a-z]{2})?\|disney(?:(?:me\|latino)\.com\|turkiye\.com\.tr\|channel\.de)\|(?:starwars\|marvelkids)\.com))/(?:(?:embed/\|(?:[^/]+/)+[\w-]+-)(?P<id>[a-z0-9]{24})\|(?:[^/]+/)?(?P<display_id>[^/?#]+))'''. _TESTS = [{. # Disney.EmbedVideo. 'url': 'http://video.disney.com/watch/moana-trailer-545ed1857afee5a0ec239977',. 'info_dict': {. 'id': '545ed1857afee5a0ec239977',. 'ext': 'mp4',. 'title': 'Moana - Trailer',. 'description': 'A fun adventure for the entire Family! Bring home Moana on Digital HD Feb 21 & Blu-ray March 7',. 'upload_date': '20170112',. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JSK11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2103
Entropy (8bit):	5.0066775042950455
Encrypted:	false
SSDEEP:	48:+upnZDdfJVzB83LjdajXhktaOYNkYCFUJs+BTXB7rNYWPB1xEW8Ek4b6Ng:VnZDN/t83Ljdaat9MkXmG+BTlxJHPAOL
MD5:	D39B06D302C07FE41408AC2718F475DB
SHA1:	A7AE288A7DD72BCD7CB6682D056958DDA9A42D23
SHA-256:	9001C134D6C037CDC16DF0334537FD78721EDF3D71C9E27C552E952B339ED6B5
SHA-512:	6D2E4DD0723ED4E134BDDA628629B0AFECAFE5E662814E322DB6D6684EDC6B50C09C30117467B35D8D83DA6703785896040B405C8E57A283666129CEB55C8DC9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. qualities,. unified_timestamp,.)...class PearVideoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pearvideo\.com/video_(?P<id>\d+)'. _TEST = {. 'url': 'http://www.pearvideo.com/video_1076290',. 'info_dict': {. 'id': '1076290',. 'ext': 'mp4',. 'title': '................',. 'description': 'md5:01d576b747de71be0ee85eb7cac25f9d',. 'timestamp': 1494275280,. 'upload_date': '20170508',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. quality = qualities(. ('ldflv', 'ld', 'sdflv', 'sd', 'hdflv', 'hd', 'src')).. formats = [{. 'url': mobj.group('url'),. 'format_id': mobj.group('id'),. 'qual

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-JU3V5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.7821957430096464
Encrypted:	false
SSDEEP:	48:PuBDrlpAFzbN3OtfjpJUpihzQ49t7kdvpudzjpJUpiF:gtpAFzbNcfnhNBkdvQFnF
MD5:	44E3932576322EDDB67A7B0E9AF39369
SHA1:	47A50DCF63E566C1FE0D65392C396C2EC9821074
SHA-256:	9FD52D3F326858D4A716B3688D58513015FC56022C757997E5605B2876C0595B
SHA-512:	9B92CA5EA88DB7B8145C13FC3299A4FAEA50999866EBF4506A22CE08189BC0C57C520A8AF0DDE98A8A309416B5F5E98C60457ABF10592AA5DA4DA638D5CE9B36
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urlparse,.)...class RtmpIE(InfoExtractor):. IE_DESC = False # Do not list. _VALID_URL = r'(?i)rtmp[est]?://.+'.. _TESTS = [{. 'url': 'rtmp://cp44293.edgefcs.net/ondemand?auth=daEcTdydfdqcsb8cZcDbAaCbhamacbbawaS-bw7dBb-bWG-GqpGFqCpNCnGoyL&aifp=v001&slist=public/unsecure/audio/2c97899446428e4301471a8cb72b4b97--audio--pmg-20110908-0900a_flv_aac_med_int.mp4',. 'only_matching': True,. }, {. 'url': 'rtmp://edge.live.hitbox.tv/live/dimak',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._generic_id(url). title = self._generic_title(url). return {. 'id': video_id,. 'title': title,. 'formats': [{. 'url': url,. 'ext': 'flv',. 'format_id': compat_urlparse.urlparse(url).scheme,. }],. }...class MmsIE(I

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-K0BJJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2480
Entropy (8bit):	4.677866579386833
Encrypted:	false
SSDEEP:	48:+uATtWnPy/1qpe2rD1q+pRZBlmbJoXjMMHBoGhnWYqGFJBTK3EYWk6Ng:kWnPC10e2rgmgbJmaGtWYdFJBTK3EYPL
MD5:	FD8CCCEA2EF2DC6013879EBCC712F249
SHA1:	893F42211D5D88D40CCB6853F37E332E11174119
SHA-256:	1A365D86410B1C6630A9EFE21A50B4AFD0078C9AB8F1BB0A3FF1320116B755A9
SHA-512:	67B67DF3ED930CB4CE688D85B6FB84006C2C999986000F9AA209BA8C49B91D16BA1B7D0B3A6D0FA18D8B67C9A58E07DF360EDEBEAFD203A70D7542034A356370
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. parse_duration,. parse_iso8601,. urlencode_postdata,.)...class UFCTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ufc\.tv/video/(?P<id>[^/]+)'. _NETRC_MACHINE = 'ufctv'. _TEST = {. 'url': 'https://www.ufc.tv/video/ufc-219-countdown-full-episode',. 'info_dict': {. 'id': '34167',. 'ext': 'mp4',. 'title': 'UFC 219 Countdown: Full Episode',. 'description': 'md5:26d4e8bf4665ae5878842d7050c3c646',. 'timestamp': 1513962360,. 'upload_date': '20171222',. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }.. def _real_initialize(self):. username, password = self._get_login_info(). if username is None:. return.. code = self._download_json(. 'https://www.ufc.tv

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-K33D9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2561
Entropy (8bit):	4.733710329283779
Encrypted:	false
SSDEEP:	48:+uUAO3fZWPhdc4C6uK59RlvtDtfjXhk34uXH4YNCEQrTzuwWAKieMATW8CbAQ8cK:z2Z8L58KJlvt5fa3P4YepeMN8CbJ8R
MD5:	297875A0144B6EEBCD6631C52D80A388
SHA1:	D88336A01BB710CABD570CA5F3555CFFC85786CE
SHA-256:	AB86E64590F2102D6321C96F3BC585F12A206530EF42CA60890E2A9A0BDC93A2
SHA-512:	371BBF6B6D624CC2E72AD6EAD2331D1AFFFD6B1BBF45E0178159D9C6433A2FDB91912CD372D9B38D86241D189B15440AEBB1D6454B197EACB60ED4DEB1B79CDE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import float_or_none...class AudioBoomIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?audioboom\.com/(?:boos\|posts)/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://audioboom.com/boos/4279833-3-09-2016-czaban-hour-3?t=0',. 'md5': '63a8d73a055c6ed0f1e51921a10a5a76',. 'info_dict': {. 'id': '4279833',. 'ext': 'mp3',. 'title': '3/09/2016 Czaban Hour 3',. 'description': 'Guest: Nate Davis - NFL free agency, Guest: Stan Gans',. 'duration': 2245.72,. 'uploader': 'SB Nation A.M.',. 'uploader_url': r're:https?://(?:www\.)?audioboom\.com/channel/steveczabanyahoosportsradio',. }. }, {. 'url': 'https://audioboom.com/posts/4279833-3-09-2016-czaban-hour-3?t=0',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-K6J5F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3269
Entropy (8bit):	4.856412809818029
Encrypted:	false
SSDEEP:	96:q0cJKQS6AFjN7kO5JsX8K09f4Y1vj3I9hE:8/6N7k4JsinaE
MD5:	44EC8BA619B7E63CCB50FC2D6AA14BCF
SHA1:	1BCFBA37B781222C10FBE59E27F05805A2A14D74
SHA-256:	CE6D3B24B2785455AEC2734838AE4047F1360DDAE9CAB42225C72362FFF229D1
SHA-512:	DEE6EC19C50904903CA28E682E0868997FD6DBD04879A58003BA80DA79E7A46E0CB6D798F2727B8EA5B183BF5F5C9DF7B6D6EDD953563950CEE9A6ED67F87D05
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. smuggle_url,.)...class NineNowIE(InfoExtractor):. IE_NAME = '9now.com.au'. _VALID_URL = r'https?://(?:www\.)?9now\.com\.au/(?:[^/]+/){2}(?P<id>[^/?#]+)'. _GEO_COUNTRIES = ['AU']. _TESTS = [{. # clip. 'url': 'https://www.9now.com.au/afl-footy-show/2016/clip-ciql02091000g0hp5oktrnytc',. 'md5': '17cf47d63ec9323e562c9957a968b565',. 'info_dict': {. 'id': '16801',. 'ext': 'mp4',. 'title': 'St. Kilda\'s Joey Montagna on the potential for a player\'s strike',. 'description': 'Is a boycott of the NAB Cup "on the table"?',. 'uploader_id': '4460760524001',. 'upload_date': '20160713',. 'timestamp': 1468421266,. },. 'skip': 'Only available in Australia',. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-K72J1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7021
Entropy (8bit):	4.688069063732678
Encrypted:	false
SSDEEP:	192:9NtIvD+cFfjzdd0oW9TLCS6w16N9ob1kfjezTV:9Nt0D1hjzdd0oWJLCSb16NECfjezTV
MD5:	97ECAF68DC59B9D84E6FAA66D13DD783
SHA1:	A6E446576B49C85E9F777036EC640CD57A8EBC24
SHA-256:	344CAB4B471555569FE20CE542663E012F565E02CF06B14E9C9A1695F26F817E
SHA-512:	459AFEE76A392599E02D5CAE3437D224825966348276811B967340E862F57FB83F3D62E6D2F191EA0DAD4707247D400600B4E3B7CA2F85502DD8441B748478B5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import codecs.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. multipart_encode,. parse_duration,. random_birthday,. urljoin,.)...class CDAIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.)?cda\.pl/video\|ebd\.cda\.pl/[0-9]+x[0-9]+)/(?P<id>[0-9a-z]+)'. _BASE_URL = 'http://www.cda.pl/'. _TESTS = [{. 'url': 'http://www.cda.pl/video/5749950c',. 'md5': '6f844bf51b15f31fae165365707ae970',. 'info_dict': {. 'id': '5749950c',. 'ext': 'mp4',. 'height': 720,. 'title': 'Oto dlaczego przed zakr.tem nale.y zwolni..',. 'description': 'md5:269ccd135d550da90d1662651fcb9772',. 'thumbnail': r're:^https?://.*\.jpg$',. 'average_rating': float,. 'duration': 39,. 'age_limit': 0,. }. }, {. 'url': 'http://www.cda.pl/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-K8IKR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	4.799789549251717
Encrypted:	false
SSDEEP:	24:1R8leR8GWKzrwJKrcTucIt/BkEucCdlheXvIUGMgHNqadfFs1ZVJvJKzlGXRUM3:PueR8AXd5cI14cCoXvKM6NqadfFkZVJp
MD5:	FFBD6450CE7075493927A3C8E6C1556D
SHA1:	410184E03307326E0C9611AA9882DD9B42374F21
SHA-256:	3D97A0C09AEA0DED60937BF5F4AA3F3BD4AFAC89EEEE7EB75658FA77FFDBAF3E
SHA-512:	359416A3CE3C1AF0B24EED43ECBAFA63BE9ED5EC103E120F8F3582559F4C1F6255629DB13517BF841E167805C24304B5C6E08D55E6746DC107A93E522D02166D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .nuevo import NuevoBaseIE...class LoveHomePornIE(NuevoBaseIE):. _VALID_URL = r'https?://(?:www\.)?lovehomeporn\.com/video/(?P<id>\d+)(?:/(?P<display_id>[^/?#&]+))?'. _TEST = {. 'url': 'http://lovehomeporn.com/video/48483/stunning-busty-brunette-girlfriend-sucking-and-riding-a-big-dick#menu',. 'info_dict': {. 'id': '48483',. 'display_id': 'stunning-busty-brunette-girlfriend-sucking-and-riding-a-big-dick',. 'ext': 'mp4',. 'title': 'Stunning busty brunette girlfriend sucking and riding a big dick',. 'age_limit': 18,. 'duration': 238.47,. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). display_id = mobj.group('display_id').. info = self._extract_nuevo(. 'http://lovehomeporn.co

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KB96J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	12523
Entropy (8bit):	4.613036269278049
Encrypted:	false
SSDEEP:	384:v5E0mODLitAejL/LT0H6NEQrh7iMy++cDy1/+QwG96lMN5jx+Lfw0u:K0mODLitAejL/LT0H8EZGawu
MD5:	52558A4490F45212D708199923CB80FF
SHA1:	BC41E0B27CA22558CECBD1BA3CE0684306112141
SHA-256:	AAC381073F2B43C3353775D4CC83E84A03ED5A9DA0C6CA56DD7CC9F2324589A3
SHA-512:	77B1EE9A1889EE5447A591519F75E9C3B99DBC84A76DB0485BF09D8C40EC4C543547365311E6F1E469DB6960D53591A755CEC877CE81F0027978C97BBC9F88BD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. determine_ext,. ExtractorError,. js_to_json,. strip_jsonp,. try_get,. unified_strdate,. update_url_query,. urlhandle_detect_ext,.)...class WDRIE(InfoExtractor):. _VALID_URL = r'https?://deviceids-medp\.wdr\.de/ondemand/\d+/(?P<id>\d+)\.js'. _GEO_COUNTRIES = ['DE']. _TEST = {. 'url': 'http://deviceids-medp.wdr.de/ondemand/155/1557833.js',. 'info_dict': {. 'id': 'mdb-1557833',. 'ext': 'mp4',. 'title': 'Biathlon-Staffel verpasst Podest bei Olympia-Generalprobe',. 'upload_date': '20180112',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. metadata = self._download_json(. url, video_id, transform_source=strip_jsonp).. is_live = metadata.get('mediaTyp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KFN17.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3127
Entropy (8bit):	4.404613425360773
Encrypted:	false
SSDEEP:	96:4Ogoi3aX+ndt45dhac3zB4YZnBT6O9TJ6Nl:0oL5d13zB4YZBTRn6Nl
MD5:	46D8E96FBA25A14DF6D41009454AC824
SHA1:	3EC2E93C583B45F80360EEBAF13A05470153FF3F
SHA-256:	A69E1FD057E0F0DDA6199F49722CD07377168A9EB9FF63CEFC5D68AD229388AA
SHA-512:	F4B2FEF52BA7809A769BCB4A2553A13DC4F93CA07843DB19C6A543029E4AA3434DBEBB8520248ACDE10FC2BF204E0A57B6C2BE62FF3322EF1DDF6A71283CD0AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. urljoin,.)...class ShowRoomLiveIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?showroom-live\.com/(?!onlive\|timetable\|event\|campaign\|news\|ranking\|room)(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'https://www.showroom-live.com/48_Nana_Okada',. 'only_matching': True,. }.. def _real_extract(self, url):. broadcaster_id = self._match_id(url).. webpage = self._download_webpage(url, broadcaster_id).. room_id = self._search_regex(. (r'SrGlobal\.roomId\s=\s(\d+)',. r'(?:profile\|room)\?room_id\=(\d+)'), webpage, 'room_id').. room = self._download_json(. urljoin(url, '/api/room/profile?room_id=%s' % room_id),. broadcaster_id).. is_live = room.get('is_onlive'). if is_live is not True:. raise

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KGDID.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5126
Entropy (8bit):	4.603755418410511
Encrypted:	false
SSDEEP:	96:eAZGxoCEDA6+sU/nH9n1Kmv92MfzEGRXUK9LYBTeUoYK5etz8V6NiAL4kmryf3PT:7B+F/9ndv926zEGRXUK9LYT0hhV6NI0z
MD5:	5A9E79E31BCD3565D1F4D7327A6A8782
SHA1:	4DEA32A7DFD272383446CD357FE070353A42C492
SHA-256:	D89655F76EE2FBE2E8D710EEE1831C93519C5D68E5E3B1E2BE2292F2B13F0810
SHA-512:	C31862A06BD0662DB58CEBE3219143DAF2EC31B40D41AC4AC446F8365D59564DD1F9728342EAA50A9E9C2D1990A8572A0B23AEE9146D6D06109C0922035D90AC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from ..compat import compat_urlparse.from .common import InfoExtractor.from ..utils import parse_duration...class JamendoBaseIE(InfoExtractor):. def _extract_meta(self, webpage, fatal=True):. title = self._og_search_title(. webpage, default=None) or self._search_regex(. r'<title>([^<]+)', webpage,. 'title', default=None). if title:. title = self._search_regex(. r'(.+?)\s\\|\sJamendo Music', title, 'title', default=None). if not title:. title = self._html_search_meta(. 'name', webpage, 'title', fatal=fatal). mobj = re.search(r'(.+) - (.+)', title or ''). artist, second = mobj.groups() if mobj else [None] * 2. return title, artist, second...class JamendoIE(JamendoBaseIE):. _VALID_URL = r'''(?x). https?://. (?:. licensing\

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KI0CN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6878
Entropy (8bit):	4.908855664852231
Encrypted:	false
SSDEEP:	192:uSCRCLQC/VPyEuXbsNPhISU0lYjHLnn07dJGtJt6NoB:uSg/a9XuYNPhISjlen07dJCt6N2
MD5:	C32B833C97989ED4E18D0E0B446C0F90
SHA1:	28782F7FD887B6F783EA543B3DC20FF3972C8251
SHA-256:	00FEFD9B0FBDA046ED34E4EACC6769BF4E7B564F1335B88720624FF4FC8E269A
SHA-512:	4D2B227F412C7249AD3B629BEFAEBE3CC7AE242970A834CDDCEB302BD3760F0ABDAD904C65F30AE75000C3F2922A58821315804D57EDCE278D7D763343A7DF18
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import time.import hashlib.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. unescapeHTML,. unified_strdate,. urljoin,.)...class DouyuTVIE(InfoExtractor):. IE_DESC = '..'. _VALID_URL = r'https?://(?:www\.)?douyu(?:tv)?\.com/(?:[^/]+/)(?P<id>[A-Za-z0-9]+)'. _TESTS = [{. 'url': 'http://www.douyutv.com/iseven',. 'info_dict': {. 'id': '17732',. 'display_id': 'iseven',. 'ext': 'flv',. 'title': 're:^............ [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': r're:.m7show@163\.com.',. 'thumbnail': r're:^https?://.\.jpg$',. 'uploader': '7..',. 'is_live': True,. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'http://www.douyutv.com/85982',. 'info_dict': {. 'id':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KLKGR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4414
Entropy (8bit):	4.676814754004661
Encrypted:	false
SSDEEP:	96:z0W/gUJFqXd0PFff0hO8hxPcyYYiU56QnnpS70LVLcqD3EiMsGxBTSqYOyVRiWy+:zpoUbzff0Jx25U9pBLVLcy3EiD8TgEOL
MD5:	8FA4B9D49C77065CA7C6C13F0FF31110
SHA1:	C86752090BC71CB96B8150AE13448CDEE6520991
SHA-256:	F10F0BD86CDB497DF587A2FE68DC91A4AEB591B601CCF75CC51F3CBB940A789D
SHA-512:	81B11D83D120985B78A5217A85E90548ABE89EB1C1FB69636D9C299713F645E305CA26E207CC28C01FA92FCF0BE3CE886BE30036F215793AE1F15B9BD214A6F2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_age_limit,. parse_iso8601,. update_url_query,.)...class IndavideoEmbedIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:embed\.)?indavideo\.hu/player/video/\|assets\.indavideo\.hu/swf/player\.swf\?.\b(?:v(?:ID\|id))=)(?P<id>[\da-f]+)'. _TESTS = [{. 'url': 'http://indavideo.hu/player/video/1bdc3c6d80/',. 'md5': 'c8a507a1c7410685f83a06eaeeaafeab',. 'info_dict': {. 'id': '1837039',. 'ext': 'mp4',. 'title': 'Cicat.nc',. 'description': '',. 'thumbnail': r're:^https?://.\.jpg$',. 'uploader': 'cukiajanlo',. 'uploader_id': '83729',. 'timestamp': 1439193826,. 'upload_date': '20150810',. 'duration': 72,. 'age_limit': 0,. 'tags': ['t.nc', 'cica', 'cuki'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KLKTJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2085
Entropy (8bit):	4.840849853168899
Encrypted:	false
SSDEEP:	48:Puu/uminogVCOXHadfFklkQXqXuXfCXlINeX0/VaPVcIK/H7DaAtZ918cU:FubnojKHat9i3Nh/aK/7D1tZ918V
MD5:	8B1389957E804772F42065A763A60038
SHA1:	4EB120C160B6139905BC184B27ACB5A9960B85E7
SHA-256:	E0542DAA6CEEAD1F91B1A26996712E61419BF810250581F72B7AB88576F3FA2F
SHA-512:	7868738309C5B618C5E00EB5009589B9EC0261C9D510249B9DF59DFB21211713243206904F54E4DC0374E38EA9B1A1CA351FAC0EE74B2EF78DB660BA44BB237B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_duration,. int_or_none,.)...class AnySexIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?anysex\.com/(?P<id>\d+)'. _TEST = {. 'url': 'http://anysex.com/156592/',. 'md5': '023e9fbb7f7987f5529a394c34ad3d3d',. 'info_dict': {. 'id': '156592',. 'ext': 'mp4',. 'title': 'Busty and sexy blondie in her bikini strips for you',. 'description': 'md5:de9e418178e2931c10b62966474e1383',. 'categories': ['Erotic'],. 'duration': 270,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id').. webpage = self._download_webpage(url, video_id).. video_url = self._html_search_regex(r"video_url\s:\s'([^']+)'", webpage, 'video URL').. title = self._html_search_regex(r'<t

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KLL0H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1882
Entropy (8bit):	4.696264577759261
Encrypted:	false
SSDEEP:	48:Pu+YB5YgDxNDNQiL1wetfJoXhhZuXH0g7oI1:L05YgDxNNQMwcfJa60GD1
MD5:	F0B00CE1F90F7D21A0DF056FBEE311DC
SHA1:	90C55A54CCB39AAE11F13745F572251FAEAEDE84
SHA-256:	0C254B0687B1D1E83B9BE44F07AE550ECFE472C148CABEB24DC4D70A65192E57
SHA-512:	2335309CD2B203AAC01B2AF4D7344A5D1B36914C66366869F17B8F10155DD75B2C154A9B930967BE13BDD25A2F60ADC30F3BBE4D5413E2C3210ECDF55541DDA5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import js_to_json...class DiggIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?digg\.com/video/(?P<id>[^/?#&]+)'. _TESTS = [{. # JWPlatform via provider. 'url': 'http://digg.com/video/sci-fi-short-jonah-daniel-kaluuya-get-out',. 'info_dict': {. 'id': 'LcqvmS0b',. 'ext': 'mp4',. 'title': "'Get Out' Star Daniel Kaluuya Goes On 'Moby Dick'-Like Journey In Sci-Fi Short 'Jonah'",. 'description': 'md5:541bb847648b6ee3d6514bc84b82efda',. 'upload_date': '20180109',. 'timestamp': 1515530551,. },. 'params': {. 'skip_download': True,. },. }, {. # Youtube via provider. 'url': 'http://digg.com/video/dog-boat-seal-play',. 'only_matching': True,. }, {. # vimeo as regular embed. 'url': 'http://digg.com/video/dream-girl-short-film',. 'only_m

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KRI1D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6462
Entropy (8bit):	4.738448582137642
Encrypted:	false
SSDEEP:	192:77nM0LKduWiMSr5dQevTNp6Nge7CaXbGbJDXYdZdmobYT26Ngu:NLB5dQevT76N/CaXbGbJzGdmsYT26NJ
MD5:	01B7EF8738119AC0FF316BCCCA4F415A
SHA1:	43EEA1B8A79758896DA225B00331506CA474199C
SHA-256:	29ED10E746CFAB1B851A2D03C823581546DA7E96C90836EFF7EBB35DC1076576
SHA-512:	9B476577A26C6C21F2D811C60739B2396B33ADEEE8C937367F1DE4C433DEDCA1CB589FBCABF6ACAD702D0367A6364C8818EDB4DDCF96E5EA165D6D408661A029
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. clean_html,. compat_str,. float_or_none,. int_or_none,. parse_iso8601,. try_get,. urljoin,.)...class BeamProBaseIE(InfoExtractor):. _API_BASE = 'https://mixer.com/api/v1'. _RATINGS = {'family': 0, 'teen': 13, '18+': 18}.. def _extract_channel_info(self, chan):. user_id = chan.get('userId') or try_get(chan, lambda x: x['user']['id']). return {. 'uploader': chan.get('token') or try_get(. chan, lambda x: x['user']['username'], compat_str),. 'uploader_id': compat_str(user_id) if user_id else None,. 'age_limit': self._RATINGS.get(chan.get('audience')),. }...class BeamProLiveIE(BeamProBaseIE):. IE_NAME = 'Mixer:live'. _VALID_URL = r'https?://(?:\w+\.)?(?:beam\.pro\|mixer\.com)/(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'http://mixer.com/niterhayven',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-KUQFU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5015
Entropy (8bit):	4.503825134221013
Encrypted:	false
SSDEEP:	96:v6IXhNlALTX+buhEWdoRX+2a+5A2lX+iPzqplX+kl5Pie5EQxC2wfEfAuwrd5ki:i0gCb/W52N5UAmywPv5zxC2wfEflAjki
MD5:	F0ADCEDC89ACCCCE64D59E7420DBFB1B
SHA1:	551C7120A40B413DAA43CD59C9FE8B2DE9668D34
SHA-256:	ACACFC2BF9C3EF3FD9EFF11D7BBEB15678FD757FCA363739BD5C2DD6F908BE33
SHA-512:	90E993F8A77954CB36BEDAE1461286B5733ED31A633D48257EA1384DA4EDD625BBEB83C3BC51F7F1604A85DC31E75A7170B943E5B3C27C0E55121A9076BB10DA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .nhl import NHLBaseIE...class MLBIE(NHLBaseIE):. _VALID_URL = r'''(?x). https?://. (?:[\da-z_-]+\.)(?P<site>mlb)\.com/. (?:. (?:. (?:[^/]+/)c-\|. (?:. shared/video/embed/(?:embed\|m-internal-embed)\.html\|. (?:[^/]+/)+(?:play\|index)\.jsp\|. )\?.*?\bcontent_id=. ). (?P<id>\d+). ). '''. _CONTENT_DOMAIN = 'content.mlb.com'. _TESTS = [. {. 'url': 'https://www.mlb.com/mariners/video/ackleys-spectacular-catch/c-34698933',. 'md5': '632358dacfceec06bad823b83d21df2d',. 'info_dict': {. 'id': '34698933',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-L086B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4493
Entropy (8bit):	4.577672862929251
Encrypted:	false
SSDEEP:	96:RqgLoa1lk3nXVCLdlXKOynXIo+Ex9gou9YhrBT6b6NGIfGa1roitJL7ce:0koaXk3XVC5lXjyXIG9xu9YhdTQ6NGSz
MD5:	FD1D69E7BC1D1AFE243AAB5F84B77F85
SHA1:	DC7625D7D14D8BACD26AA4F02B18A91D1A30D925
SHA-256:	118AE5AE56F5B06AC111887C0AF2F424593E15477409989441A7AE9C3FFD2AFB
SHA-512:	6B2266052EFC4C93BC1588DD8E3AFBC424F082647336E3D739D238D7E85907CF591B6504B2B38E3CE9FFAC199C212F0161938CD019C303C23EAA8E63F17CBC20
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor..import json.import random.import re..from ..compat import (. compat_parse_qs,. compat_str,.).from ..utils import (. js_to_json,. strip_jsonp,. urlencode_postdata,.)...class WeiboIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?weibo\.com/[0-9]+/(?P<id>[a-zA-Z0-9]+)'. _TEST = {. 'url': 'https://weibo.com/6275294458/Fp6RGfbff?type=comment',. 'info_dict': {. 'id': 'Fp6RGfbff',. 'ext': 'mp4',. 'title': 'You should have servants to massage you,... ..Hosico_. - ..',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). # to get Referer url for genvisitor. webpage, urlh = self._download_webpage_handle(url, video_id).. visitor_url = urlh.geturl().. if 'passport.weibo.com' in visitor_url:. # first visit. visitor_data = self._download_jso

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-L0E6J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5004
Entropy (8bit):	4.708413876050088
Encrypted:	false
SSDEEP:	96:EOqVGND5ZbjdNMLQMzdLd8BTeFsCrtWwVxEYhNWF6N4309o7FEGCKpCNjLy2LUoy:RqeNjdNMLQMzxdUTqvZM6NI0+7fCKwNU
MD5:	AC640614F92F426A3B6D06E0A5CE4BC5
SHA1:	597F56BA41AD46DF220442F3E6CF57EC20773C51
SHA-256:	623E37D28E6A66150AAF32340DA1E8D7548B0D2DC3C60100B43E16F500D8B588
SHA-512:	7D71548A0CDCD4BFD8386DDEF7297326CE7929F456582B9DA9A40030FCE342C12AF63AE6A7D5CDB1FAA32EA8E84D4AC612B0D7C693D45357EE2E9CD3AE9AA170
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. int_or_none,. parse_iso8601,. parse_duration,.)...class NHLBaseIE(InfoExtractor):. def _real_extract(self, url):. site, tmp_id = re.match(self._VALID_URL, url).groups(). video_data = self._download_json(. 'https://%s/%s/%sid/v1/%s/details/web-v1.json'. % (self._CONTENT_DOMAIN, site[:3], 'item/' if site == 'mlb' else '', tmp_id), tmp_id). if video_data.get('type') != 'video':. video_data = video_data['media']. video = video_data.get('video'). if video:. video_data = video. else:. videos = video_data.get('videos'). if videos:. video_data = videos[0].. video_id = compat_str(video_data['id']). title = video_data['title'].. formats = []. for play

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-L15PN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	14570
Entropy (8bit):	4.681179037375776
Encrypted:	false
SSDEEP:	384:HKjP/8RWBXKOE1N37hWFnYwTw4GTivM1nSwKb0JNFdGosETJ6NaKR18G:t1nyMEb0JNFdGosETJ8aKR1x
MD5:	C68CA08A6A867C3B9984B445550A72C9
SHA1:	72273016463EC65FAE618DF8D457F301EA157EC1
SHA-256:	42AABBCC468786991CA63881601AF9857A818B99AE011B91F2AA972373551D81
SHA-512:	5636ED388653D428FD860F152CC646C8B05C2CF656F383572AF223B15FACADD9DBA25C84CF23634491A7F0A8DE0B5BC612DA5E00FBF5C0C8F347A24C7CDB0298
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_xpath.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. url_or_none,. urlencode_postdata,. xpath_text,.)...class AfreecaTVIE(InfoExtractor):. IE_NAME = 'afreecatv'. IE_DESC = 'afreecatv.com'. _VALID_URL = r'''(?x). https?://. (?:. (?:(?:live\|afbbs\|www)\.)?afreeca(?:tv)?\.com(?::\d+)?. (?:. /app/(?:index\|read_ucc_bbs)\.cgi\|. /player/[Pp]layer\.(?:swf\|html). )\?.*?\bnTitleNo=\|. vod\.afreecatv\.com/PLAYER/STATION/. ). (?P<id>\d+). '''. _NETRC_MACHINE = 'afreecatv'. _TESTS = [{. 'url': 'http://live.afreecatv.com:8079/app/index.cgi?

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-L26QE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	4.9059531528285625
Encrypted:	false
SSDEEP:	24:zi8lFvS2sKghw7dp3/EdlGwsQCfckJmg8aeIXjlgtyVuXn9zE/jaoxNlDDc3HDcA:+uTsKghOfEywsXU8mdajXjlkauX5uj7q
MD5:	D66E0C3CF6B022185F7F830E579F9411
SHA1:	2EEB16ED55A043D5E6756C4B05BE7DC2D0EFE077
SHA-256:	AC827CB6B349032F9D51DBC08D3CAB1DE76490F032FE6F1F61441B2A0DD3D3A1
SHA-512:	10E29CD35E496DAF9DC2B63FCE9863AB1489FB4DB36A66DCDE18C1357C7DB5EB391E3AFDCE3B2532FCB9D7B5428B7B1C2A4BBBDCB7B5E24D6CD498CC3F4FB0B3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import js_to_json...class ScreencastOMaticIE(InfoExtractor):. _VALID_URL = r'https?://screencast-o-matic\.com/watch/(?P<id>[0-9a-zA-Z]+)'. _TEST = {. 'url': 'http://screencast-o-matic.com/watch/c2lD3BeOPl',. 'md5': '483583cb80d92588f15ccbedd90f0c18',. 'info_dict': {. 'id': 'c2lD3BeOPl',. 'ext': 'mp4',. 'title': 'Welcome to 3-4 Philosophy @ DECV!',. 'thumbnail': r're:^https?://.\.jpg$',. 'description': 'as the title says! also: some general info re 1) VCE philosophy and 2) distance learning.',. 'duration': 369.163,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. jwplayer_data = self._parse_json(. self._search_regex(. r"(?s)jwplayer$'mp4Player'$.setup\((\{.?\}

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-L35EI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3509
Entropy (8bit):	4.588634332458504
Encrypted:	false
SSDEEP:	96:ZU67d3+r/InP5AIz/RX3m8c3Qntk6iuhBTfeNlmadt/8Z6Ng:F71+OP2Ip3vtauvTnZ6Ng
MD5:	5377A6CA5950C815DFA3D497ADA9C530
SHA1:	B96393E37CB9042581895E15D27A3B8F34365D87
SHA-256:	3B9300C66059C009E1092129787001937C9527B1FFDD9DF103DD85EB4C2E3878
SHA-512:	756797ED5368BDFD290C699CB0619CE67CA3705A547A8733DB92271CC8B9702E2C666A3351176FFF2AFB9E8C71C2A04FE7ECCE5F0774E219D33A825E72EC4F5C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class DigitekaIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://(?:www\.)?(?:digiteka\.net\|ultimedia\.com)/. (?:. deliver/. (?P<embed_type>. generic\|. musique. ). (?:/[^/]+)*/. (?:. src\|. article. )\|. default/index/video. (?P<site_type>. generic\|. music. ). /id. )/(?P<id>[\d+a-z]+)'''. _TESTS = [{. # news. 'url': 'https://www.ultimedia.com/default/index/videogeneric/id/s8uk0r',. 'md5': '276a0e49de58c7e85d32b057837952a2',. 'info_dict': {. 'id': 's8uk0r',. 'ext': 'mp4',. 'title': 'Loi sur la fin de vie: le texte pr.voit un renforcement des directives anticip.es',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-L7OO9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3138
Entropy (8bit):	4.726226695300948
Encrypted:	false
SSDEEP:	96:xQE/Nn+Eal8vj8cycqUlCzeKGSgHXiXsLBT/I6Ng:RF+Es8vNq4UGScyXiTA6Ng
MD5:	AE08FB971474CAAABC63ED8AAAF241AD
SHA1:	2937ACCE5B5E853796325A4A36A6C0D4665EAF9A
SHA-256:	9093C414EB826518C0D8715F2110D40F10D6E4AF01AB5E5BFE442889A460AE38
SHA-512:	FBB9A1ADED465FF9407E326AEFEC996B9D5A49D92B504A715D3D08EE1E101EC1E2AF2B5EF61A3A04FF7816E1E2BCD3351D92935E8586411F4494570E6C30E837
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. determine_protocol,. try_get,. unescapeHTML,.)...class DailyMailIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?dailymail\.co\.uk/(?:video/[^/]+/video-\|embed/video/)(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.dailymail.co.uk/video/tvshowbiz/video-1295863/The-Mountain-appears-sparkling-water-ad-Heavy-Bubbles.html',. 'md5': 'f6129624562251f628296c3a9ffde124',. 'info_dict': {. 'id': '1295863',. 'ext': 'mp4',. 'title': 'The Mountain appears in sparkling water ad for \'Heavy Bubbles\'',. 'description': 'md5:a93d74b6da172dd5dc4d973e0b766a84',. }. }, {. 'url': 'http://www.dailymail.co.uk/embed/video/1295863.html',. 'only_matching': True,. }].. @staticmethod. def _extract_urls(webpage):. return

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-L7TTG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4047
Entropy (8bit):	4.7959679052340585
Encrypted:	false
SSDEEP:	96:JO8j23rDVUqcv8Z3ZmHDbh9Wxy/mkKsm0K3UoOhavOaYQDbV5cU:Q8j233ZJmjbhVIs480bVmU
MD5:	317392B1A70BF1C2D1E1600FB9E4570C
SHA1:	FCC120F73E6CE9C12BAA85F502C09B9D528A3DB5
SHA-256:	C0883F33E7B69959DD46552E92C811117F7BD8C5E86314E4306C80B25B23B3E4
SHA-512:	B00A8CC69A2AA4E9950E28085B5B5BD5A4AEBFB01E5D05CB36116F1D927335FAFAC5BF56985348BAC8FEEBBD48CDB725968974F829D762F9971F7A996B0AE924
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_b64decode.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. KNOWN_EXTENSIONS,. parse_filesize,. url_or_none,. urlencode_postdata,.)...class SharedBaseIE(InfoExtractor):. def _real_extract(self, url):. video_id = self._match_id(url).. webpage, urlh = self._download_webpage_handle(url, video_id).. if self._FILE_NOT_FOUND in webpage:. raise ExtractorError(. 'Video %s does not exist' % video_id, expected=True).. video_url = self._extract_video_url(webpage, video_id, url).. title = self._extract_title(webpage). filesize = int_or_none(self._extract_filesize(webpage)).. return {. 'id': video_id,. 'url': video_url,. 'ext': 'mp4',. 'filesize': filesize,. 'title': title,. }.. def _extract_title(self, webpage):.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LAMIV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2800
Entropy (8bit):	4.909048621952197
Encrypted:	false
SSDEEP:	48:+ug/QY7V4fVXcc3vXccl00v141vv3tfJoXhhIwW5z6gvVE5XBfymuVyPVKx9yAtj:cQYJaVMuvMEjd41vv9fJam1fu5Ry5VEm
MD5:	16B5F3BB9F3F32708B8FC936E2DB86D3
SHA1:	58E79FB65482EEFA6FC8F83AAB6CED004D50FE95
SHA-256:	9473EDB5768873EF0DA7A0A3E7633C734B5FA2F3788B279DD4A29B3E803879CC
SHA-512:	0087BD2653205F0A8EFD6ACD0E78F8EBFEC8264D3516CE382D624BBDC07BE3EB0BA771017DEE0CDC1DBE446BD5AB77A25E2A024B60AD1D04311F1D653A7586BC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_duration,. parse_iso8601,. js_to_json,.).from ..compat import compat_str...class RDSIE(InfoExtractor):. IE_DESC = 'RDS.ca'. _VALID_URL = r'https?://(?:www\.)?rds\.ca/vid(?:[e.]\|%C3%A9)os/(?:[^/]+/)*(?P<id>[^/]+)-\d+\.\d+'.. _TESTS = [{. 'url': 'http://www.rds.ca/videos/football/nfl/fowler-jr-prend-la-direction-de-jacksonville-3.1132799',. 'info_dict': {. 'id': '604333',. 'display_id': 'fowler-jr-prend-la-direction-de-jacksonville',. 'ext': 'flv',. 'title': 'Fowler Jr. prend la direction de Jacksonville',. 'description': 'Dante Fowler Jr. est le troisi.me choix du rep.chage 2015 de la NFL. ',. 'timestamp': 1430397346,. 'upload_date': '20150430',. 'duration': 154.354,. 'age_limit': 0,. }. }, {. 'url': 'http://www.rds.ca/v

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LD4B0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4942
Entropy (8bit):	4.720323793449986
Encrypted:	false
SSDEEP:	96:6Eo6nvs4AP2/Fb4lpdGVRsxFb4wDpwB46kWTn6a6kopMfa6sr6iJQJOs+7BTjdH1:Po6vqjpdGHSpA4gT6aOp6azr6iYOs+tb
MD5:	B16172F79B66D583CD7ADD3A4EE6F5FC
SHA1:	86F9719B66AF1A2E43D00DD56AA95FC7F87A9C58
SHA-256:	6202A7081294493AE7F8F15109BF55A1D16B9E1EA2FA4C643AEE77BDEA627508
SHA-512:	0092DDB2E0E9CA9B1EA07031E0E00C0F567D54E2586C64BE0990EACA5D6E65E1CF0B452F904C62CA54465819C4D56B3F2DE3C27B9283A86A3652001F2FF4A69B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. unescapeHTML,. url_or_none,.)...class TVNetIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+)\.tvnet\.gov\.vn/[^/]+/(?:\d+/)?(?P<id>\d+)(?:/\|$)'. _TESTS = [{. # video. 'url': 'http://de.tvnet.gov.vn/video/109788/vtv1---bac-tuyet-tai-lao-cai-va-ha-giang/tin-nong-24h',. 'md5': 'b4d7abe0252c9b47774760b7519c7558',. 'info_dict': {. 'id': '109788',. 'ext': 'mp4',. 'title': 'VTV1 - B.c tuy.t t.i L.o Cai v. H. Giang',. 'thumbnail': r're:(?i)https?://.*\.(?:jpg\|png)',. 'is_live': False,. 'view_count': int,. },. }, {. # audio. 'url': 'http://vn.tvnet.gov.vn/radio/27017/vov1---ban-tin-chieu-10062018/doi-song-va-xa-hoi',. 'md5': 'b5875ce9b0a2eecde029216d0e6db2ae',. 'info_dict': {. 'id': '27017'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LDPKR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	4.492749924054443
Encrypted:	false
SSDEEP:	48:PuZWOf5roSHarvwajXjMBdaO2HtZaDkkbdksTxBTKxFNNty6Ng:LO9ZHarvwaTGDkYdkMBTKxFNNty6Ng
MD5:	C9B75D9331953E2D31B33AF2817852DA
SHA1:	EF8EADF0323879944EC05E20F576211BE935EE30
SHA-256:	BE00EB95354E33680386ACF3DA5809337D4C2D4DD5CEC58E2DB43275D26A7D4D
SHA-512:	9C2906582A2E3AF293CB93C7ADB25F237110FD0CC6A1231EFCEF33F248096B97A290880D87DF9C95BD25FCDAEA5377ADBB5BDF71DA2D384C5FB990F7D8716BBA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. determine_ext,. mimetype2ext,.)...class TweakersIE(InfoExtractor):. _VALID_URL = r'https?://tweakers\.net/video/(?P<id>\d+)'. _TEST = {. 'url': 'https://tweakers.net/video/9926/new-nintendo-3ds-xl-op-alle-fronten-beter.html',. 'md5': 'fe73e417c093a788e0160c4025f88b15',. 'info_dict': {. 'id': '9926',. 'ext': 'mp4',. 'title': 'New Nintendo 3DS XL - Op alle fronten beter',. 'description': 'md5:3789b21fed9c0219e9bcaacd43fab280',. 'thumbnail': r're:^https?://.*\.jpe?g$',. 'duration': 386,. 'uploader_id': 's7JeEm',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). video_data = self._download_json(. 'https://tweakers.net/video/s1playlist/%s/1920/1080/playlist.json' % video_id,. video_id)['items'][0]..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LEKMB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3748
Entropy (8bit):	4.545680666793904
Encrypted:	false
SSDEEP:	96:5pClTvnXy2wfZE082R6qQxj8bu0Wn2ZY/BTufrKRtu8C6NM:SRqQhdMu0Wn2ZYJT3C6NM
MD5:	48684129DB579159AAEE80BF8123F164
SHA1:	9D425B24346B79964ECD029CF1DCC27B83C1D6A2
SHA-256:	AE5289F326627144F6BE4BA4F688602D332495BCBF88246297D9BCBBC4AD5D53
SHA-512:	CFFCBCDE00AA7ED69535AA861B4F13D6F273FCC8547DE322B51496738700E38CD79F3FEE2577C35ED10347D2CD31ED4415557AC7B6C7074F9C0B6BF20F220067
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals....import re....from .common import InfoExtractor..from ..compat import compat_str..from ..utils import (.. int_or_none,.. js_to_json,.. try_get,..)......class JojIE(InfoExtractor):.. _VALID_URL = r'''(?x).. (?:.. joj:\|.. https?://media\.joj\.sk/embed/.. ).. (?P<id>[^/?#^]+).. '''.. _TESTS = [{.. 'url': 'https://media.joj.sk/embed/a388ec4c-6019-4a4a-9312-b1bee194e932',.. 'info_dict': {.. 'id': 'a388ec4c-6019-4a4a-9312-b1bee194e932',.. 'ext': 'mp4',.. 'title': 'NOV. B.VANIE',.. 'thumbnail': r're:^https?://.*\.jpg$',.. 'duration': 3118,.. }.. }, {.. 'url': 'https://media.joj.sk/embed/9i1cxv',.. 'only_matching': True,.. }, {.. 'url': 'joj:a388ec4c-6019-4a4a-9312-b1bee194e932',.. 'only_matchin

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LFUFH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3495
Entropy (8bit):	4.712092028453331
Encrypted:	false
SSDEEP:	96:uQRp1eR/5EcrIeadtq7fqUBoCy21v6DLFE6v2MBTeIq6NB3WNW8q:uQleXjIHds7qCyWvIBTv2kTe6NBWq
MD5:	12CA58C6BE900D5E1575E8548FB2216D
SHA1:	0274C47B63000B209DE9AB3CDE174BCDB427FCE1
SHA-256:	32404DF5B56990725D6166FAB869D2FC47B374D25F017A476A7E9224D1B88156
SHA-512:	E0A680D650258EABF27BBFBC36B996DEEAC318729397B9FCEFFEC8F818C38DD9D02848033D5DF443801840912638E175FDD317FD9D9F536A1B9E5337AE387B27
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .vk import VKIE.from ..utils import (. HEADRequest,. int_or_none,.)...class BIQLEIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?biqle\.(?:com\|org\|ru)/watch/(?P<id>-?\d+_\d+)'. _TESTS = [{. # Youtube embed. 'url': 'https://biqle.ru/watch/-115995369_456239081',. 'md5': '97af5a06ee4c29bbf9c001bdb1cf5c06',. 'info_dict': {. 'id': '8v4f-avW-VI',. 'ext': 'mp4',. 'title': "PASSE-PARTOUT - L'ete c'est fait pour jouer",. 'description': 'Passe-Partout',. 'uploader_id': 'mrsimpsonstef3',. 'uploader': 'Phanolito',. 'upload_date': '20120822',. },. }, {. 'url': 'http://biqle.org/watch/-44781847_168547604',. 'md5': '7f24e72af1db0edf7c1aaba513174f97',. 'info_dict': {. 'id': '-44781847_168547604',. 'ext': 'mp4',. 'title': '.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LIA0O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1820
Entropy (8bit):	4.7185703392710385
Encrypted:	false
SSDEEP:	48:PugtUPci2qJOXNqa7Xjl42sBKEkR8Uq7C8ErureOErbrNrjaf7SXrs9IBTSAt0+L:jtUP3Osaf+kR8U38Ei6OEHBf07crs9Ij
MD5:	22C6C79F82E5CB23B7635432FD98ACC0
SHA1:	0158FEBCD203C974BBCBEE5CEE5E5D9B1D1F70DA
SHA-256:	5344542AE4409AD456AF763384268C9FA7136668DFEE4E5B00541E307580302B
SHA-512:	952D06F2B4C094C158C7C759F607F6A2AB8965F5110882C81868722DD6218068D9355E74787808CA203256EBC931F31B1E5292399CD907E3E0AFFD89AEC8D0D9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class RadioDeIE(InfoExtractor):. IE_NAME = 'radio.de'. _VALID_URL = r'https?://(?P<id>.+?)\.(?:radio\.(?:de\|at\|fr\|pt\|es\|pl\|it)\|rad\.io)'. _TEST = {. 'url': 'http://ndr2.radio.de/',. 'info_dict': {. 'id': 'ndr2',. 'ext': 'mp3',. 'title': 're:^NDR 2 [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': 'md5:591c49c702db1a33751625ebfb67f273',. 'thumbnail': r're:^https?://.\.png',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. radio_id = self._match_id(url). webpage = self._download_webpage(url, radio_id). jscode = self._search_regex(. r"'components/station/stationService':\s\{\s'?station'?:\s(\{.?\s\}),\n",. webpage, 'broadcast').. broadcast = self._parse_json(jscode, radio

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LJNNN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2480
Entropy (8bit):	4.7631702765358055
Encrypted:	false
SSDEEP:	48:+uh79JBc0hL7EpBvNZXgajXmzqyBcaFp537BAS/aFJzhQY0KBsuaPjqt46Ng:djlupBvNZXgaKBcouS8zhQdKBsuejqtE
MD5:	6B6183D0951EA29E404317F6F8B6E15E
SHA1:	67E61EE3711E25916F07E8740D194B957E9AE594
SHA-256:	573832E55C338234C76FAE1C4FF8C0293121E75FA53B3CDA1B88FC25F6E82389
SHA-512:	0976198A3D2F188DF849F1E9B7642E7DE26767CC907741051F437990A2E88C47D46601897F35AABDEBD423F213E03AFEA2A3402F00408E3DD91874597B2CE484
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. sanitized_Request,. urlencode_postdata,. xpath_text,. xpath_with_ns,.).._x = lambda p: xpath_with_ns(p, {'xspf': 'http://xspf.org/ns/0/'})...class NosVideoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nosvideo\.com/' + \. r'(?:embed/\|\?v=)(?P<id>[A-Za-z0-9]{12})/?'. _PLAYLIST_URL = 'http://nosvideo.com/xml/{xml_id:s}.xml'. _FILE_DELETED_REGEX = r'<b>File Not Found</b>'. _TEST = {. 'url': 'http://nosvideo.com/?v=mu8fle7g7rpq',. 'md5': '6124ed47130d8be3eacae635b071e6b6',. 'info_dict': {. 'id': 'mu8fle7g7rpq',. 'ext': 'mp4',. 'title': 'big_buck_bunny_480p_surround-fix.avi.mp4',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. fields = {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LKOR9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1341
Entropy (8bit):	4.9324501516487045
Encrypted:	false
SSDEEP:	24:zi8lzvBnEAdr7HVtu/r/kPaKvFFdlNtFhl6eIXjlgt06Y4t+GyumI0h:+udEOr7GrkPa8Fn56jXjlk06n/yumbh
MD5:	FFF16101B7A4BF58FAF2186324FB4470
SHA1:	F35D2AA708FC9835C1576BB1877D186138ABCBCC
SHA-256:	331F79ECC56B510E7A52CA1DE48E65E6EE73197B3414C1A31A2AC4AD9EC00346
SHA-512:	82CE2DB3083A3864C8F1F14641DFF71D66237597E1462DC06DD62E9473AFBB0EF0D1C0E1C0EAC4A7494F228AE70375E14117E8B0914D2092FE69FFF2E9B4F01D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import extract_attributes...class BFIPlayerIE(InfoExtractor):. IE_NAME = 'bfi:player'. _VALID_URL = r'https?://player\.bfi\.org\.uk/[^/]+/film/watch-(?P<id>[\w-]+)-online'. _TEST = {. 'url': 'https://player.bfi.org.uk/free/film/watch-computer-doctor-1974-online',. 'md5': 'e8783ebd8e061ec4bc6e9501ed547de8',. 'info_dict': {. 'id': 'htNnhlZjE60C9VySkQEIBtU-cNV1Xx63',. 'ext': 'mp4',. 'title': 'Computer Doctor',. 'description': 'md5:fb6c240d40c4dbe40428bdd62f78203b',. },. 'skip': 'BFI Player films cannot be played outside of the UK',. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). entries = []. for player_el in re.findall(r'(?s)<[^>]+class="player"[^>]*>', webpage):. player_attr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LM0M1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2703
Entropy (8bit):	5.012946443857223
Encrypted:	false
SSDEEP:	48:+ug0tGjz2hwpjjuLC+eO0LL0jhkEsgdFG518/+5JoXjll9tfc+c47j4cUNjp3EYl:XGmhqjjSCLhLL0tbsag1/5JFVpjp3EYl
MD5:	BD8E5D482609832829308C3E0D4FBEC0
SHA1:	29DEAB0EEACA3A7A9D611598E65F545D61C555A1
SHA-256:	FCBB4C9F91C0E727EECEF7FDCEF6AD9AFDAC66A554E2C17D5B8CB2DBFE3E1A65
SHA-512:	0430DCF9B5459BDED2110C77313F15669A1407C2A2D15114A144659589F0295016187728C05227AD1653DACE9E5EEFB2659AE668FD5511FDB1B8C7372A92C3F3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. get_element_by_attribute,. parse_duration,. try_get,. update_url_query,.).from ..compat import compat_str...class USATodayIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?usatoday\.com/(?:[^/]+/)*(?P<id>[^?/#]+)'. _TESTS = [{. # Brightcove Partner ID = 29906170001. 'url': 'http://www.usatoday.com/media/cinematic/video/81729424/us-france-warn-syrian-regime-ahead-of-new-peace-talks/',. 'md5': '033587d2529dc3411a1ab3644c3b8827',. 'info_dict': {. 'id': '4799374959001',. 'ext': 'mp4',. 'title': 'US, France warn Syrian regime ahead of new peace talks',. 'timestamp': 1457891045,. 'description': 'md5:7e50464fdf2126b0f533748d3c78d58f',. 'uploader_id': '29906170001',. 'upload_date': '20160313',. }. }, {. # ui-video-data[a

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LOHG0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	4.698536725147762
Encrypted:	false
SSDEEP:	24:1R8lzvRdG/hwqWN/53lSthGVWtr3OZXh0YXfCXVOnxAYpJB08hZQlLSX:PuvihnWVKagr3OZXh0YXfCXVQNvP/X
MD5:	BC347166E36E39871256368D76FE00A6
SHA1:	CC2DD207BF194C4A1A0D04FD03453C8F582975A2
SHA-256:	C07633C8A8A2273291CC4DBC75B007E0D7628D4B93B6CD3A050FF4D0A17C91C5
SHA-512:	5395225E3DE6BC09301F040D9A8B4AD897D98CFB89E40712021AF9E45F90DCA011968E3FE99672AFDDE4252A4C8AAF10B9F0BDF88957A9216F50110D0E38E460
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor...class AcademicEarthCourseIE(InfoExtractor):. _VALID_URL = r'^https?://(?:www\.)?academicearth\.org/playlists/(?P<id>[^?#/]+)'. IE_NAME = 'AcademicEarth:Course'. _TEST = {. 'url': 'http://academicearth.org/playlists/laws-of-nature/',. 'info_dict': {. 'id': 'laws-of-nature',. 'title': 'Laws of Nature',. 'description': 'Introduce yourself to the laws of nature with these free online college lectures from Yale, Harvard, and MIT.',. },. 'playlist_count': 3,. }.. def _real_extract(self, url):. playlist_id = self._match_id(url).. webpage = self._download_webpage(url, playlist_id). title = self._html_search_regex(. r'<h1 class="playlist-name"[^>]?>(.?)</h1>', webpage, 'title'). description = self._html_search_regex(. r'<p class="excerpt"[^>]?>(.?)</p>',. webpage, 'desc

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LOJR2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	4.705764513562361
Encrypted:	false
SSDEEP:	96:f5hUUf+mXjIhGf0Te6Ddlckwp18Wy8N8ybdVQ+BTu+j4Ys6ND8XEHQO9:RCRna0TDdlckwpyWy8LPTu+K6NYgB9
MD5:	B3B9585AF0B27E0F576A72BFBF5D3F22
SHA1:	3E7CFDC1A2E42D3CD2A2D9C0CBE379DA474EA364
SHA-256:	AA7C7E960D0218B7679C68F59325C9FFD815505EDD4AC217C2F690B519425FB4
SHA-512:	B4B82A415E175D36870D24F06B57930614C840F20FF2ACA01AE951643FAFE1F432859E942F597A5BB83914C8A5E7F7E5D7F93A175619230360228C0D15BF8516
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import js_to_json...class LineTVIE(InfoExtractor):. _VALID_URL = r'https?://tv\.line\.me/v/(?P<id>\d+)_[^/]+-(?P<segment>ep\d+-\d+)'.. _TESTS = [{. 'url': 'https://tv.line.me/v/793123_goodbye-mrblack-ep1-1/list/69246',. 'info_dict': {. 'id': '793123_ep1-1',. 'ext': 'mp4',. 'title': 'Goodbye Mr.Black \| EP.1-1',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 998.509,. 'view_count': int,. },. }, {. 'url': 'https://tv.line.me/v/2587507_%E6%B4%BE%E9%81%A3%E5%A5%B3%E9%86%ABx-ep1-02/list/185245',. 'only_matching': True,. }].. def _real_extract(self, url):. series_id, segment = re.match(self._VALID_URL, url).groups(). video_id = '%s_%s' % (series_id, segment).. webpage = self._download_webpage(url, video_id).. player_params = self._p

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LS882.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7421
Entropy (8bit):	4.376671462052683
Encrypted:	false
SSDEEP:	192:meVdw2vz5Qk2OWy0joWBTtUV6N6szT0Isgub:meVdw272Or+ocTqV6N6szIR9
MD5:	D679585B64CD5EF2E0298E34C57310B2
SHA1:	E400987416988F9BEBF535A56F5412794E6ADDF0
SHA-256:	1890D1E68AFEF55B7116F491142A3E298EC3F47C9A0611DC6EE46C2B6B077D47
SHA-512:	8454AB58B5259EE685BD78385AD84AF71D728757D69862835B626F66D6C3B879E81ACC24977B9B9AD2D0FC3299EA53121B184EB64CE6AAB387E97DBD5FBE8F51
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_str,.).from ..utils import (. clean_html,. ExtractorError,. int_or_none,. str_or_none,. try_get,. url_or_none,. urlencode_postdata,. urljoin,.)...class PlatziIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. platzi\.com/clases\| # es version. courses\.platzi\.com/classes # en version. )/[^/]+/(?P<id>\d+)-[^/?\#&]+. '''. _LOGIN_URL = 'https://platzi.com/login/'. _NETRC_MACHINE = 'platzi'.. _TESTS = [{. 'url': 'https://platzi.com/clases/1311-next-js/12074-creando-nuestra-primera-pagina/',. 'md5': '8f56448241005b561c10f11a595b37e3',. 'info_dict': {. 'id': '12074',. 'ext': 'mp4',. 'title': 'Creando nues

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-LSR2L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2923
Entropy (8bit):	4.555647426159368
Encrypted:	false
SSDEEP:	48:+uzGJuyNfI4K0JRafFqVqv4tfYWfFIYBvHFhxSAiOnY0Owu6BnR2gjsmyHB0GxLf:WJxI4K0JcfFqUvefpl2AfYwtjshh0GEw
MD5:	8D345A19D1124C82E4B3B0CA40114D67
SHA1:	DA65DD0C50FA3E85F0A5025C4B99CBA75F27C74F
SHA-256:	BE9DE0249CA302CDFDC66AEE9A75C903AE84A693738270B82081AE0835352BDB
SHA-512:	90001F2CD019BF04085D4A200FBB87353F40F0D48C8944210B2143D02F115AC0E88E4A4304777C97FC33B717F8CEED078C39B4A25171D5BF4251463831F7D062
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .brightcove import BrightcoveNewIE.from ..compat import compat_str.from ..utils import (. try_get,. update_url_query,.)...class SevenPlusIE(BrightcoveNewIE):. IE_NAME = '7plus'. _VALID_URL = r'https?://(?:www\.)?7plus\.com\.au/(?P<path>[^?]+\?.*?\bepisode-id=(?P<id>[^&#]+))'. _TESTS = [{. 'url': 'https://7plus.com.au/MTYS?episode-id=MTYS7-003',. 'info_dict': {. 'id': 'MTYS7-003',. 'ext': 'mp4',. 'title': 'S7 E3 - Wind Surf',. 'description': 'md5:29c6a69f21accda7601278f81b46483d',. 'uploader_id': '5303576322001',. 'upload_date': '20171201',. 'timestamp': 1512106377,. 'series': 'Mighty Ships',. 'season_number': 7,. 'episode_number': 3,. 'episode': 'Wind Surf',. },. 'params': {. 'format': 'bestvideo',. 'skip_download': True,. }

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-M07D6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7647
Entropy (8bit):	4.800442168494576
Encrypted:	false
SSDEEP:	192:jKIyb6k65su6YSIsvPLS/wzUvTAIvVJMaRwn5pK6qZQf1jwmbOV+0vIwTMx4Cc4O:iOkqsufSIwP2/wzITAIvVJMaRwn5p1qP
MD5:	AE88B1DAC41CCB9D6A2933A4319C9AF4
SHA1:	65479AF331DFF8407C2A8A1BAAAAA557F967F879
SHA-256:	1B3480B0FCCFE51E9BF959B2189F4C82F2B08BBD116C71BD0B0DB3064E5A1EB5
SHA-512:	3B699C16838D81CFDCCB1C3A90D8576CE6002B119DA9DAF0150955A710CA792F99DC1C6C3AA4436958279620267D8842613941AE719B81C5092A5D2BEDE4A990
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. decode_packed_codes,. determine_ext,. ExtractorError,. int_or_none,. NO_DEFAULT,. urlencode_postdata,.)...class XFileShareIE(InfoExtractor):. _SITES = (. (r'daclips\.(?:in\|com)', 'DaClips'),. (r'filehoot\.com', 'FileHoot'),. (r'gorillavid\.(?:in\|com)', 'GorillaVid'),. (r'movpod\.in', 'MovPod'),. (r'powerwatch\.pw', 'PowerWatch'),. (r'rapidvideo\.ws', 'Rapidvideo.ws'),. (r'thevideobee\.to', 'TheVideoBee'),. (r'vidto\.(?:me\|se)', 'Vidto'),. (r'streamin\.to', 'Streamin.To'),. (r'xvidstage\.com', 'XVIDSTAGE'),. (r'vidabc\.com', 'Vid ABC'),. (r'vidbom\.com', 'VidBom'),. (r'vidlo\.us', 'vidlo'),. (r'rapidvideo\.(?:cool\|org)', 'RapidVideo.TV'),. (r'fastvideo\.me', 'FastVideo.me'),. ).. IE_DESC = 'XFileShare based sites: %s' % ', '.join(list

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-M5F4Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5437
Entropy (8bit):	4.700206363328471
Encrypted:	false
SSDEEP:	96:nG4WQCqpHr2XdrESwBfbMdc9/Zb3XBljqKQljpsyyrr7qzQVfbyuFzFymWVtvEOb:G4ESJSIbMds/djqKAjUqsVbyeEmwz
MD5:	75AE165C45B87ED083ED23BCC5798174
SHA1:	CDEFE1619D795607A5DC13368B34AE26E291FBCF
SHA-256:	DCF93FEA587FD897FCFCE79146B79F243CA7CFBFAB3696141220C6EEC205224D
SHA-512:	07769119DF8ADABED33459AF74EA9AC14B7611B37A00C9807AD24B104DED1EE0F3714A8D2379872666D3B9FA9379DB11B05E06CAF9A20078AAF60D8FC9489DA2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import calendar.import re.import time..from .amp import AMPIE.from .common import InfoExtractor.from .youtube import YoutubeIE.from ..compat import compat_urlparse...class AbcNewsVideoIE(AMPIE):. IE_NAME = 'abcnews:video'. _VALID_URL = r'''(?x). https?://. (?:. abcnews\.go\.com/. (?:. [^/]+/video/(?P<display_id>[0-9a-z-]+)-\|. video/embed\?.*?\bid=. )\|. fivethirtyeight\.abcnews\.go\.com/video/embed/\d+/. ). (?P<id>\d+). '''.. _TESTS = [{. 'url': 'http://abcnews.go.com/ThisWeek/video/week-exclusive-irans-foreign-minister-zarif-20411932',. 'info_dict': {. 'id': '20411932',. 'ext': 'mp4',. 'display_id': 'we

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-M6E4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	36626
Entropy (8bit):	4.864156155725045
Encrypted:	false
SSDEEP:	768:jbF+G/imHQDTnEhO4FwC/wUMffXuknfj2Of2TIN9wVm5yTv8m:jb0GmDbEhOGT/SXbnfj2Of2TIN9wVm56
MD5:	4148F49C0CF90F62F0E704F3528A4A4F
SHA1:	F9D6DDE736D20CDFD14646E6D042CA1386852CC6
SHA-256:	CC6B126FAA35391BD38C08F6E2EDAA925CEA8019B59F5D782CD12E4DE4509B11
SHA-512:	38FC530758370F4B3E3519D3F3903DF1DBE0C1CE49BEB76466F4F08EA01238A483F6D9C085BB723C1823564AD4C118419F43F708C83335A8A69AE9D14CCD9259
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. determine_ext,. int_or_none,. float_or_none,. js_to_json,. orderedSet,. strip_jsonp,. strip_or_none,. unified_strdate,. url_or_none,. US_RATINGS,.)...class PBSIE(InfoExtractor):. _STATIONS = (. (r'(?:video\|www\|player)\.pbs\.org', 'PBS: Public Broadcasting Service'), # http://www.pbs.org/. (r'video\.aptv\.org', 'APT - Alabama Public Television (WBIQ)'), # http://aptv.org/. (r'video\.gpb\.org', 'GPB/Georgia Public Broadcasting (WGTV)'), # http://www.gpb.org/. (r'video\.mpbonline\.org', 'Mississippi Public Broadcasting (WMPN)'), # http://www.mpbonline.org. (r'video\.wnpt\.org', 'Nashville Public Television (WNPT)'), # http://www.wnpt.org. (r'video\.wfsu\.org', 'WFSU-TV (WFSU)'), # http://wfsu.org/. (r'video\.wsre\.org', 'WSRE (W

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-M7HGO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2329
Entropy (8bit):	4.961547078501025
Encrypted:	false
SSDEEP:	48:PuzL+VufEUw/rFCyYn6LYsLU/JnN2iXMY5vTDtfJoXhhrfzIMyxn1Y:yLCoEUw/rF6cY3/Jnoi5HfJaTbr
MD5:	86F3D9D29C2EF4844C49F1ABDD5C7F6C
SHA1:	03053C0B6002D69AF68A7FFE2BC51B4F5F55619C
SHA-256:	594BABCE79CCCE79FD51ACE25511508D77085D480586C433E4E8EC063D2248A4
SHA-512:	31245A1D6C20CC908B5B73F5C10B12BFBB325EE275236AAD93B199F36987CCE2E7D8FF3690AD7C661404B1E7E4EC86253022A6539538B823EA998B1C416331D9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class LemondeIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?lemonde\.fr/(?:[^/]+/)(?P<id>[^/]+)\.html'. _TESTS = [{. 'url': 'http://www.lemonde.fr/police-justice/video/2016/01/19/comprendre-l-affaire-bygmalion-en-cinq-minutes_4849702_1653578.html',. 'md5': 'da120c8722d8632eec6ced937536cc98',. 'info_dict': {. 'id': 'lqm3kl',. 'ext': 'mp4',. 'title': "Comprendre l'affaire Bygmalion en 5 minutes",. 'thumbnail': r're:^https?://.\.jpg',. 'duration': 309,. 'upload_date': '20160119',. 'timestamp': 1453194778,. 'uploader_id': '3pmkp',. },. }, {. # standard iframe embed. 'url': 'http://www.lemonde.fr/les-decodeurs/article/2016/10/18/tout-comprendre-du-ceta-le-petit-cousin-du-traite-transatlantique_5015920_4355770.html',. 'info_dict': {. 'id': 'uzsxms',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-M9BFQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	4.628363949331134
Encrypted:	false
SSDEEP:	48:+uEMFpSCfFZ1KFJ8GigqEFh2dEF0OxZgqdN2FLt8cyaBLxMwjXXBwm1CavWXBTow:fF784zEFhdF0OxZzdoFh8cyaswqmwcWn
MD5:	7BCBC9E4A080CF765E65AF2DE6B9354F
SHA1:	3A5B2AF99B5DAD70BB91FBC26B7C6BF189673EF3
SHA-256:	18E276F3C3B043FA8CE6F5C0B551CFC9B9A5CF1280F214462365A51E0C9E0544
SHA-512:	6E9BE08BF4DC00C8FFD84EE95DFE963F3D90134FAD01491D5A579979CE37F589384F0F99053BE939483F007F78D6EC5069B6C0E0C0F463B5FCFFB1631828B5AE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. try_get,.)...class TwentyMinutenIE(InfoExtractor):. IE_NAME = '20min'. _VALID_URL = r'''(?x). https?://. (?:www\.)?20min\.ch/. (?:. videotv/\?.?\bvid=\|. videoplayer/videoplayer\.html\?.?\bvideoId@. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://www.20min.ch/videotv/?vid=469148&cid=2',. 'md5': 'e7264320db31eed8c38364150c12496e',. 'info_dict': {. 'id': '469148',. 'ext': 'mp4',. 'title': '85 000 Franken f.r 15 perfekte Minuten',. 'thumbnail': r're:https?://.\.jpg$',. },. }, {. 'url': 'http://www.20min.ch/videoplayer/videoplayer.html?params=client@twentyDE\|videoId@523629

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MAOLI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5866
Entropy (8bit):	4.444215758799194
Encrypted:	false
SSDEEP:	96:QfOi7YlK83QPitUDHsngFWx3qeophkIwJR6Ce2Ry6gFWOUy60KA5a5LUNLG81Bqp:M6R3giW7sng8xzopunJXe0y6g8OUyiAk
MD5:	0D5EE9BB4642C385C33C52C1D82BBE24
SHA1:	E1B876BF195C1DD4D73E8EFBD438950B56563A3C
SHA-256:	1C79E56E6253F452AB4232BD145D660528B74CAFB63288285A166920E22B0E16
SHA-512:	43E42833351C3B03A66B0074DB5278FC2059C9C78DA84AAF147BC15A0176BDCAF059A78BC46305524C4EED17BCB84A5EE1F5C45900B76E57DB1A4CF9B9828616
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import time..from .common import InfoExtractor.from .soundcloud import SoundcloudIE.from ..compat import compat_str.from ..utils import (. ExtractorError,. url_basename,.)...class AudiomackIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?audiomack\.com/song/(?P<id>[\w/-]+)'. IE_NAME = 'audiomack'. _TESTS = [. # hosted on audiomack. {. 'url': 'http://www.audiomack.com/song/roosh-williams/extraordinary',. 'info_dict':. {. 'id': '310086',. 'ext': 'mp3',. 'uploader': 'Roosh Williams',. 'title': 'Extraordinary'. }. },. # audiomack wrapper around soundcloud song. {. 'add_ie': ['Soundcloud'],. 'url': 'http://www.audiomack.com/song/hip-hop-daily/black-mamba-freestyle',. 'info_dict': {. 'id': '258901379',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MD9UO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6079
Entropy (8bit):	4.555266815536536
Encrypted:	false
SSDEEP:	96:lOKUG8+LvpRIOfIi8BTrghNg5jD5sit3mh8qNTK6NPzL4CF73JaHDZomHRAnoIEA:0KUxajIOfIiUTZws3eK6NP40JajZjbmb
MD5:	255A4835A769A9B5847F38088163A45E
SHA1:	D68A57EFEF3244474260E8858EA9853B803D8924
SHA-256:	8CE5E86D85A74F16DB7CBE2460ACE0CC535931FCD31A4128718BB4D66383003C
SHA-512:	C04ECED2F12CD4F80B7EA4721C38172557171F05AB07D5E4071F5FCB34A206578B3812C1119920A3087E9DF21D13E407B82A97E8AA31700A887AD9F8D9928E91
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. extract_attributes,. ExtractorError,. int_or_none,. parse_age_limit,. remove_end,. unescapeHTML,. url_or_none,.)...class DiscoveryGoBaseIE(InfoExtractor):. _VALID_URL_TEMPLATE = r'''(?x)https?://(?:www\.)?(?:. discovery\|. investigationdiscovery\|. discoverylife\|. animalplanet\|. ahctv\|. destinationamerica\|. sciencechannel\|. tlc\|. velocitychannel. )go\.com/%s(?P<id>[^/?#&]+)'''.. def _extract_video_info(self, video, stream, display_id):. title = video['name'].. if not stream:. if video.get('authenticated') is True:. raise ExtractorError(. 'This video is only available via cable service provider subscription that'. ' is not currently supported. You may want

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MEJ4J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2835
Entropy (8bit):	4.770174794089422
Encrypted:	false
SSDEEP:	48:+uTMTOb7Ogbt8geHnXqVnnM+X80FNrQFeQX9xl7M+JHElfFIjimn4VSRiY4wSyo5:0TpgdCnXABXHFNrQFdXPldJHEFCyYyyS
MD5:	B50292F913DBFF8BDE949BDAFA1B81F3
SHA1:	37FA4F072D8A85F2776C4EAA4A970E6552412CE4
SHA-256:	6E9B9C5A44DA3D35678FC87DAF0298AA910C1057F94AAAF6146E77E3A0F4882E
SHA-512:	47FA791BADCEA7BD3E0E932EFA56506104A7E81FB9CA707CB9C08DECFA0C6328420BD29406E85AD573A4AA2E836D75ED43C5DE6893656D5E2865CB6F41B14FA8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,.)...class MoeVideoIE(InfoExtractor):. IE_DESC = 'LetitBit video services: moevideo.net, playreplay.net and videochart.net'. _VALID_URL = r'''(?x). https?://(?P<host>(?:www\.)?. (?:(?:moevideo\|playreplay\|videochart)\.net\|thesame\.tv))/. (?:video\|framevideo\|embed)/(?P<id>[0-9a-z]+\.[0-9A-Za-z]+)'''. _API_URL = 'http://api.letitbit.net/'. _API_KEY = 'tVL0gjqo5'. _TESTS = [. {. 'url': 'http://moevideo.net/video/00297.0036103fe3d513ef27915216fd29',. 'md5': '129f5ae1f6585d0e9bb4f38e774ffb3a',. 'info_dict': {. 'id': '00297.0036103fe3d513ef27915216fd29',. 'ext': 'flv',. 'title': 'Sink cut out machine',. 'description': 'md5:f29ff97b663aefa760bf7ca63c8ca8a8',. 'thumbnail': r're:^https?://.*\.j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MEP2B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3833
Entropy (8bit):	4.61722281506882
Encrypted:	false
SSDEEP:	96:Pw/7KQdbV4/XAcmPzzxHr5sx/SO65UB0gzHry7KYBebtfYHPwetVxB:o/7Kn/XtDSx2rpYeMB
MD5:	C574A5B4568689064C277F64CAC3ED9A
SHA1:	3BEDABDE962F53FEAD65427D0AD6618AA63F1F8C
SHA-256:	F8E13194A033F73EF723611043B2D2DC9C42BA56BC70FF98621870B6A9D0C737
SHA-512:	0C6827A566D0E1C3503D20B1ACCCBAE7BB602961AC78F3A71655A7612EED634C58A5C58B3D824F43E7DB8FEA712712483A4CFDC47AB41A50D937DB8F08CED282
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. float_or_none,. parse_iso8601,. update_url_query,. int_or_none,. determine_protocol,. unescapeHTML,.)...class SendtoNewsIE(InfoExtractor):. _VALID_URL = r'https?://embed\.sendtonews\.com/player2/embedplayer\.php\?.*\bSC=(?P<id>[0-9A-Za-z-]+)'.. _TEST = {. # From http://cleveland.cbslocal.com/2016/05/16/indians-score-season-high-15-runs-in-blowout-win-over-reds-rapid-reaction/. 'url': 'http://embed.sendtonews.com/player2/embedplayer.php?SC=GxfCe0Zo7D-175909-5588&type=single&autoplay=on&sound=YES',. 'info_dict': {. 'id': 'GxfCe0Zo7D-175909-5588'. },. 'playlist_count': 8,. # test the first video only to prevent lengthy tests. 'playlist': [{. 'info_dict': {. 'id': '240385',. 'ext': 'mp4',. 'title': 'Indians introduce Encarnacion'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MEV4S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3658
Entropy (8bit):	4.751752668646228
Encrypted:	false
SSDEEP:	96:Y6zvodh0WUNTSUssx5azTrBGzt9qj/KLqWwcRMFkNKVy7RO:Vo7GNvHa/ii9hx
MD5:	4B489B003C0109E4A542E500622D5DB0
SHA1:	A287A79704F6EC1CCAA9E2BBCECBDAC5270300A7
SHA-256:	3F0BA4246A55434F0863C90E61840A490E7B2289FEEE1032F6A94DF498F92946
SHA-512:	B51F2377DD4C3B9A1DB79701BD51A754C65D6ECCB644B78D73C97BDDF50BEC236F418BB668BA28C5D7C72133B5FD60DD03DAC87492D87ADFDC6690A5E9D03A9E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .brightcove import BrightcoveNewIE.from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. js_to_json,. smuggle_url,. try_get,.)...class NoovoIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?noovo\.ca/videos/(?P<id>[^/]+/[^/?#&]+)'. _TESTS = [{. # clip. 'url': 'http://noovo.ca/videos/rpm-plus/chrysler-imperial',. 'info_dict': {. 'id': '5386045029001',. 'ext': 'mp4',. 'title': 'Chrysler Imperial',. 'description': 'md5:de3c898d1eb810f3e6243e08c8b4a056',. 'timestamp': 1491399228,. 'upload_date': '20170405',. 'uploader_id': '618566855001',. 'series': 'RPM+',. },. 'params': {. 'skip_download': True,. },. }, {. # episode. 'url': 'http://noovo.ca/videos/l-amour-est-dans-le-pre/episode-13-8',. 'info_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MFT6V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	4.446090871387455
Encrypted:	false
SSDEEP:	192:HZSFcHv9l/3VSYM1rRqKHIZJynpDCGzK++UTu6NQ1C4+9pT83dn6NaujLRVFAV:HZSFgXVSYerRqKHIZKDCUK++UTu6NAC0
MD5:	81D7573C625A25708A53B46ECBF07212
SHA1:	F45BEB71CF0F0C184B531B5227F95353F6E8C23A
SHA-256:	07855DCCE0D3005795F24AD09D92A399286EF85CE638C93B6B4867E2C96367EB
SHA-512:	5B81E367906E226E6ED1867ADEE016E41BD9DBEC561D79D4C37445E2B30D8FA23BE5BA1B8614C9C085E5A8E96CD40219B8B80C45C2FF5AE143481A5CB9ADF3D4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,.)...class MySpaceIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. myspace\.com/[^/]+/. (?P<mediatype>. video/[^/]+/(?P<video_id>\d+)\|. music/song/[^/?#&]+-(?P<song_id>\d+)-\d+(?:[/?#&]\|$). ). '''.. _TESTS = [{. 'url': 'https://myspace.com/fiveminutestothestage/video/little-big-town/109594919',. 'md5': '9c1483c106f4a695c47d2911feed50a7',. 'info_dict': {. 'id': '109594919',. 'ext': 'mp4',. 'title': 'Little Big Town',. 'description': 'This country quartet was all smiles.while.playing a sold out show at the Pacific.Amphitheatre.in Orange County, California.',. 'uplo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MJEE0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	4.921142715908385
Encrypted:	false
SSDEEP:	24:zi8lFviLG5mAew1nMT/BODdlnDnIafEp2/nbZ6tbRHNPyW0e3NtXsy:+u0ryMLBc7DnI/I/ARxNPybYTXsy
MD5:	1CC4929A0D05FC12D8F8772CA5F1017A
SHA1:	FACEABFA95633C7C3597127755618C33CF71DAAB
SHA-256:	2B050B22FA5043AC750E934F8C611F676565656CC095122358E816E2E7F00214
SHA-512:	8F782F9492F30F26EB4D732A6A9BADD61B5D6E1E5321B8B4ED77E137A8352F7D26C26D94DC175790BC750233A644225649F689E529A7257B8F64A34BD2906696
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class PeopleIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?people\.com/people/videos/0,,(?P<id>\d+),00\.html'.. _TEST = {. 'url': 'http://www.people.com/people/videos/0,,20995451,00.html',. 'info_dict': {. 'id': 'ref:20995451',. 'ext': 'mp4',. 'title': 'Astronaut Love Triangle Victim Speaks Out: .The Crime in 2007 Hasn.t Defined Us.',. 'description': 'Colleen Shipman speaks to PEOPLE for the first time about life after the attack',. 'thumbnail': r're:^https?://.*\.jpg',. 'duration': 246.318,. 'timestamp': 1458720585,. 'upload_date': '20160323',. 'uploader_id': '416418724',. },. 'params': {. 'skip_download': True,. },. 'add_ie': ['BrightcoveNew'],. }.. def _real_extract(self, url):. return self.url_result(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MR8S8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3560
Entropy (8bit):	4.6024114441645745
Encrypted:	false
SSDEEP:	96:bmqwVwQS7cH7om9wCfLYkt9zdYG7xhBTthLciQx7RkUzNdya6Ng:Sqw+Q19wwLYuzdYG7xvTPLVtc6Ng
MD5:	35E47B222243795446E04973BB4B19B6
SHA1:	B561E2D348FB6C8717E13D3BB6B2678650D81F97
SHA-256:	9874C8446B0226F5FC48A819155CFD3FCE4B06BC0F5FBEBC7DE636621B89AE51
SHA-512:	03772DFC075430B1EEF6D4E81857D8FFF08F59ACCF944BABF5D1DBBDBF19F7D1C45B3645FBC935582E6AEFFCFE84B728402B67A0A6D92315C9BAD3E7E4392581
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. try_get,. unified_timestamp,.)...class VootIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?voot\.com/(?:[^/]+/)+(?P<id>\d+)'. _GEO_COUNTRIES = ['IN']. _TESTS = [{. 'url': 'https://www.voot.com/shows/ishq-ka-rang-safed/1/360558/is-this-the-end-of-kamini-/441353',. 'info_dict': {. 'id': '0_8ledb18o',. 'ext': 'mp4',. 'title': 'Ishq Ka Rang Safed - Season 01 - Episode 340',. 'description': 'md5:06291fbbbc4dcbe21235c40c262507c1',. 'timestamp': 1472162937,. 'upload_date': '20160825',. 'duration': 1146,. 'series': 'Ishq Ka Rang Safed',. 'season_number': 1,. 'episode': 'Is this the end of Kamini?',. 'episode_number': 340,. 'view_count': int,. 'like_count': int,. }

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-MU6A1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (348)
Category:	dropped
Size (bytes):	146359
Entropy (8bit):	4.642444918888387
Encrypted:	false
SSDEEP:	1536:1xIJvOT4t8eu2qQAbQQrus9euqdzfVBim9s2jsnWyI7a9c/hu6SNuPKoOTkgim4m:YXzqDSBF76SPKl
MD5:	95DBE450497F854AA90C28DA383B9BEA
SHA1:	9E55CDED8CD3392C484652600C730596F55DCA4D
SHA-256:	631BEEA50B6D6778A3F6D419F46FAE01F95E79F0B9DE89315CFA35E8E401AB99
SHA-512:	506DA7FCBE25B86FFA9DF319E295C76D5F5F74C215FFD47090D4090E1BDEBA2D332E155A546D96B0837FC4D97B7F8DA8465CB26728B951588B01A0F2593B570C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals...import itertools.import json.import os.path.import random.import re.import time.import traceback..from .common import InfoExtractor, SearchInfoExtractor.from ..jsinterp import JSInterpreter.from ..swfinterp import SWFInterpreter.from ..compat import (. compat_chr,. compat_HTTPError,. compat_kwargs,. compat_parse_qs,. compat_urllib_parse_unquote,. compat_urllib_parse_unquote_plus,. compat_urllib_parse_urlencode,. compat_urllib_parse_urlparse,. compat_urlparse,. compat_str,.).from ..utils import (. bool_or_none,. clean_html,. dict_get,. error_to_compat_str,. ExtractorError,. float_or_none,. get_element_by_attribute,. get_element_by_id,. int_or_none,. mimetype2ext,. orderedSet,. parse_codecs,. parse_duration,. qualities,. remove_quotes,. remove_start,. smuggle_url,. str_or_none,. str_to_int,. try_get,. unescapeHTML,. unified_strdate,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-N2NIV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9106
Entropy (8bit):	4.7571173147749315
Encrypted:	false
SSDEEP:	192:XpfdEpMO5oQeyNAdUNLtBOgOfiWO1MizuxsT/Hq6NQfcCV/cXksvp5l/G1F:XpypM8oQeyNAdUNLGPfiWO1MizuxsTCX
MD5:	E8386F79622058EF82ABE7301DA564FD
SHA1:	058451999708A9F2D798F870301C5BBD7EB30E45
SHA-256:	C265B6E033DC7EEF46D0A891BF8D870939DD5A993152441BC4784196E3B7FFCE
SHA-512:	5BF85CB8E2F7B66A245A6B2470D7C2C74420B9BD3C8039965A7FCB6D48C247D49477118F77C6791EB713F9B7443E88143440C4F6F273141E29FAB59D91D3447C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class IGNIE(InfoExtractor):. """. Extractor for some of the IGN sites, like www.ign.com, es.ign.com de.ign.com.. Some videos of it.ign.com are also supported. """.. _VALID_URL = r'https?://.+?\.ign\.com/(?:[^/]+/)?(?P<type>videos\|show_videos\|articles\|feature\|(?:[^/]+/\d+/video))(/.+)?/(?P<name_or_id>.+)'. IE_NAME = 'ign.com'.. _API_URL_TEMPLATE = 'http://apis.ign.com/video/v3/videos/%s'. _EMBED_RE = r'<iframe[^>]+?["\']((?:https?:)?//.+?\.ign\.com.+?/embed.+?)["\']'.. _TESTS = [. {. 'url': 'http://www.ign.com/videos/2013/06/05/the-last-of-us-review',. 'md5': 'febda82c4bafecd2d44b6e1a18a595f8',. 'info_dict': {. 'id': '8f862beef863986b2785559b9e1aa599',. 'ext': 'mp4',. 'title': 'The Last of Us Review',. 'description':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-N88RC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12703
Entropy (8bit):	4.607436134371312
Encrypted:	false
SSDEEP:	384:deDiWQSy8IU0D9qHw03QdBjehkaBdTFb6NVI4ftTQyTpN6N0yyio8qsmT0fl+mU:wmpSo9sAdBjehkaBdTFb8VI4ftTQyTp1
MD5:	7D1C9FFD162F1FC86713A7B09228EAB9
SHA1:	9AB1A036BB18F668E3540C523F6FE8A41A57B27F
SHA-256:	98DF06A804FCA66227D96E81678D906784F033D197F57CEB3EB98FABBFB473B6
SHA-512:	AA7EC600B59DA74FDB398E58935EF3F9C3081D27AA216D9E3A849E9A402E7FE28F406692167DF6C6C893A541FD605FB5BFD606EF8220CA701B263F5EC1A60A13
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. urlencode_postdata,.)...class LyndaBaseIE(InfoExtractor):. _SIGNIN_URL = 'https://www.lynda.com/signin/lynda'. _PASSWORD_URL = 'https://www.lynda.com/signin/password'. _USER_URL = 'https://www.lynda.com/signin/user'. _ACCOUNT_CREDENTIALS_HINT = 'Use --username and --password options to provide lynda.com account credentials.'. _NETRC_MACHINE = 'lynda'.. def _real_initialize(self):. self._login().. @staticmethod. def _check_error(json_string, key_or_keys):. keys = [key_or_keys] if isinstance(key_or_keys, compat_str) else key_or_keys. for key in keys:. error = json_string.get(key). if error:. raise ExtractorError('Unable to login: %s' % error, expected=True).. def _login_step(self, form_html, fallb

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-N9L46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (524)
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.925377962396441
Encrypted:	false
SSDEEP:	96:5yN7szo/AXjkK8Rmvs0fFw64gOM3eAXYkNBxqrWBToU77Nl4ft/8sE6NyfL+s/Se:5yN7sU/48R2siFwtgOM3dooxqryTPN6+
MD5:	01DA7C541A7E92911F84CFB71BBAD071
SHA1:	D24D23515BA56F70B72FEDF41ABF8DEB5673F761
SHA-256:	1CDEF85E695CCB631D2AC73D44F38BF7712B37D61B2C8609730CEED31D848A22
SHA-512:	B61D880E09D7F3573C3777FDB1AAAA8AE7B1A804FB28D4541775ECD54E7AA693061AA2C3B78DF4838FF7A3A238871E37FE9189AAB7534D110A945820B75890F3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import int_or_none...class R7IE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. (?:[a-zA-Z]+)\.r7\.com(?:/[^/]+)+/idmedia/\|. noticias\.r7\.com(?:/[^/]+)+/[^/]+-\|. player\.r7\.com/video/i/. ). (?P<id>[\da-f]{24}). '''. _TESTS = [{. 'url': 'http://videos.r7.com/policiais-humilham-suspeito-a-beira-da-morte-morre-com-dignidade-/idmedia/54e7050b0cf2ff57e0279389.html',. 'md5': '403c4e393617e8e8ddc748978ee8efde',. 'info_dict': {. 'id': '54e7050b0cf2ff57e0279389',. 'ext': 'mp4',. 'title': 'Policiais humilham suspeito . beira da morte: "Morre com dignidade"',. 'description': 'md5:01812008664be76a6479aa58ec865b72',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-NAKU2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2254
Entropy (8bit):	4.77880175382604
Encrypted:	false
SSDEEP:	48:Pu4gUwI+ve2nXpe3sCajXjlkoVH0dgpfmoq5XZXlk3ByNaXSq6SSWdOA10KB6NvS:WUwIQfnXI3Baqo6oqjXldNiS9SSWcs0K
MD5:	125F23501151AFA09AF9FB6E6057643E
SHA1:	C0B70F2CC3928AA3DB2839C4D50E1C42B0C9E9A8
SHA-256:	10D180D446C7D557C3F8528914E4EF96F62D13F3DE1EEA29CACC21CBC6F11F79
SHA-512:	268DA65A0A03234E961914EC5F4A2D35A38B39772270516E4A1C3B5AE4BFEE2C908E0EF55AC853679350994F666EF3BD9069A0C8C32B82FB0EAD2A73E72D4D7E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. parse_duration,. remove_end,.)...class VuClipIE(InfoExtractor):. _VALID_URL = r'https?://(?:m\.)?vuclip\.com/w\?.?cid=(?P<id>[0-9]+)'.. _TEST = {. 'url': 'http://m.vuclip.com/w?cid=1129900602&bu=8589892792&frm=w&z=34801&op=0&oc=843169247&section=recommend',. 'info_dict': {. 'id': '1129900602',. 'ext': '3gp',. 'title': 'Top 10 TV Convicts',. 'duration': 733,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. ad_m = re.search(. r'''value="No.?" onClick="location.href='([^"']+)'"''', webpage). if ad_m:. urlr = compat_urllib_parse_urlparse(url). adfree_url = urlr.scheme + '://' + urlr.netloc +

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-NEDD2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4791
Entropy (8bit):	4.516801047460295
Encrypted:	false
SSDEEP:	96:mj3mZgPE6Wld/vv2vl+k5N6rXkxNwG4+ZcKlBbpST2:mjWZgPPwf2vl+kH6rY+klhpV
MD5:	AD8D8D02643A2D23D1D190B96F4A6630
SHA1:	5135C938FAE684202FA3FB4D9AC0904139E184A7
SHA-256:	DCF50E2D7A66D736025B0F5DCBC158D93B8BFBDD8A79232836800287C2659B1A
SHA-512:	A21BFA0223716DC6D277586FADDE46A20FE79B37857B034B539F750307E82667DC1513376F2D676D073881335231AFD9C35F3EB682A7F250ED17C0AA78A33AEC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import random.import re.import string..from .discoverygo import DiscoveryGoBaseIE.from ..compat import (. compat_str,. compat_urllib_parse_unquote,.).from ..utils import (. ExtractorError,. try_get,. HEADRequest.).from ..compat import compat_HTTPError...class DiscoveryIE(DiscoveryGoBaseIE):. _VALID_URL = r'''(?x)https?://. (?P<site>. (?:www\.\|go\.)?. (?:. discovery\|. investigationdiscovery\|. discoverylife\|. animalplanet\|. ahctv\|. destinationamerica\|. sciencechannel\|. tlc\|. velocity. )\|. watch\.. (?:. hgtv\|. foodnetwork\|. travelchannel\|. diynetwork\|. cookingchanneltv\|. motortr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-NEOK7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	24209
Entropy (8bit):	4.707015572305671
Encrypted:	false
SSDEEP:	384:HWqKJivbtytje+pG7pbQzZHumvGXyt2gfaARZF+y0jDFrsbJy7FGQOriZTg6NHyk:HnpvDNsbOFGQOriZTg8IBEpT
MD5:	4BAC3DC2430F31748AFA4415787CFEB2
SHA1:	3B3FA8AA4BB986774917628AE56E175E4EA19E4E
SHA-256:	B559301E92B54BB1A7833A3B63E1952BB5CBD14F8BD9532378FB764C1C368BE7
SHA-512:	A30102B86CD262DEBDD484461F062D342F1319D9E55D6BCEC1715F95F7DBE13AF7FCDC6095915D123571DF904BAFC03E0CA44ADCF7100F0824928048D50130DC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import collections.import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. clean_html,. ExtractorError,. get_element_by_class,. int_or_none,. orderedSet,. remove_start,. str_or_none,. str_to_int,. unescapeHTML,. unified_timestamp,. url_or_none,. urlencode_postdata,.).from .dailymotion import DailymotionIE.from .pladform import PladformIE.from .vimeo import VimeoIE.from .youtube import YoutubeIE...class VKBaseIE(InfoExtractor):. _NETRC_MACHINE = 'vk'.. def _login(self):. username, password = self._get_login_info(). if username is None:. return.. login_page, url_handle = self._download_webpage_handle(. 'https://vk.com', None, 'Downloading login page').. login_form = self._hidden_inputs(login_page).. login_form.update({. 'email': username.encode('cp1251'),. 'pass':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-NK9RU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	13633
Entropy (8bit):	4.839947315373942
Encrypted:	false
SSDEEP:	384:0SMnAKVeG/tLz+luKmnoK/NzH4pbBKYyj4Q5LvicTp6Ng:0SMnBGelzY5QYyjbicTp8g
MD5:	D5B9DC145E19BB2BFE26C9A42DB3BDEA
SHA1:	E5665DB75CFEB1CDAFAAF6D82862E2C69202C3C2
SHA-256:	6815017D45A6FCC873B9998EC72AAB2F6148D6E47526CDCDE696CCD6EBE04DC2
SHA-512:	86953FDE9ADF86EF1DE4544A8A461E11C3F0E8A88D8A78E0DA1BC94AD721F1AFE8F170E237122DB135A8F53F79F955CBD0EC831EB4632F5BE941B7C48F8DC44B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import itertools.import re.import time..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urllib_parse_urlencode,.).from ..utils import (. clean_html,. decode_packed_codes,. get_element_by_id,. get_element_by_attribute,. ExtractorError,. ohdave_rsa_encrypt,. remove_start,.)...def md5_text(text):. return hashlib.md5(text.encode('utf-8')).hexdigest()...class IqiyiSDK(object):. def __init__(self, target, ip, timestamp):. self.target = target. self.ip = ip. self.timestamp = timestamp.. @staticmethod. def split_sum(data):. return compat_str(sum(map(lambda p: int(p, 16), list(data)))).. @staticmethod. def digit_sum(num):. if isinstance(num, int):. num = compat_str(num). return compat_str(sum(map(int, num))).. def even_odd(self):. even = self.digit_sum(compat_str(self.timestamp)[::2]).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-NLL84.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6137
Entropy (8bit):	4.813158598166853
Encrypted:	false
SSDEEP:	96:5eOUPKNHvliOT4h7Z1OUrln2rld5evYv8F0UyS9fCQ9PuOB51CH0vbbeH+kNghNy:Y+hlif7PDMfl8Fm4GDHubeH+PhTL8/1T
MD5:	E647A39901430A52DFA9C08934CCB1F5
SHA1:	402AADDDB801E2B7E22B6602BE6A0D7D63091161
SHA-256:	232F34F9D3408A5BB61739DEEF34B22BAECAF2A0EF884C44955CE71B50FAE476
SHA-512:	9D2FF83C85C7845638F62A5DEF5F85B4B9A48566B75A6CD80FB2D7F757E69395DBD1055B0C9C9B0A5CC346171E010D3F0849DADB6C1A0E06388400CBB2DEC72B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. unescapeHTML,. parse_duration,. get_element_by_class,.)...class LEGOIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lego\.com/(?P<locale>[^/]+)/(?:[^/]+/)videos/(?:[^/]+/)[^/?#]+-(?P<id>[0-9a-f]+)'. _TESTS = [{. 'url': 'http://www.lego.com/en-us/videos/themes/club/blocumentary-kawaguchi-55492d823b1b4d5e985787fa8c2973b1',. 'md5': 'f34468f176cfd76488767fc162c405fa',. 'info_dict': {. 'id': '55492d823b1b4d5e985787fa8c2973b1',. 'ext': 'mp4',. 'title': 'Blocumentary Great Creations: Akiyuki Kawaguchi',. 'description': 'Blocumentary Great Creations: Akiyuki Kawaguchi',. },. }, {. # geo-restricted but the contentUrl contain a valid url. 'url': 'http://www.lego.com/nl-nl/videos/themes/nexoknights/episode-20-kingdom-of-heroes-13bdc

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-NOOU2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12336
Entropy (8bit):	4.754936423552399
Encrypted:	false
SSDEEP:	384:BIqbxjLzOrHirRorfsr1hTYF6NTHSFiFM0y8cECmVn/fj:qixjLzOrHirRorfsr1hTI8u9Gbd/L
MD5:	5F5D80C593FC731DF9417C9C0307D500
SHA1:	45B4D27D4315B2119BD56F08E849DE809641F3DB
SHA-256:	B40CA46E04299F38226A30DB40012D94C3F8BA188ADBF5DE5EFBFF8A6DB47080
SHA-512:	F77333849082CDAB657D6786E417628A014478E090E042683F22B5B50C78A3333D632BFAC6A31E0DD936F627EE8FF7F353D6CDB3F5419007EA107EB5337D19C8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from .gigya import GigyaBaseIE.from ..compat import compat_HTTPError.from ..utils import (. ExtractorError,. strip_or_none,. float_or_none,. int_or_none,. merge_dicts,. parse_iso8601,.)...class CanvasIE(InfoExtractor):. _VALID_URL = r'https?://mediazone\.vrt\.be/api/v1/(?P<site_id>canvas\|een\|ketnet\|vrt(?:video\|nieuws)\|sporza)/assets/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://mediazone.vrt.be/api/v1/ketnet/assets/md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'md5': '90139b746a0a9bd7bb631283f6e2a64e',. 'info_dict': {. 'id': 'md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'display_id': 'md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'ext': 'flv',. 'title': 'Nachtwacht: De Greystook',. 'description': 'md5:1db3f5dc4c7109c821261e7512975be7',. 'thumbnail': r're:^https?://.*\.jpg$',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-NOQVC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	4.825519505513922
Encrypted:	false
SSDEEP:	192:c9n3s9dssNzyJFsz9zg67HhyJnGVFppdOW/NEHzdQj6eJ1:7OsNzyJFsz9zP7H+mFpmW/NEHze
MD5:	D58EEA7DAF4055C5CFAC99D4D1F3C49C
SHA1:	DC53E1659FFA90ED2B43C1BAEAB117F9C796C627
SHA-256:	79D11C1CB9CE7D2E03E3947BD243AC86F8EC3AAAB2A670259B9D453E2B3E0DAE
SHA-512:	CAFAE0DD046C73F8A2F8AC56260900AC334E913220CEF76B944E33E91F2041D8C1A190B22B5A75D0824161A3C46D7059ED551A297323E02DBEAD56DE86D026F7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor..from ..compat import (. compat_parse_qs,. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. update_url_query,.)...class SafariBaseIE(InfoExtractor):. _LOGIN_URL = 'https://learning.oreilly.com/accounts/login/'. _NETRC_MACHINE = 'safari'.. _API_BASE = 'https://learning.oreilly.com/api/v1'. _API_FORMAT = 'json'.. LOGGED_IN = False.. def _real_initialize(self):. self._login().. def _login(self):. username, password = self._get_login_info(). if username is None:. return.. _, urlh = self._download_webpage_handle(. 'https://learning.oreilly.com/accounts/login-check/', None,. 'Downloading login page').. def is_logged(urlh):. return 'learning.oreilly.com/home/' in compat_str(urlh.geturl()).. if is_logged(urlh):. self.LOGGED_IN =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-O183L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	4.794717959641716
Encrypted:	false
SSDEEP:	96:VnZrSU5dNdwwidXd+bpMY08bXd0fJaG4BPVcQidBkbowBTrpE6Ng:9YoNdjXlMY0xJa8QidBkboATG6Ng
MD5:	2432113AA5B869481E45317CF80B60D0
SHA1:	6671FE747F1C84C3FE420C9E65439E8FE2DA5939
SHA-256:	36F99011141BA6C0D086F61789C04644E1A969E6D7D3EFACA115831DEBEE425B
SHA-512:	97F67EAEDCE52BFE3A0A4B1CB4F236BC1FE40430ABDD20A6287C6E4DC8DE53DE0C883470DD9D7910B5B4E2C4CFDCB7D536073B3A3224733A05D358030A1DC0AC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import unified_timestamp...class InternazionaleIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?internazionale\.it/video/(?:[^/]+/)(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.internazionale.it/video/2015/02/19/richard-linklater-racconta-una-scena-di-boyhood',. 'md5': '3e39d32b66882c1218e305acbf8348ca',. 'info_dict': {. 'id': '265968',. 'display_id': 'richard-linklater-racconta-una-scena-di-boyhood',. 'ext': 'mp4',. 'title': 'Richard Linklater racconta una scena di Boyhood',. 'description': 'md5:efb7e5bbfb1a54ae2ed5a4a015f0e665',. 'timestamp': 1424354635,. 'upload_date': '20150219',. 'thumbnail': r're:^https?://.\.jpg$',. },. 'params': {. 'format': 'bestvideo',. },. }, {. 'url': 'https://www.internazionale.it/video/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-O34A5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1541
Entropy (8bit):	5.081469098955692
Encrypted:	false
SSDEEP:	48:+uLlUPf+1jQUIbXIvq9wBhHrD18VZbOZXjl07sRpNNx:+H+1jQUIjiq+hHreV5Ok4fx
MD5:	BAB36F3DD13BB8CE9AF29A1D899714E4
SHA1:	EC21AF3A348B0B68687159543600775627E282F8
SHA-256:	AC457A5885AC7A696EF76F45169549593BA9D4BA53F6DCCF10662F12BFBE1DD2
SHA-512:	0BFCB69919D1AE83CCBD4D9EC2807DA9070A799CD30B8217894E6BEB394A292F95778A8E2A1F3590C638738760D8CF7F9A51AD53FB8CD21CDB2B5D3B2985E1A0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .mtv import MTVServicesInfoExtractor...class VH1IE(MTVServicesInfoExtractor):. IE_NAME = 'vh1.com'. _FEED_URL = 'http://www.vh1.com/feeds/mrss/'. _TESTS = [{. 'url': 'http://www.vh1.com/episodes/0umwpq/hip-hop-squares-kent-user-vs-nick-young-season-1-ep-120',. 'info_dict': {. 'title': 'Kent user vs. Nick Young',. 'description': 'Come to Play. Stay to Party. With Mike Epps, TIP, O.Shea Jackson Jr., T-Pain, Tisha Campbell-Martin and more.',. },. 'playlist_mincount': 4,. }, {. # Clip. 'url': 'http://www.vh1.com/video-clips/t74mif/scared-famous-scared-famous-extended-preview',. 'info_dict': {. 'id': '0a50c2d2-a86b-4141-9565-911c7e2d0b92',. 'ext': 'mp4',. 'title': 'Scared Famous\|October 9, 2017\|1\|NO-EPISODE#\|Scared Famous + Extended Preview',. 'description': 'md5:eff5551a274c473a29463de40f7b09da',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-O6E5A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3637
Entropy (8bit):	4.733473249972319
Encrypted:	false
SSDEEP:	96:cIJ6sxM6jyGBRo6uvq82/0hzVfNFcpj52bECHeSIJlf6GuVDEWNs6Ng:cIMAO8zGVNFY5GOlYG6Ng
MD5:	4D54A7B94F0CB2689416356BD06C5DE8
SHA1:	95578D4BEB7D8B35CE37B8704EC68C57D72F7E24
SHA-256:	3F0952A8750D731992FAD8FB3F778BB698AD5147636D24A7D7DDEB0F1C8A40F6
SHA-512:	6CE3082EFCA47233F75C096FCF8AFF87C1ADAC8B89356B27F42AC7483F2207D3906BA1CF2E3D5845AA80ADE6CECA9F725B3952E53677A1449ACEA68C18C9E929
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. get_element_by_class,. parse_duration,. strip_or_none,. unified_strdate,.)...class LibsynIE(InfoExtractor):. _VALID_URL = r'(?P<mainurl>https?://html5-player\.libsyn\.com/embed/episode/id/(?P<id>[0-9]+))'.. _TESTS = [{. 'url': 'http://html5-player.libsyn.com/embed/episode/id/6385796/',. 'md5': '2a55e75496c790cdeb058e7e6c087746',. 'info_dict': {. 'id': '6385796',. 'ext': 'mp3',. 'title': "Champion Minded - Developing a Growth Mindset",. # description fetched using another request:. # http://html5-player.libsyn.com/embed/getitemdetails?item_id=6385796. # 'description': 'In this episode, Allistair talks about the importance of developing a growth mindset, not only in sports, but in life too.',. 'upload_date': '20180320',. 'th

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-O7G66.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2269
Entropy (8bit):	4.776434615717236
Encrypted:	false
SSDEEP:	48:+unRFS/ZCfaiK4s3gN2j0XCZN3XSLLt8cynBpVyjXHqGp1k8opdBTr6Ng:be/KafrQockHSV8cyBpITdp1NopdBTrL
MD5:	5EAE13A76A727E69634E245571936B4D
SHA1:	FF40E22ECFDD579C970212FDAE823B576A8C1F57
SHA-256:	05CE21C9193C8AF3EBE69394DB291CE13C21D197B59AF1B6CB5F2A3FB131CB92
SHA-512:	F7F154B54F8CABCC7DADF4D8A1FFE656DB42E63F3D698CB8777CD9AC26AE32008ACA1C80A402B6EF4310BDC176F07F40AA84895190BB1C8D6282A58CCE9A732C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class CloudflareStreamIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. (?:watch\.)?(?:cloudflarestream\.com\|videodelivery\.net)/\|. embed\.(?:cloudflarestream\.com\|videodelivery\.net)/embed/[^/]+\.js\?.*?\bvideo=. ). (?P<id>[\da-f]+). '''. _TESTS = [{. 'url': 'https://embed.cloudflarestream.com/embed/we4g.fla9.latest.js?video=31c9291ab41fac05471db4e73aa11717',. 'info_dict': {. 'id': '31c9291ab41fac05471db4e73aa11717',. 'ext': 'mp4',. 'title': '31c9291ab41fac05471db4e73aa11717',. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'https://watch.cloudflarestream.com/9df17203414fd1db3e3ed74abbe936c1',. 'only_matc

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-O7NBF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5295
Entropy (8bit):	4.7207887081698345
Encrypted:	false
SSDEEP:	96:k41nHgElNt3vzelUVfhtA01wRwLWRV1wLjoNzAw5QxNZSBTxJ483T/LNnRq6Ng:k41nHHN5vyGVhtA01IwewHoGwOnYTbNu
MD5:	63C175A5B904AA9C28CBD551DA8DD473
SHA1:	7141DB3A1EC7B5DBD3ECC917A2ED735452BAF629
SHA-256:	0A16F76C3B5B6486F98DE70299FF0F6BB6C7B323E9C7BBC25E84740B7305C3CC
SHA-512:	828E64180F4A8E41CFD33562DF69FA73E500AB5D5CE711D1940167065AD2DE69D350BD6E25588F6C7135D4104725B476B790B40749748C2920D75EE372EDF1FE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. unified_timestamp,. update_url_query,.)...class KakaoIE(InfoExtractor):. _VALID_URL = r'https?://tv\.kakao\.com/channel/(?P<channel>\d+)/cliplink/(?P<id>\d+)'. _API_BASE = 'http://tv.kakao.com/api/v1/ft/cliplinks'.. _TESTS = [{. 'url': 'http://tv.kakao.com/channel/2671005/cliplink/301965083',. 'md5': '702b2fbdeb51ad82f5c904e8c0766340',. 'info_dict': {. 'id': '301965083',. 'ext': 'mp4',. 'title': '...46 ..... .3................GP... ........',. 'uploader_id': 2671005,. 'uploader': '.....',. 'timestamp': 1488160199,. 'upload_date': '20170227',. }. }, {. 'url': 'http://tv.kakao.com/channel/2653210/cliplink/300103180',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-O85NF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2061
Entropy (8bit):	4.756770934713165
Encrypted:	false
SSDEEP:	48:Purt53fY7nfQQ8VMcvgtfjXhFouXY8VPwaLGKjQS5BTCwexRe7Cn6tNs6Ng:kY7oQ8V5vGfHA8SeTBTCPxRTINs6Ng
MD5:	77313FEB59FD0E417DCA1BC6F6FC40BE
SHA1:	D536555A516AB4BC96412D7C8606EFB19F05C9CC
SHA-256:	FD89D9C3D7C2FF1CAAFA19677D1873914FD4B4334D7547D4B311FB378BF58CF4
SHA-512:	703FCA285BDEDE7BFA9602BEDE1A338626217AD0A70CF008926158C3F9D553866365CE5D70530E086743D2D339DCDB9869E0FC8BFA04E2056694C9A83AE252EE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. qualities,.)...class CrooksAndLiarsIE(InfoExtractor):. _VALID_URL = r'https?://embed\.crooksandliars\.com/(?:embed\|v)/(?P<id>[A-Za-z0-9]+)'. _TESTS = [{. 'url': 'https://embed.crooksandliars.com/embed/8RUoRhRi',. 'info_dict': {. 'id': '8RUoRhRi',. 'ext': 'mp4',. 'title': 'Fox & Friends Says Protecting Atheists From Discrimination Is Anti-Christian!',. 'description': 'md5:e1a46ad1650e3a5ec7196d432799127f',. 'thumbnail': r're:^https?://.*\.jpg',. 'timestamp': 1428207000,. 'upload_date': '20150405',. 'uploader': 'Heather',. 'duration': 236,. }. }, {. 'url': 'http://embed.crooksandliars.com/v/MTE3MjUtMzQ2MzA',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OE2ED.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	4.888857282900641
Encrypted:	false
SSDEEP:	24:zi8lFvngpjYRUjZon/65dll2VPdZ8aeIXjlgtewUdxreW7LK+/0Ffl5VZ2P4vvg:+uxgpjYa9w65pAPcajXjlkewUdwW7WuR
MD5:	F8078A31E44CB748DD5D3FA7D77D172D
SHA1:	5EAF6642C656F932C472E0FFBBFA4CCB52839773
SHA-256:	4F6779E3AE0D68C68EE9C57DCE9DE8DF401DAFBF6EB1995D6239A10B60D29FCA
SHA-512:	C6AACE0B8A90B0B0CE349D8F8B85EEBE94BB3375AE326416479B281F2EB7A6AC7C64E4C236BAA51674062E6B4E79F46623A51CA72A86AD5A60FB64F4287599FB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import int_or_none...class LiveJournalIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^.]+\.)?livejournal\.com/video/album/\d+.+?\bid=(?P<id>\d+)'. _TEST = {. 'url': 'https://andrei-bt.livejournal.com/video/album/407/?mode=view&id=51272',. 'md5': 'adaf018388572ced8a6f301ace49d4b2',. 'info_dict': {. 'id': '1263729',. 'ext': 'mp4',. 'title': '........... ...... ....',. 'upload_date': '20190624',. 'timestamp': 1561406715,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). record = self._parse_json(self._search_regex(. r'Site\.page\s=\s({.+?});', webpage,. 'page data'), video_id)['video']['record']. storage_id = compat_str(

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OI4JR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	4.733818050536063
Encrypted:	false
SSDEEP:	48:PuEgOv/aXSZRtoRjXOuSPKlZLjiDdDqWv+5LDKtobJdT:ddv/aXSZgoKlZHi5WhLJ
MD5:	D66CD686318A43FF888AB3FBE322CA50
SHA1:	E71F2BA59280ED526F60A31B9EEF8CFD3752ADF0
SHA-256:	77A4FDFE6EC1701D2EE995390AC8B2205C8163317F921DB61E570EB16B18B2FF
SHA-512:	67F23E56A8F740986A84E3E93AF695C35750958A4AD65E839D79F8FAB8237A8908D3A5917F90DE7883C4336D1F6CCE0B82E407FC05BDF4B46C0C8712DDD0C084
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class VideofyMeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.videofy\.me/.+?\|p\.videofy\.me/v)/(?P<id>\d+)(&\|#\|$)'. IE_NAME = 'videofy.me'.. _TEST = {. 'url': 'http://www.videofy.me/thisisvideofyme/1100701',. 'md5': 'c77d700bdc16ae2e9f3c26019bd96143',. 'info_dict': {. 'id': '1100701',. 'ext': 'mp4',. 'title': 'This is VideofyMe',. 'description': '',. 'upload_date': '20130326',. 'timestamp': 1364288959,. 'uploader': 'VideofyMe',. 'uploader_id': 'thisisvideofyme',. 'view_count': int,. 'likes': int,. 'comment_count': int,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. config = self._download_json('http://vf-player-info-loader.herokuapp.com/%s.json'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OJ8CM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	4.974790035731387
Encrypted:	false
SSDEEP:	48:+uHVpp+0R3pMXYxvqrCFhBTnh3HnN16N/SOn/46Sj8:TrbxvSGhBTnhXnN16N/dgj8
MD5:	64FA1182C10A7E62013FDEF3EC24F426
SHA1:	78591CBD945E670C73F4BBD8C894DB5BFBA6D76D
SHA-256:	ADACF63584AD5988206A61BC3D07D138FFC31596A68F145788905144A8F2D7C7
SHA-512:	254044C41D9ACF99C48B1FEBFE287F37D4650561A0E45EEC4C33385D87A314374A23838EA4367E08A77CB086B31F30972B96F092F51BEEA3F75759611CC035D2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_urllib_parse_unquote,.).from ..utils import int_or_none...class MangomoloBaseIE(InfoExtractor):. def _get_real_id(self, page_id):. return page_id.. def _real_extract(self, url):. page_id = self._get_real_id(self._match_id(url)). webpage = self._download_webpage(url, page_id). hidden_inputs = self._hidden_inputs(webpage). m3u8_entry_protocol = 'm3u8' if self._IS_LIVE else 'm3u8_native'.. format_url = self._html_search_regex(. [. r'file\s:\s"(https?://[^"]+?/playlist\.m3u8)',. r'<a[^>]+href="(rtsp://[^"]+)"'. ], webpage, 'format url'). formats = self._extract_wowza_formats(. format_url, page_id, m3u8_entry_protocol, ['smil']). self._sort_formats(formats).. return {. 'id': page_id,. 'title':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OL1H6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	4.974618501126581
Encrypted:	false
SSDEEP:	96:A+/JghkCLuoAanCH8l78yNYSP7saj6TFcdT6TSfxayIYKKLU0YKv6TTcBmx7IFLe:nyuIA8r7s665O68xQr0rv6PDaFaFL
MD5:	A822324CDC3D13B444A079D6FC6D1EF4
SHA1:	9CBAE4B32D926C89F1461FF1C3C4326BDD7BF0E9
SHA-256:	42C3FD362A562D9F53A18F08055CB779FB7BE146AC37F0423ABDCFFC6FBD350E
SHA-512:	73C54AA4D4A3004B763DB4EA8FCA7150521CE2C88FD12D7CE4F3DE4AB48F8BD0A56737B293791979E08E064193DA1873420C182E6B6E201AECAC6D73C2E5ED62
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse_urlparse,.).from ..utils import (. clean_html,. float_or_none,. int_or_none,. try_get,. urlencode_postdata,.)...class CiscoLiveBaseIE(InfoExtractor):. # These appear to be constant across all Cisco Live presentations. # and are not tied to any user session or event. RAINFOCUS_API_URL = 'https://events.rainfocus.com/api/%s'. RAINFOCUS_API_PROFILE_ID = 'Na3vqYdAlJFSxhYTYQGuMbpafMqftalz'. RAINFOCUS_WIDGET_ID = 'n6l4Lo05R8fiy3RpUBm447dZN8uNWoye'. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/5647924234001/SyK2FdqjM_default/index.html?videoId=%s'.. HEADERS = {. 'Origin': 'https://ciscolive.cisco.com',. 'rfApiProfileId': RAINFOCUS_API_PROFILE_ID,. 'rfWidgetId': RAINFOCUS_WIDGET_ID,. }.. def _call_api(self, ep, rf_id, query, referrer, note=None):

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ON4F0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10330
Entropy (8bit):	4.336534640040588
Encrypted:	false
SSDEEP:	192:Fbmdsfz/1QFELjsEW1id2TcO6N0RFHjaTwObUTi6N0ow7RhbCxSqoA0751KMsMq:FbmdsfzKFEMXy2TcO6N0bjqwAUTi6N0q
MD5:	F2A416236D5F2D1CA4D1403C246FF2C1
SHA1:	1D6E37485BCB3D00C0F312AD56A46489627FB1D5
SHA-256:	940E42C79AEBA8F3CD58A048BCA2AC17CBEEC2D16D7ECD96285D63260ED28AE5
SHA-512:	77BC96F5C1F8461DD1B2DE020EC12DF803A2D20900F08EC4AA189E5BE35B9E5EEA16293DE34226E0DE75B4EAC418C02C31DADC05CA9EE2B80C223F417BAD41F9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. parse_duration,. unified_strdate,.)...class AppleTrailersIE(InfoExtractor):. IE_NAME = 'appletrailers'. _VALID_URL = r'https?://(?:www\.\|movie)?trailers\.apple\.com/(?:trailers\|ca)/(?P<company>[^/]+)/(?P<movie>[^/]+)'. _TESTS = [{. 'url': 'http://trailers.apple.com/trailers/wb/manofsteel/',. 'info_dict': {. 'id': '5111',. 'title': 'Man of Steel',. },. 'playlist': [. {. 'md5': 'd97a8e575432dbcb81b7c3acb741f8a8',. 'info_dict': {. 'id': 'manofsteel-trailer4',. 'ext': 'mov',. 'duration': 111,. 'title': 'Trailer 4',. 'upload_date': '20130523',. 'uploader_id': 'wb',. },. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ONM4T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18470
Entropy (8bit):	4.662997868826779
Encrypted:	false
SSDEEP:	384:EWh12Ps2GO2TauTg+26NWMkG1T0vrE5Dh19wkKckW/Wo1rgbw13Ms6Oq+Q2uT0U8:EWh12Ps2GO2TauTV28NVl9wkJPv13Ms5
MD5:	D5FFDB088BD5719F8188EF3571656EC7
SHA1:	9BEE01B07DA119243C7FEF2B7925264612EED63B
SHA-256:	D0D3E4DB4083EB43A095E7E2EEB48B6DC323E856992F2483A15B2A25DDA04530
SHA-512:	5A3B6D46F23EA9135518B8842EDDCBA15750C91502C50C37E25E0182A29DB9B1CAE926A72A2AB4318DF00B745C0DF4CAE6B67B912807CCB1401FD1C6EFEEF845
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,. parse_duration,. str_or_none,. update_url_query,. urljoin,.)...class TVNowBaseIE(InfoExtractor):. _VIDEO_FIELDS = (. 'id', 'title', 'free', 'geoblocked', 'articleLong', 'articleShort',. 'broadcastStartDate', 'isDrm', 'duration', 'season', 'episode',. 'manifest.dashclear', 'manifest.hlsclear', 'manifest.smoothclear',. 'format.title', 'format.defaultImage169Format', 'format.defaultImage169Logo').. def _call_api(self, path, video_id, query):. return self._download_json(. 'https://api.tvnow.de/v3/' + path, video_id, query=query).. def _extract_video(self, info, display_id):. video_id = compat_str(info['id']). title = info['title'].. paths = []. for manifest_url in (info.get('manifest') o

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OP7QL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5704
Entropy (8bit):	4.799178112039796
Encrypted:	false
SSDEEP:	96:W6JHDN6y8EacnVH4hf9LZjiyRnbRYBTSr6NjMN4jF4k7g+KHdjSIPLuYIRDufYui:WWDNr4Y+9dji8nbRYTe6NFjF4k7g+qdC
MD5:	534084711CEA8087236DC3BBC23C7B89
SHA1:	7936DA30D93BD9BE9B9F716BFCE372130C24295E
SHA-256:	B3D6262CB9BD7E03FB4D607FA53C30E31B8AAA7E0563985C9C2986E76959344E
SHA-512:	2ABEE6D31DA9E6A858008A9E80D33BA4C0D24F102135FB0B5DFF102B6EF32F1C673C9D2DDD0329B6DA982C5A00E9932A3D0DA6DADE66BC58B051631ACF32A0E0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. qualities,. remove_start,.)...class WrzutaIE(InfoExtractor):. IE_NAME = 'wrzuta.pl'.. _VALID_URL = r'https?://(?P<uploader>[0-9a-zA-Z]+)\.wrzuta\.pl/(?P<typ>film\|audio)/(?P<id>[0-9a-zA-Z]+)'.. _TESTS = [{. 'url': 'http://laboratoriumdextera.wrzuta.pl/film/aq4hIZWrkBu/nike_football_the_last_game',. 'md5': '9e67e05bed7c03b82488d87233a9efe7',. 'info_dict': {. 'id': 'aq4hIZWrkBu',. 'ext': 'mp4',. 'title': 'Nike Football: The Last Game',. 'duration': 307,. 'uploader_id': 'laboratoriumdextera',. 'description': 'md5:7fb5ef3c21c5893375fda51d9b15d9cd',. },. 'skip': 'Redirected to wrzuta.pl',. }, {. 'url': 'http://vexling.wrzuta.pl/audio/01xBFabGXu6/james_horner_-_into_the_na_39_vi_world_bonus',. 'md5': 'f

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OPDK9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7147
Entropy (8bit):	4.96034309716297
Encrypted:	false
SSDEEP:	96:dcWfq1YErjVeO6NNs9mHVgL9EdunfFDhK85obUBxltrV93PymGahzHKvowOIeayv:hfAjYgL6ufTiYhT5jzHKvoX0EJ
MD5:	79A946E9A11862465E31354FBB66A42D
SHA1:	BBDD4246902247B396B1754987AB1EB9698454A9
SHA-256:	7557CEEA1ED0F85B660D4C8560AA137EA95C14FD2D3F4476DAFE04359D29E831
SHA-512:	1C9B72E5F2F3F96814907B1860A442165C9234C17E9E8DF2246A0517D694DE01709307334D4322ACE7ECBF3DD5B8AB45C80A3B767758ADF94446DEBE4F2F26BA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import base64..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_str,.).from ..utils import (. int_or_none,. parse_iso8601,. smuggle_url,. unsmuggle_url,. urlencode_postdata,.)...class AWAANIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:awaan\|dcndigital)\.ae/(?:#/)?show/(?P<show_id>\d+)/[^/]+(?:/(?P<video_id>\d+)/(?P<season_id>\d+))?'.. def _real_extract(self, url):. show_id, video_id, season_id = re.match(self._VALID_URL, url).groups(). if video_id and int(video_id) > 0:. return self.url_result(. 'http://awaan.ae/media/%s' % video_id, 'AWAANVideo'). elif season_id and int(season_id) > 0:. return self.url_result(smuggle_url(. 'http://awaan.ae/program/season/%s' % season_id,. {'show_id': show_id}), 'AWAANSeason'). else:. return self.u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OQPI3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1811
Entropy (8bit):	4.663136901739167
Encrypted:	false
SSDEEP:	48:+uVddofZkL4XN2+ptffBdei0dHvExOB5q6jWBT01+6Ng:z0WLGo+XfTe1dHMxW53jWBT0Q6Ng
MD5:	17F32D325EEE655D1699FECE87B7D4EC
SHA1:	DA8146BD8E348F78DF41D9AA862B26925125E9A4
SHA-256:	52AC7512AA1DF3CCEFBAA32A2875091CC4BCFBD4CCF91E2085CE020CA63E2021
SHA-512:	F705442D6CD0FEB733BAFDAC4CA0835FA86A4E84FE4E5A91EC69C9A444613AF83348AD7A8D7EBC20E1D830F1B7D6BB301487A7132A3C4EB0C2AAC8478808C48B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random..from .common import InfoExtractor.from ..utils import xpath_text...class MatchTVIE(InfoExtractor):. _VALID_URL = r'https?://matchtv\.ru(?:/on-air\|/?#live-player)'. _TESTS = [{. 'url': 'http://matchtv.ru/#live-player',. 'info_dict': {. 'id': 'matchtv-live',. 'ext': 'flv',. 'title': r're:^.... .. - ...... .... \d{4}-\d{2}-\d{2} \d{2}:\d{2}$',. 'is_live': True,. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'http://matchtv.ru/on-air/',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = 'matchtv-live'. video_url = self._download_json(. 'http://player.matchtv.ntvplus.tv/player/smil', video_id,. query={. 'ts': '',. 'quality': 'SD',. 'contentId': '561d2c0df7159b37178b4567',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OQTLQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4530
Entropy (8bit):	4.750174778634872
Encrypted:	false
SSDEEP:	96:xdCpoNlZkbE83uiRvtfEuSuCLHZhBE16tbmmdKEKln2I7L+87Htd0E8s9fa:vCQlOleiRvNEuYZr4a
MD5:	6BF264E9096C9D7C2F1D17E20431FA3C
SHA1:	47AA17D0890C7FBE6E6B06BA00596AC15F571CEC
SHA-256:	60F77B11EFD9512FEE9025E291BA67DD51570EF81BBFEA0F6394B26E359D767A
SHA-512:	7F9886BE673E388A9FFEAAA5DEAE1B155540F85E1714C5077C21CE9E8241AA5971E3CD86A7C13AD845002AA81A8669B05C826B5E2DC2D64DE043E85B13C04DBE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. float_or_none,. get_element_by_id,. int_or_none,. strip_or_none,. unified_strdate,. urljoin,.)...class VidLiiIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vidlii\.com/(?:watch\|embed)\?.?\bv=(?P<id>[0-9A-Za-z_-]{11})'. _TESTS = [{. 'url': 'https://www.vidlii.com/watch?v=tJluaH4BJ3v',. 'md5': '9bf7d1e005dfa909b6efb0a1ff5175e2',. 'info_dict': {. 'id': 'tJluaH4BJ3v',. 'ext': 'mp4',. 'title': 'Vidlii is against me',. 'description': 'md5:fa3f119287a2bfb922623b52b1856145',. 'thumbnail': 're:https://..jpg',. 'uploader': 'APPle5auc31995',. 'uploader_url': 'https://www.vidlii.com/user/APPle5auc31995',. 'upload_date': '20171107',. 'duration': 212,. 'view_count': int,. 'comment_count': int,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ORBFA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18653
Entropy (8bit):	4.514561007533472
Encrypted:	false
SSDEEP:	384:hoKdqqsl0vr/HxaAY25NiFABGcEUlVevT5Y6NEYm++s:hjr/xaAY26FABEc4vT5Y8zd
MD5:	B4F1EA1AB44A601CBCC24F4EB4034520
SHA1:	9F04C374427A17FA5AE5C0823414CF4E2AF1935A
SHA-256:	646EF7B9FECE5A371F904C8C7CD8AED0D7B73DDCADFF0C51D2801D2F0449E80D
SHA-512:	BC773F8E162F528227B33F4CC88126730D66E865AE1EBA473C3CA0F9D62B1F1E58D7019D9FA3DC84FB7431B0019DCCDF3A35BFBE3BCAA4DBDA8204F03F883ADC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import collections.import json.import os.import random.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. dict_get,. ExtractorError,. float_or_none,. int_or_none,. parse_duration,. qualities,. srt_subtitles_timecode,. try_get,. update_url_query,. urlencode_postdata,.)...class PluralsightBaseIE(InfoExtractor):. _API_BASE = 'https://app.pluralsight.com'.. _GRAPHQL_EP = '%s/player/api/graphql' % _API_BASE. _GRAPHQL_HEADERS = {. 'Content-Type': 'application/json;charset=UTF-8',. }. _GRAPHQL_COURSE_TMPL = '''.query BootstrapPlayer {. rpc {. bootstrapPlayer {. profile {. firstName. lastName. email. username. userHandle. authed. isAuthed. plan. }. course(courseId: "%s") {. name. title. courseHasCaptions. translationLanguag

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OSF6C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5956
Entropy (8bit):	4.783178212128582
Encrypted:	false
SSDEEP:	96:Rhj1OVVnhTDwZBxrE9ijWnnp/fBfpydBiNrQihPXeidradeivZXDhKGolAnANhrs:RhmVpwugjWn/UdBrVqo7vyhmR69cWakw
MD5:	4C0F21A684A0A8286BEEA5DB2426A95B
SHA1:	A45C268FEB892AC78A3549FDBA7A0FB3DB547FFD
SHA-256:	0B409176ADBA50836BF7156E178E83E9EAE6DFB0C4CE92649E37A9905200FC45
SHA-512:	5266729E30405224FBFF2289F43347CF6C47471A049839CB33E7A1B1E17A44434477E0CB9460FD58B51B25B55AC6A5B6911697FDC66659C22086FBCFBABA53A8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import functools.import re..from .turner import TurnerBaseIE.from ..compat import (. compat_urllib_parse_urlencode,. compat_urlparse,.).from ..utils import (. OnDemandPagedList,. remove_start,.)...class NBAIE(TurnerBaseIE):. _VALID_URL = r'https?://(?:watch\.\|www\.)?nba\.com/(?P<path>(?:[^/]+/)+(?P<id>[^?]?))/?(?:/index\.html)?(?:\?.)?$'. _TESTS = [{. 'url': 'http://www.nba.com/video/games/nets/2012/12/04/0021200253-okc-bkn-recap.nba/index.html',. 'md5': '9e7729d3010a9c71506fd1248f74e4f4',. 'info_dict': {. 'id': '0021200253-okc-bkn-recap',. 'ext': 'mp4',. 'title': 'Thunder vs. Nets',. 'description': 'Kevin Durant scores 32 points and dishes out six assists as the Thunder beat the Nets in Brooklyn.',. 'duration': 181,. 'timestamp': 1354638466,. 'upload_date': '20121204',. },. 'params': {. # m3u8 download.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-OTDV2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9455
Entropy (8bit):	4.724941506838349
Encrypted:	false
SSDEEP:	192:wCkaW3uHnLyTxV6Nc8ORvLlz/5yEuVLVlW/gbMpxXY6eMtWwET46Ng:wCFW3uHLyTxV6NJOVBVyfV5lW/lpxofY
MD5:	4537BF43CC9A99FAA4EE0DCCD72B3E99
SHA1:	55B03B737381FF779AF0ADD22F8588478877CF0A
SHA-256:	62C35F617035D2F3D38D5F16980EDF41F6BAD18A67FF5E25805DDC31DA3A3A25
SHA-512:	57E2E9895227B7B3B96A4628EA2CC1BBB6C2DA421815B636964B37DF4C647724B60EC51A594700D5069382D8E3090919DD293E2D31EAA997676E683A9915E604
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. js_to_json,. qualities,. unified_strdate,. url_or_none,.)...class NovaEmbedIE(InfoExtractor):. _VALID_URL = r'https?://media\.cms\.nova\.cz/embed/(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'https://media.cms.nova.cz/embed/8o0n0r?autoplay=1',. 'md5': 'b3834f6de5401baabf31ed57456463f7',. 'info_dict': {. 'id': '8o0n0r',. 'ext': 'mp4',. 'title': '2180. d.l',. 'thumbnail': r're:^https?://.\.jpg',. 'duration': 2578,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. bitrates = self._parse_json(. self._search_regex(. r'(?s)(?:src\|bitrates)\s=\s({.+?})\s;', webpage, 'formats'),. video_id, transform_source=j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-P1DB1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15667
Entropy (8bit):	4.344719381179493
Encrypted:	false
SSDEEP:	192:27rGnQpOxv1ME8hOqeU3cci6N5/dXqBpyjrMnVDfnUl7YBfx8:27rGnQpOxv1p8h/e6c36N5cwrUxnUyJ8
MD5:	70B99D0040AF4C45D32A8CA1F2E752A3
SHA1:	F8E4A300C88149757333EEDF16E4A9AEFA5DE43B
SHA-256:	350891E80BF4316A9FC4A8364E35D124E1CF64F7090ACE5208E3AD2963B995E6
SHA-512:	9506BBDC9C428B023CA6A12D40EA989F41CCC16DADBF89BA1F6D77A185DBD598DF58A7BA88B535C29A52EA1D23D9426A939009288013242C67B3B5180ABA86A0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import itertools.import hashlib.import json.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_HTTPError,.).from ..utils import (. ExtractorError,. get_element_by_attribute,. int_or_none,. lowercase_escape,. std_headers,. try_get,. url_or_none,.)...class InstagramIE(InfoExtractor):. _VALID_URL = r'(?P<url>https?://(?:www\.)?instagram\.com/p/(?P<id>[^/?#&]+))'. _TESTS = [{. 'url': 'https://instagram.com/p/aye83DjauH/?foo=bar#abc',. 'md5': '0d2da106a9d2631273e192b372806516',. 'info_dict': {. 'id': 'aye83DjauH',. 'ext': 'mp4',. 'title': 'Video by naomipq',. 'description': 'md5:1f17f0ab29bd6fe2bfad705f58de3cb8',. 'thumbnail': r're:^https?://.*\.jpg',. 'timestamp': 1371748545,. 'upload_date': '20130620',. 'uploader_id': 'naomipq',. 'uploader': 'Naomi Leonor Phan-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-P3H27.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	4.5240925737168105
Encrypted:	false
SSDEEP:	96:Pn7y+PFuPfBRL8oDQLnH15RybnvZXEoetYAIIBTd6Nl:jZ0nBV8UQLnH15RQ3IYAIITd6Nl
MD5:	DAD576C0AE180C07C33C3A43E598C548
SHA1:	5861080A4BE91F620A18AAF4267209F50518B70E
SHA-256:	4B50A7EA4DE69EBBF2BDCBBD4B2FB847F28DCDCBDF255A034F013449F786DF15
SHA-512:	33B15BC16A005DEB8E8159BFB9691BFC2A1AFF3FCB0F9305A7CE10EC30405C1D64789A840B7B342F4953C07C3D248D5F0692649971F0CA05451140701D1EBC0E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. qualities,.)...class PandaTVIE(InfoExtractor):. IE_DESC = '..TV'. _VALID_URL = r'https?://(?:www\.)?panda\.tv/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.panda.tv/66666',. 'info_dict': {. 'id': '66666',. 'title': 're:.+',. 'uploader': '...',. 'ext': 'flv',. 'is_live': True,. },. 'params': {. 'skip_download': True,. },. 'skip': 'Live stream is offline',. }, {. 'url': 'https://www.panda.tv/66666',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. config = self._download_json(. 'https://www.panda.tv/api_room_v2?roomid=%s' % video_id, video_id).. error_code = config.get('errno', 0). if error_code != 0:. raise E

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-P3LVQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2639
Entropy (8bit):	4.906385449589408
Encrypted:	false
SSDEEP:	48:+ulLjXjlkeTB97Za3ZT6tTiPy6Fd7Yna7ChdL3NI9lJJhZln+u2A:hLqwBNCZ2tGPHXcaI53C9lJ/n+/A
MD5:	1AC690B6E52272DECB4EC22902385B70
SHA1:	7024577AFE6F010E6AD471EE7E949CB42A757D54
SHA-256:	60B83B1CA16A10380AB5EE4C450D3DE1BAA91CC13690D9B6A8BF958A47779578
SHA-512:	D7772EA7EE6B37E6BBC7BE7A2BC0521E4534EEA4258C339B8DEB740E09EFD2733A23E5884E5848034B385783FEB07861CF9582BD04D96BCCBD7A544C7066C603
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. extract_attributes,. smuggle_url,. strip_or_none,. urljoin,.)...class SkyBaseIE(InfoExtractor):. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). video_data = extract_attributes(self._search_regex(. r'(<div.+?class="[^"]sdc-article-video__media-ooyala[^"]"[^>]+>)',. webpage, 'video data')).. video_url = 'ooyala:%s' % video_data['data-video-id']. if video_data.get('data-token-required') == 'true':. token_fetch_options = self._parse_json(video_data.get(. 'data-token-fetch-options', '{}'), video_id, fatal=False) or {}. token_fetch_url = token_fetch_options.get('url'). if token_fetch_url:. embed_token = self._download_webpage(urljoin(. url, token_fetch_url), vide

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-P3QER.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1541
Entropy (8bit):	4.71562278640472
Encrypted:	false
SSDEEP:	48:PuLBjkMkbt0kWNUNcjXjWDakPU2IbMXqZHbzbS:etmuzqc1kPUDb1ZHX+
MD5:	F5BC1BDFA30D129C549DF01AF2D97DFC
SHA1:	D866995A2227DF1E31E48BE912DE187091FDAFE4
SHA-256:	5A73BF6621F3E29E25F1F00D4FD9D1DE2B2DDEF3D5E83419CC4FC401BC81518B
SHA-512:	CDCD07188B3839B775C6203F994BD1580A92A15DD7425098BC55196FD567CE0A637EBC19F4606C108D20CD7FF9D5CB7153568EB362765F130D70261B00C81371
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import random..from .common import InfoExtractor...class VideoPremiumIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?videopremium\.(?:tv\|me)/(?P<id>\w+)(?:/.)?'. _TEST = {. 'url': 'http://videopremium.tv/4w7oadjsf156',. 'info_dict': {. 'id': '4w7oadjsf156',. 'ext': 'f4v',. 'title': 'youtube-dl_test_video____a_________-BaW_jenozKc.mp4.mp4'. },. 'params': {. 'skip_download': True,. },. 'skip': 'Test file has been deleted.',. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage_url = 'http://videopremium.tv/' + video_id. webpage = self._download_webpage(webpage_url, video_id).. if re.match(r'^<html><head><script[^>]>window\.location\s*=', webpage):. # Download again, we need a cookie. webpage = self._download_webpage(. webpage_url, video_id,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-P47OU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3165
Entropy (8bit):	4.66239612647012
Encrypted:	false
SSDEEP:	48:Pu52nXKnfJJXbXeIBLuOfFIZ05V2gNBdv6hx11kU2f5Ygtp62G6kso6XGjVzNqz6:TsDzju5KjBShx1Sf6op6B6kxRjVzNqNM
MD5:	FA057466DFD3136D231BA9EB53CB4DD3
SHA1:	16C678D97E79FA05FF95599D4B8747999ECF5BB7
SHA-256:	27D2E1BF36E164D9BAA3429CC1EBD773C5C62B77C35580ABE47C8129C4F3917A
SHA-512:	179CCCDC71F176427B9E50A225E17E9612A2B2B3012EB0915E9F038465C6FD395EB4DDC7B2BC1D3CB0CC96393386B175CB4F9EA1DA23E3CBB95FA79998047528
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor...class NhkVodIE(InfoExtractor):. _VALID_URL = r'https?://www3\.nhk\.or\.jp/nhkworld/(?P<lang>[a-z]{2})/ondemand/(?P<type>video\|audio)/(?P<id>\d{7}\|[a-z]+-\d{8}-\d+)'. # Content available only for a limited period of time. Visit. # https://www3.nhk.or.jp/nhkworld/en/ondemand/ for working samples.. _TESTS = [{. 'url': 'https://www3.nhk.or.jp/nhkworld/en/ondemand/video/2015173/',. 'only_matching': True,. }, {. 'url': 'https://www3.nhk.or.jp/nhkworld/en/ondemand/audio/plugin-20190404-1/',. 'only_matching': True,. }, {. 'url': 'https://www3.nhk.or.jp/nhkworld/fr/ondemand/audio/plugin-20190404-1/',. 'only_matching': True,. }]. _API_URL_TEMPLATE = 'https://api.nhk.or.jp/nhkworld/%sodesdlist/v7/episode/%s/%s/all%s.json'.. def _real_extract(self, url):. lang, m_type, episode_id = re.match(self._VALID_URL, url).groups(). if epis

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-P5NOV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	4.391741304980828
Encrypted:	false
SSDEEP:	96:xOM3YGBoRR5YNrGXaJoHqkyjA8TdGCBzPiiC3xxoC3O0XlBT21McK+6N1tk:4M3YGBe5YECoHnyj/TdGCBzPiiCfoCNi
MD5:	6E4F74B76B584DD65EBB211C6D0E5203
SHA1:	19BBE8C1A542D4383AA1C9F9ECBAAEAC8B6C66DF
SHA-256:	64545916CF8DC4B73CCD5974A2FA797786ABF6C06869868A3EE555DDFEAA5283
SHA-512:	776CBCB67F8E4243B920151538AC38114CD6AF6F38E1BDB4729EA41A65994D40ED66C0CE1A9ACF1C963E6DD930C6B28BD4BC903C55AE5642310C1118D80E1891
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import (. determine_ext,. int_or_none,. xpath_text,.)...class InternetVideoArchiveIE(InfoExtractor):. _VALID_URL = r'https?://video\.internetvideoarchive\.net/(?:player\|flash/players)/.?\?.?publishedid.*?'.. _TEST = {. 'url': 'http://video.internetvideoarchive.net/player/6/configuration.ashx?customerid=69249&publishedid=194487&reporttag=vdbetatitle&playerid=641&autolist=0&domain=www.videodetective.com&maxrate=high&minrate=low&socialplayer=false',. 'info_dict': {. 'id': '194487',. 'ext': 'mp4',. 'title': 'KICK-ASS 2',. 'description': 'md5:c189d5b7280400630a1d3dd17eaa8d8a',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. @staticmethod. def _build_json_url(query):. return 'http://video.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-P6JTR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1997
Entropy (8bit):	4.683337692423292
Encrypted:	false
SSDEEP:	48:+upPBfm1VPjNTZmo6tfjXjIO8DcrzbxaafScsJefJBTp0T6Ng:ZJm3PJTZmoYf7si5/KjQfJBTp0T6Ng
MD5:	D5817ADCC2DBBB9BAFF58743BA78B5CF
SHA1:	09C02CB8F061EC8AA2A9CEBE79ECA778717D9E69
SHA-256:	2B18BC8C352C4310AC6A20A3D2C36898EFBF19127980AC2C78B77BFBEF7F119A
SHA-512:	E503BA0E4C44FFC44D6F16F80CDC10114DA4EB47769080EA79E181FA36249E3200AB38E7FA1DE5A96FDDC3180CD3019AA9CE2C534DBCBD1744E3C26995CBE668
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. unified_strdate,. xpath_text,.)...class CinchcastIE(InfoExtractor):. _VALID_URL = r'https?://player\.cinchcast\.com/.*?(?:assetId\|show_id)=(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://player.cinchcast.com/?show_id=5258197&platformId=1&assetType=single',. 'info_dict': {. 'id': '5258197',. 'ext': 'mp3',. 'title': 'Train Your Brain to Up Your Game with Coach Mandy',. 'upload_date': '20130816',. },. }, {. # Actual test is run in generic, look for undergroundwellness. 'url': 'http://player.cinchcast.com/?platformId=1&assetType=single&assetId=7141703',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). doc = self._download_xml(. 'http://www.blogtalkradio.com/playerasset/mrss?assetType=single&assetId

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PB6K8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3000
Entropy (8bit):	4.520262114834362
Encrypted:	false
SSDEEP:	48:+um0paBXSFBK4FndT3t8cyJznjXjMBsVPbk9RsdmUFKNpmkT1O13kLBTNRKdNqVL:LQBXSFBdFndT98cyFtjk9Rsd/K+kJO1G
MD5:	025BA72CF2FEF36AD11D90559FDAD049
SHA1:	9038BEA678E86B53A3D4EC2542123496F17BD742
SHA-256:	E50600D2B16DC991B8185575F3D5F45838E1C5468B9B841D6EF0B2CECB7151EA
SHA-512:	5681AF4BFE1DA0F5780BC18EE4AA68E9299086D1FB0A13FD32277EEFFE40D1D78C67A9F7E1E57DEB7572D3B4CF358A4897EB3276070D08F4D7B7DACFCFEA5D84
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. float_or_none,. unified_timestamp,. url_or_none,.)...class VzaarIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\|view)\.)?vzaar\.com/(?:videos/)?(?P<id>\d+)'. _TESTS = [{. # HTTP and HLS. 'url': 'https://vzaar.com/videos/1152805',. 'md5': 'bde5ddfeb104a6c56a93a06b04901dbf',. 'info_dict': {. 'id': '1152805',. 'ext': 'mp4',. 'title': 'sample video (public)',. },. }, {. 'url': 'https://view.vzaar.com/27272/player',. 'md5': '3b50012ac9bbce7f445550d54e0508f2',. 'info_dict': {. 'id': '27272',. 'ext': 'mp3',. 'title': 'MP3',. },. }, {. # with null videoTitle. 'url': 'https://view.vzaar.com/20313539/download',. 'only_matching': True,. }].. @sta

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PBLOE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2084
Entropy (8bit):	5.106347235184866
Encrypted:	false
SSDEEP:	48:+ut+IPf8GFnZkrsZcvWXjX1atfjXhMkdBw2imvYwG0VCeVU5qG4bkYhBTSAt46Ng:RhH8GFnOoZcv+L14ftHvN4Hd4b7hBTNu
MD5:	F2769A6EF6B9CACC22287D13399D1CBA
SHA1:	EECE33F63C9B08B71D8EBC6C466997B5575561CE
SHA-256:	49A876A4A3E6F8B7E90D786F91CFDB3B20A4CB41B45628CA140A254ECCFF7B9A
SHA-512:	A3A07C5C90E21C6776EEF416E36527A51AF7A2E452DC7BF7088222BD6F642654FC007442F43579F76A1BE987EB80517B4906F0080F550807725B5F7E080A21AD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class ServusIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?servus\.com/(?:(?:at\|de)/p/[^/]+\|tv/videos)/(?P<id>[aA]{2}-\w+\|\d+-\d+)'. _TESTS = [{. 'url': 'https://www.servus.com/de/p/Die-Gr%C3%BCnen-aus-Sicht-des-Volkes/AA-1T6VBU5PW1W12/',. 'md5': '3e1dd16775aa8d5cbef23628cfffc1f4',. 'info_dict': {. 'id': 'AA-1T6VBU5PW1W12',. 'ext': 'mp4',. 'title': 'Die Gr.nen aus Sicht des Volkes',. 'description': 'md5:1247204d85783afe3682644398ff2ec4',. 'thumbnail': r're:^https?://.*\.jpg',. }. }, {. 'url': 'https://www.servus.com/at/p/Wie-das-Leben-beginnt/1309984137314-381415152/',. 'only_matching': True,. }, {. 'url': 'https://www.servus.com/tv/videos/aa-1t6vbu5pw1w12/',. 'only_matching': True,. }, {. 'url': 'https://www.servus.com/tv/videos/1380889096408-1

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PBT7D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8006
Entropy (8bit):	4.580622102732138
Encrypted:	false
SSDEEP:	192:0JFjtgqvKK5/77mS3FMxFY/ih9nb/w0RMPdt3nTiE6N+V:Urg6KY/7CS3FMjY/S9nb/w0RMPdtXTiw
MD5:	99FD477062CFC66ED1763CA3444F93F2
SHA1:	F9440B7721A2B7748D8324A1A513DA3447418857
SHA-256:	7FF4AF6C01429896AF255BB4AFC8B6B6D0E7ED58B23E7B7EDCFC0CF4B8D5AD93
SHA-512:	2ADBF73029913E3E34FB6451AA7B9C97FB5B700BF89E62B2ABDE5BCDF118931CD4BA6F0F703E056F14D652DE7DBCC0A103BD0260F141CD68290D09CE7524AC19
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. extract_attributes,. find_xpath_attr,. get_element_by_class,. int_or_none,. smuggle_url,. unescapeHTML,.).from .senateisvp import SenateISVPIE.from .ustream import UstreamIE...class CSpanIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?c-span\.org/video/\?(?P<id>[0-9a-f]+)'. IE_DESC = 'C-SPAN'. _TESTS = [{. 'url': 'http://www.c-span.org/video/?313572-1/HolderonV',. 'md5': '94b29a4f131ff03d23471dd6f60b6a1d',. 'info_dict': {. 'id': '315139',. 'title': 'Attorney General Eric Holder on Voting Rights Act Decision',. },. 'playlist_mincount': 2,. 'skip': 'Regularly fails on travis, for unknown reasons',. }, {. 'url': 'http://www.c-span.org/video/?c4486943/cspan-international-health-care-models',. # md5 is unstable. 'info_dict': {

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PEDT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9148
Entropy (8bit):	4.270465256107691
Encrypted:	false
SSDEEP:	192:pUpQ20ueyuv7wvu7a0LTCsJuxmCfooBYt7BiyShPZivezUTS6Nam+:S/0ueV7Mu7a0LTCwuxrocYt7BiykUTSx
MD5:	6DB9C2B2221B7AB4206A921E419F07AB
SHA1:	DA295DDBA0C3E66ABB9376618FC970582B2F3EF5
SHA-256:	CE5F7ED0736155E254FF2D6ADA72BD012B6CD0F50AD8AFDA1878F382255DFB17
SHA-512:	8E84A8601613B8F37123419C2CD9EC26F10E76ECB28D461DC49A972B9C019DBB7A0EB6A1D9D5B07BA2B1DA46E4D77CE1C9EEDAB696A819673B65C02E73F446DF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. remove_end,.)...class NFLIE(InfoExtractor):. IE_NAME = 'nfl.com'. _VALID_URL = r'''(?x). https?://. (?P<host>. (?:www\.)?. (?:. (?:. nfl\|. buffalobills\|. miamidolphins\|. patriots\|. newyorkjets\|. baltimoreravens\|. bengals\|. clevelandbrowns\|. steelers\|. houstontexans\|.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PEO6S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7543
Entropy (8bit):	4.801142161586214
Encrypted:	false
SSDEEP:	192:5kHpd7WluTRPzedqSBHjdyLx/CEKT96NbRMTtA1ij49Rc7qLd8t+UUYTCl6N4:5kHpd6QdzeoKS6T96NbR6tE2WK7qLd8w
MD5:	C425A499922ECC1EE7A715D24474EEFD
SHA1:	E77B2FABF793E8AEAC573911EFBC82D9E058017C
SHA-256:	32EEF9675CFE17C27903B85C5BC461543BC3D00ADB88F9B2020582F0E978542C
SHA-512:	C8B6C368F8E65BED118DAD5C7FA7094E8713F7B17165A3B1D93B1B4BE7B5CF69109ED5F58B8ACEDCD34CFEB115F9DCEA43C63914E348DBB26D2B59C39A358072
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import hashlib.import hmac.import re.import time..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. js_to_json,. int_or_none,. parse_iso8601,. try_get,. unescapeHTML,. update_url_query,.)...class ABCIE(InfoExtractor):. IE_NAME = 'abc.net.au'. _VALID_URL = r'https?://(?:www\.)?abc\.net\.au/news/(?:[^/]+/){1,2}(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.abc.net.au/news/2014-11-05/australia-to-staff-ebola-treatment-centre-in-sierra-leone/5868334',. 'md5': 'cb3dd03b18455a661071ee1e28344d9f',. 'info_dict': {. 'id': '5868334',. 'ext': 'mp4',. 'title': 'Australia to help staff Ebola treatment centre in Sierra Leone',. 'description': 'md5:809ad29c67a05f54eb41f2a105693a67',. },. 'skip': 'this video has expired',. }, {. 'url': 'http://www.abc.net.au/news/2015-08-17/warren-entsch-i

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PFHFI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	4.610669936549896
Encrypted:	false
SSDEEP:	24:zi8l40vg4GQw1V/5dlBQI5d210RMWyltWNlQSk3XMIFOwDEojaBhhlBvQ:+u4r4zQ59QIrI0RM8cr3XMuOUE/lvQ
MD5:	413A3146E224762FDA2729C26D66C003
SHA1:	9F6F4B88F1B7CC5A06254277CDC9F6B23D296F0A
SHA-256:	BCECFD0E68CEA35964AFCD8771462706D8413F8F4C4CD6D77D95A8BD10CBB8D6
SHA-512:	75E8CFA9DCB5E31485C2BC6A1DAE1FE4A5D36704229EAB619F211F479D898BC36193FA8A0013487C0E3295718FAF0503557422C96FB82E46B6F85646BB104087
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import datetime..from .common import InfoExtractor...class NerdCubedFeedIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nerdcubed\.co\.uk/feed\.json'. _TEST = {. 'url': 'http://www.nerdcubed.co.uk/feed.json',. 'info_dict': {. 'id': 'nerdcubed-feed',. 'title': 'nerdcubed.co.uk feed',. },. 'playlist_mincount': 1300,. }.. def _real_extract(self, url):. feed = self._download_json(url, url, 'Downloading NerdCubed JSON feed').. entries = [{. '_type': 'url',. 'title': feed_entry['title'],. 'uploader': feed_entry['source']['name'] if feed_entry['source'] else None,. 'upload_date': datetime.datetime.strptime(feed_entry['date'], '%Y-%m-%d').strftime('%Y%m%d'),. 'url': 'http://www.youtube.com/watch?v=' + feed_entry['youtube_id'],. } for feed_entry in feed].. return {. '_type': 'pla

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PFNVH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1980
Entropy (8bit):	5.095679547382841
Encrypted:	false
SSDEEP:	48:+uBLC27lr9CfbkKm4LmXb0nX3Di4IZSCUfj6vUWfBVUqfFId09cDUT/HYmEItUBN:xCglOQKdLmX4nX3Di4IZSCUfjiUWfBV8
MD5:	F38BE1366B996DA5D4B79ADD08889F49
SHA1:	09F75C71E8693C946C82EC69D05464868E997A78
SHA-256:	7432657DB77148703996CF7C85EBDB36CBC0978F44B88D08975356DA7C215268
SHA-512:	9CE0D64F9099D500D02577DE0994510FC6CD4A9D74D9B4C496D0D0E4AD00C2168974E52B12B9A7136289AB0246218FF6ADE4B957375FF9EA8C8DC9E89A3C8CC0
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import unescapeHTML...class BaiduVideoIE(InfoExtractor):. IE_DESC = '....'. _VALID_URL = r'https?://v\.baidu\.com/(?P<type>[a-z]+)/(?P<id>\d+)\.htm'. _TESTS = [{. 'url': 'http://v.baidu.com/comic/1069.htm?frp=bdbrand&q=%E4%B8%AD%E5%8D%8E%E5%B0%8F%E5%BD%93%E5%AE%B6',. 'info_dict': {. 'id': '1069',. 'title': '..... TV...',. 'description': 'md5:51be07afe461cf99fa61231421b5397c',. },. 'playlist_count': 52,. }, {. 'url': 'http://v.baidu.com/show/11595.htm?frp=bdbrand',. 'info_dict': {. 'id': '11595',. 'title': 're:^.....',. 'description': 'md5:1bf88bad6d850930f542d51547c089b8',. },. 'playlist_mincount': 12,. }].. def _call_api(self, path, category, playlist_id, note):. return self._download_json('htt

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PG139.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	4.648788383174453
Encrypted:	false
SSDEEP:	48:Puo/3euxfRU0voPdXNUkxUgtM1NjXhCqevw+/HAdBX1ouGBJ+71etW4O1cKBTv1H:nvnu0vQVOGg4Jw+/HW1SBJtRO1cKBTvt
MD5:	6D437E6569CF5D345CCFE318B7B65C13
SHA1:	663B4507B7871B88E00EC416031BA6EC2A8A6C3D
SHA-256:	EAEAC2DACDBF38B1E18A8BE7A1F013907FF7219446404C1A27D489C02EADD0C6
SHA-512:	A4FBDEB1773331A064DC934A50C347402168923F0D5C4417B1CEF2D67D1244141F6E4439282C4078C3234C8E585B94BC44D19A10DEAF8E79958F0269A5025B8E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import ExtractorError...class ChaturbateIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?chaturbate\.com/(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'https://www.chaturbate.com/siswet19/',. 'info_dict': {. 'id': 'siswet19',. 'ext': 'mp4',. 'title': 're:^siswet19 [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'age_limit': 18,. 'is_live': True,. },. 'params': {. 'skip_download': True,. },. 'skip': 'Room is offline',. }, {. 'url': 'https://en.chaturbate.com/siswet19/',. 'only_matching': True,. }].. _ROOM_OFFLINE = 'Room is currently offline'.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(. url, video_id, headers=self.geo_verification_headers()).. m3u8_urls = []..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PG89R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	4.997003272421197
Encrypted:	false
SSDEEP:	48:+uSsjEcBOmpNgajXjlkQX5GXBWXCXn3NeXKiZsoAAtc:maEcBOmpNgaqGYQI3NJiZsoHtc
MD5:	A0058CAA32D7A7D4F05F24D034553791
SHA1:	02CD3BD624DF337D1B60F4F4B92B994030822CC7
SHA-256:	95D1D40428F3E6106415111BE871E091867B880D2C6E52C1D4EC491CFFA7F880
SHA-512:	D4C36DD9C96FDB893C96C99610BE483FB96FE1E883D237531E809C4423DF5EE08846A61D6BE23071FDA4590FFFE045CDAC786BCF24C050811E819334918E4BAF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class RUHDIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ruhd\.ru/play\.php\?vid=(?P<id>\d+)'. _TEST = {. 'url': 'http://www.ruhd.ru/play.php?vid=207',. 'md5': 'd1a9ec4edf8598e3fbd92bb16072ba83',. 'info_dict': {. 'id': '207',. 'ext': 'divx',. 'title': '... .......',. 'description': '........ ...)',. 'thumbnail': r're:^http://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. video_url = self._html_search_regex(. r'<param name="src" value="([^"]+)"', webpage, 'video url'). title = self._html_search_regex(. r'<title>([^<]+)   RUHD\.ru - ..... ........ ........ .1 . ......!</title>',. webpage, 'tit

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PKNQT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	4.920435633156532
Encrypted:	false
SSDEEP:	48:+uqsgh7fbnsyN/irD12bnoXbnlXmOXXbnstfjXh3nybXn3t3rNAi1NGLuHPO7FpQ:/ghjRNqrEoVjnmf0Td3rNjNGh4Sk
MD5:	9C9B1DA417E2B5093ABB8CA2D2DB5E92
SHA1:	116076F49BE8EA3985954BC313E847B845768693
SHA-256:	6F0287B0421FF8AC2F5C4EAD52EA9671D9CE8171AE6361338678CB3F853BD72B
SHA-512:	AFB4A2426484B3E698AF0ADBC548F69991B8FE300C06F2039858253D1A934E513E5EE04956ED2113258906304347884E422509E23B98A8A81E71394939B6144A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. decode_packed_codes,. js_to_json,. NO_DEFAULT,. PACKED_CODES_RE,.)...class VidziIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vidzi\.(?:tv\|cc\|si\|nu)/(?:embed-)?(?P<id>[0-9a-zA-Z]+)'. _TESTS = [{. 'url': 'http://vidzi.tv/cghql9yq6emu.html',. 'md5': '4f16c71ca0c8c8635ab6932b5f3f1660',. 'info_dict': {. 'id': 'cghql9yq6emu',. 'ext': 'mp4',. 'title': 'youtube-dl test video 1\\\\2\'3/4<5\\\\6.7.',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }, {. 'url': 'http://vidzi.tv/embed-4z2yb0rzphe9-600x338.html',. 'only_matching': True,. }, {. 'url': 'http://vidzi.cc/cghql9yq6emu.html',. 'only_matching': True,. }, {. 'url': 'https://vidzi.si/rph9gztxj1et.html',. 'only_matching': True,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PMOFB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (334)
Category:	dropped
Size (bytes):	8753
Entropy (8bit):	4.654158190222714
Encrypted:	false
SSDEEP:	192:obGSBvMwJTbOwiyToLfje4rTKd6NnW3Fwvdo4dWF1WUYIqErJvAkQEkpE:PSBvMwxOwiyToLfje4rTW6NnmFkdo4dS
MD5:	15C6C0024E40A62BB1655675080ED082
SHA1:	097801B10049D49BBCF11CDE06D301A579C77EC0
SHA-256:	53D23C4C7AA1B1B57380ADBF76A8D74BED9B8DACF5FADF51379D65E4E0C79B7A
SHA-512:	2902A05D56B08F13C466AB30B2474C464161762C245CD6C652550DF6C2C000BE2E680B839955E737E3A63D2D2B85DB10DE7423D23A73CB72E437F43F2FBE92A6
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_str,. compat_urllib_parse_urlencode,.).from ..utils import (. determine_ext,. ExtractorError,. float_or_none,. int_or_none,. try_get,. unsmuggle_url,.)...class OoyalaBaseIE(InfoExtractor):. _PLAYER_BASE = 'http://player.ooyala.com/'. _CONTENT_TREE_BASE = _PLAYER_BASE + 'player_api/v1/content_tree/'. _AUTHORIZATION_URL_TEMPLATE = _PLAYER_BASE + 'sas/player_api/v2/authorization/embed_code/%s/%s?'.. def _extract(self, content_tree_url, video_id, domain='example.org', supportedformats=None, embed_token=None):. content_tree = self._download_json(content_tree_url, video_id)['content_tree']. metadata = content_tree[list(content_tree)[0]]. embed_code = metadata['embed_code']. pcode = metadata.get('asset_pcode') or embed_code. title = metadata['title'].. auth_data = self._download_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PO3VF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5984
Entropy (8bit):	4.445534430518342
Encrypted:	false
SSDEEP:	96:AUfRzh96fK5WcBHvMYlaUD66OFf7/XBGkz9SLBrBTnnw16NkxdTNpdjYmIu0flMz:AYh96yz3laUDXOFbX0ddTnc6NkP1tiW
MD5:	9FCC363E2741B942C0D1EE6F63A9FFB8
SHA1:	80D553DF5BBB4739A0C37832976567612689644A
SHA-256:	8D099743248ECEF376DFF46E30F87145664F267DEAA75BD5D7D4CFE2D37E6E60
SHA-512:	8C91E1A9FFB1AB7E79977043CDE52AD4938F329426AAE0FC93567D5CE34C91BEF6E14ACFF02D89D201D5DA2C264C1F38F5DC8DA7B226A66A2E4D0DD72E72EA02
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. urlencode_postdata,. compat_str,. ExtractorError,.)...class CuriosityStreamBaseIE(InfoExtractor):. _NETRC_MACHINE = 'curiositystream'. _auth_token = None. _API_BASE_URL = 'https://api.curiositystream.com/v1/'.. def _handle_errors(self, result):. error = result.get('error', {}).get('message'). if error:. if isinstance(error, dict):. error = ', '.join(error.values()). raise ExtractorError(. '%s said: %s' % (self.IE_NAME, error), expected=True).. def _call_api(self, path, video_id):. headers = {}. if self._auth_token:. headers['X-Auth-Token'] = self._auth_token. result = self._download_json(. self._API_BASE_URL + path, video_id, headers=headers). self._handle_errors(result). return result['data'].. def

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-POBBF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5121
Entropy (8bit):	5.121295724424904
Encrypted:	false
SSDEEP:	96:h+fTLRaSu7aSunp6pnKSSsSHpSNQppkC1pp/vu5dpogGaaeyNyQWK5Nl9jYe/4PV:sf/RaSu7aSukpKF7cSMEn2TGaizD74PV
MD5:	D9D96C1D6ABA579BC0ADB7D7E1469ABC
SHA1:	0367879AE6260FB00385EE4008DFC405D20A5875
SHA-256:	524AB562A1A7E83DF172E26181B9F7492B3863E51EC012537E0F130B067B22C9
SHA-512:	6AFBAE05BF0D08CE7670BF9B1F2554728AE5FC21F2F154CE0CEF6E1A192625885003F0CC3AC901922E5C1EA69C0A6EC5576DFD3D13BD0906F01EBDFAB8EBDE32
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. xpath_text,. int_or_none,.)...class NTVRuIE(InfoExtractor):. IE_NAME = 'ntv.ru'. _VALID_URL = r'https?://(?:www\.)?ntv\.ru/(?:[^/]+/)(?P<id>[^/?#&]+)'.. _TESTS = [{. 'url': 'http://www.ntv.ru/novosti/863142/',. 'md5': 'ba7ea172a91cb83eb734cad18c10e723',. 'info_dict': {. 'id': '746000',. 'ext': 'mp4',. 'title': '........... ............ ...... ...... .......... . ..... ... .......',. 'description': '........... ............ ...... ...... .......... . ..... ... .......',. 'thumbnail': r're:^http://.\.jpg',. 'duration': 136,. },. }, {. 'url': 'http://www.ntv.ru/video/novosti/750370/',. 'md5': 'adecff79691b4d71e25220

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-PTA4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19499
Entropy (8bit):	5.448040671968066
Encrypted:	false
SSDEEP:	384:6oV1u++L0Q+SRwY3mZalD+TR9Pm0i3elEGBOl1LTs6N+FP+I6E:tUKYCgCR9Pm0i3elE+Ol1LTs8+FP+I6E
MD5:	9AF7AB0695C38BD19C3EE44E10163665
SHA1:	49A2F7DE51F372FFBA6E99354A9EB7FFEA43BBB8
SHA-256:	EBA5F0C1E66A087AD67E05199C7D0696409467F07DF219E20D689FF0A1A22942
SHA-512:	150DE89B944AFBB13A27179559BB478F09A2C07B32BDF798CB6F2ECF668EDD99642AEE9EC8AF6D147A9E209FF51E0CA402420E8ADF1A141BA559B338EE357710
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import hashlib.import json.import random.import re.import time..from .common import InfoExtractor.from ..aes import aes_encrypt.from ..compat import compat_str.from ..utils import (. bytes_to_intlist,. determine_ext,. intlist_to_bytes,. int_or_none,. strip_jsonp,. unescapeHTML,. unsmuggle_url,.)...def md5_text(s):. if not isinstance(s, compat_str):. s = compat_str(s). return hashlib.md5(s.encode('utf-8')).hexdigest()...class AnvatoIE(InfoExtractor):. _VALID_URL = r'anvato:(?P<access_key_or_mcp>[^:]+):(?P<id>\d+)'.. # Copied from anvplayer.min.js. _ANVACK_TABLE = {. 'nbcu_nbcd_desktop_web_prod_93d8ead38ce2024f8f544b78306fbd15895ae5e6': 'NNemUkySjxLyPTKvZRiGntBIjEyK8uqicjMakIaQ',. 'nbcu_nbcd_desktop_web_qa_1a6f01bdd0dc45a439043b694c8a031d': 'eSxJUbA2UUKBTXryyQ2d6NuM8oEqaPySvaPzfKNA',. 'nbcu_nbcd_desktop_web_acc_eb2ff240a5d4ae9a63d4c297c32716b6c523a129': '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-Q2A4D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7202
Entropy (8bit):	4.756900344121029
Encrypted:	false
SSDEEP:	192:BJC0raUiVvv7JZDJW7ndPtYYAdMNvTnV6NeSJlXLHNKxU:/xiVvTPD87n7FAdCTnV6NeSJX0U
MD5:	AFCFD96714B49010F960CAE924D2921F
SHA1:	EC73B3975CFF387CAC1FB564584D1A5F2D7C41CF
SHA-256:	14B095D3AB3F27C604236A8913EB5369AA6DEE42D772631EE7158256A9CACD20
SHA-512:	987FFA4DE6D51874573DA29CFBDDB90CED42893963BB48E1C3D6234B466773F7603BCF2DD10D2D9492F963687FABB7D253BC9D36383FE500D92211928669ED35
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. clean_html,. ExtractorError,. int_or_none,. parse_age_limit,. sanitized_Request,. try_get,.)...class HRTiBaseIE(InfoExtractor):. """. Base Information Extractor for Croatian Radiotelevision. video on demand site https://hrti.hrt.hr. Reverse engineered from the JavaScript app in app.min.js. """. _NETRC_MACHINE = 'hrti'.. _APP_LANGUAGE = 'hr'. _APP_VERSION = '1.1'. _APP_PUBLICATION_ID = 'all_in_one'. _API_URL = 'http://clientapi.hrt.hr/client_api.php/config/identify/format/json'.. def _initialize_api(self):. init_data = {. 'application_publication_id': self._APP_PUBLICATION_ID. }.. uuid = self._download_json(. self._API_URL, None, note='Downloading uuid',. errnote='Unable to download uuid',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-Q488T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8064
Entropy (8bit):	4.630708339153749
Encrypted:	false
SSDEEP:	192:pZx/bGGgN9XMPdyscwkmAwl3ZIi/G4etXu8/TRbONbykNTiV6Ng:7ZqGg3MPdysTkmAwl3ZnOFF/hON9NTi5
MD5:	A9BEC20982649567C70F766B8092FB57
SHA1:	90F971CC0EBB4158574096433CF7A9A6D2498ECE
SHA-256:	609CF6ABC4AC8E243CBD71A7B8045A3D91D10695D60D75C7C69B285147C7BA1D
SHA-512:	04A1377A28EA47ED1C2F0D51969B8AE4A84B2FAE3D9FF1E9F3201E5534869FF3F5CB2B8DCC428F219A6E89A68C4AF20AF83C618266A0449C957CB9712128F430
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none.)...class RUTVIE(InfoExtractor):. IE_DESC = 'RUTV.RU'. _VALID_URL = r'''(?x). https?://. (?:test)?player\.(?:rutv\.ru\|vgtrk\.com)/. (?P<path>. flash\d+v/container\.swf\?id=\|. iframe/(?P<type>swf\|video\|live)/id/\|. index/iframe/cast_id/. ). (?P<id>\d+). '''.. _TESTS = [. {. 'url': 'http://player.rutv.ru/flash2v/container.swf?id=774471&sid=kultura&fbv=true&isPlay=true&ssl=false&i=560&acc_video_id=episode_id/972347/video_id/978186/brand_id/31724',. 'info_dict': {. 'id': '774471',. 'ext': 'mp4',. 'title': '........ .. ... .....

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-Q5PN4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	4.911064433547342
Encrypted:	false
SSDEEP:	48:+uTxKNo3fg4OPZjib29XKvOctfdfFklkbXVfXt0leXWAXRUQjtOb:3xEQgRRjy29XKvOSftZl0lzHQjtk
MD5:	4F80D2438B99B19D1745DCB9C3078945
SHA1:	0B4BCE963326F943854549EE4C741E19DF81F6BF
SHA-256:	125BBEF8284DF14E3A524FE2A0D019CE6D9E80AC9A8E15539BA8FE7507EF0DF2
SHA-512:	FB38F86189FA6B8340BBB751DECD4CBFA1891E394E0F4269B19C201B3AB7A8E14BF4F363B75F2EB4A47ED4A727A2387A7246347856E8FA190462A6233D7D2E02
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class MorningstarIE(InfoExtractor):. IE_DESC = 'morningstar.com'. _VALID_URL = r'https?://(?:(?:www\|news)\.)morningstar\.com/[cC]over/video[cC]enter\.aspx\?id=(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.morningstar.com/cover/videocenter.aspx?id=615869',. 'md5': '6c0acface7a787aadc8391e4bbf7b0f5',. 'info_dict': {. 'id': '615869',. 'ext': 'mp4',. 'title': 'Get Ahead of the Curve on 2013 Taxes',. 'description': "Vanguard's Joel Dickson on managing higher tax rates for high-income earners and fund capital-gain distributions in 2013.",. 'thumbnail': r're:^https?://.*m(?:orning)?star\.com/.+thumb\.jpg$'. }. }, {. 'url': 'http://news.morningstar.com/cover/videocenter.aspx?id=825556',. 'only_matching': True,. }].. def _real_extract(self, url):. mobj = re.match(self._

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-Q6ICU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3123
Entropy (8bit):	4.889432053044251
Encrypted:	false
SSDEEP:	96:5YAysGibzUqaJAxdq3LgGNUOz7B4YDQeTQ6BTUXbWS/E3b6Ng:5vysvQqt6LReOnmYDQeTQOTj6Ng
MD5:	AD1A52C84CCDCD31D49932FE296BC1FA
SHA1:	CEA4F9F691D9953F4C602C4863EC06D6B754B0B9
SHA-256:	3059D1EBA605B89866466B20C68C684169BB0EB36C0BEEE4AC91F343B2197D0D
SHA-512:	2711313D6D89F700E5B421B0FA63D2E75AEDD26FA4298D537FB0672F06145053D5D3B01A0A669CAA108B092E2E6B9F399B2D7112B360348DA582DAA5BD8AB5D6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import hashlib..from .common import InfoExtractor.from ..aes import aes_cbc_decrypt.from ..utils import (. bytes_to_intlist,. int_or_none,. intlist_to_bytes,. parse_codecs,. parse_duration,.)...class NewstubeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?newstube\.ru/media/(?P<id>.+)'. _TEST = {. 'url': 'http://www.newstube.ru/media/telekanal-cnn-peremestil-gorod-slavyansk-v-krym',. 'md5': '9d10320ad473444352f72f746ccb8b8c',. 'info_dict': {. 'id': '728e0ef2-e187-4012-bac0-5a081fdcb1f6',. 'ext': 'mp4',. 'title': '......... CNN .......... ..... ........ . ....',. 'description': 'md5:419a8c9f03442bc0b0a794d689360335',. 'duration': 31.05,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. page = self._download_webpage(url, video_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-Q776V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3154
Entropy (8bit):	4.680936526461476
Encrypted:	false
SSDEEP:	96:pdcddtTvopjXKat7aPJg3JAP6Q7ALVu0PfmAY38MtZ90:bwd9vopWaF7PLVcMN
MD5:	F9CDED50A8497C9495B38ACE88B00C55
SHA1:	5020202727C0A3237D7798C850DD534D0CD9B159
SHA-256:	0E664DE490EC3C67B872889F382102D309C546411DE3FC6FBD527DF43FFDD6CF
SHA-512:	AEF0B7A5DFFF42F451DFBAA95D191C475BD8028E27371BB84A347D517A0F0893D4AEAFCA493B7058535758FED8A40C13BBC732AE270C57DF1E9ED2D0A1A7D366
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import int_or_none...class PornotubeIE(InfoExtractor):. _VALID_URL = r'https?://(?:\w+\.)?pornotube\.com/(?:[^?#]?)/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.pornotube.com/orientation/straight/video/4964/title/weird-hot-and-wet-science',. 'md5': '60fc5a4f0d93a97968fc7999d98260c9',. 'info_dict': {. 'id': '4964',. 'ext': 'mp4',. 'upload_date': '20141203',. 'title': 'Weird Hot and Wet Science',. 'description': 'md5:a8304bef7ef06cb4ab476ca6029b01b0',. 'categories': ['Adult Humor', 'Blondes'],. 'uploader': 'Alpha Blue Archives',. 'thumbnail': r're:^https?://.\.jpg$',. 'timestamp': 1417582800,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. token = self._download_json(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-Q8RV5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3380
Entropy (8bit):	4.748002678495213
Encrypted:	false
SSDEEP:	96:xUVGAanscu3b6gpKNvD6al9lDtf2VRr6OpWTZ3PuOp+BTY6Ng:xUVMOb6cOvDTNN2VRrJITRmOpKTY6Ng
MD5:	0081D01ECEE93B46B39AE54A8DE4AD22
SHA1:	89214D1EB76898E6745B91B100F88F0CA7D1AD30
SHA-256:	EDE0BC0ED41091C48FC0CEAA4298396FE3F7A528E1FB4F418AD2A36FC2983F51
SHA-512:	7FD1FACED2A7A6FAB4B6C5C84AB3FC47DE12097D4405C1C77220A4545CD0C144D25D456F53E17A964DE9A9FDCC1093A6FE55BF066A86175E3C4DA54B0B3035B3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urllib_parse_urlparse.from ..utils import (. int_or_none,. mimetype2ext,. remove_end,. url_or_none,.)...class IwaraIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.\|ecchi\.)?iwara\.tv/videos/(?P<id>[a-zA-Z0-9]+)'. _TESTS = [{. 'url': 'http://iwara.tv/videos/amVwUl1EHpAD9RD',. # md5 is unstable. 'info_dict': {. 'id': 'amVwUl1EHpAD9RD',. 'ext': 'mp4',. 'title': '.MMD R-18........ carry_me_off',. 'age_limit': 18,. },. }, {. 'url': 'http://ecchi.iwara.tv/videos/Vb4yf2yZspkzkBO',. 'md5': '7e5f1f359cd51a027ba4a7b7710a50f0',. 'info_dict': {. 'id': '0B1LvuHnL-sRFNXB1WHNqbGw4SXc',. 'ext': 'mp4',. 'title': '[3D Hentai] Kyonyu . Genkai . Emaki Shinobi Girls.mp4',. 'age_limit': 18,. },. 'a

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-Q96DC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2623
Entropy (8bit):	4.618177012104108
Encrypted:	false
SSDEEP:	48:+unFfbgkHT5idlJAPXbXLUbBtfjXjlkLfBxhXrU/d9erpjUc/k3Tgllzh:ZfH9CJAPX8rfqLxwV9eNVcUllF
MD5:	A7F7996F776E30F002AC534C4E645FCD
SHA1:	BD9D2C6A53AD0C70CF22068C974B6C1BD3B0A42D
SHA-256:	FCC378AF6CB1ED4B18AC217AF091D5F8CA986022E870444B192BE2CD78716C68
SHA-512:	C97929BDD682224AEFDAC41430B4C09750983EFF1079442B4B0D8BE9CCC37A259981DB5645A571091B41A0F4F2200B646A718F90BB4E100412F8264660A22358
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .pladform import PladformIE.from ..utils import (. unescapeHTML,. int_or_none,. ExtractorError,.)...class METAIE(InfoExtractor):. _VALID_URL = r'https?://video\.meta\.ua/(?:iframe/)?(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://video.meta.ua/5502115.video',. 'md5': '71b6f3ee274bef16f1ab410f7f56b476',. 'info_dict': {. 'id': '5502115',. 'ext': 'mp4',. 'title': 'Sony Xperia Z camera test [HQ]',. 'description': 'Xperia Z shoots video in FullHD HDR.',. 'uploader_id': 'nomobile',. 'uploader': 'CH.ZA.TV',. 'upload_date': '20130211',. },. 'add_ie': ['Youtube'],. }, {. 'url': 'http://video.meta.ua/iframe/5502115',. 'only_matching': True,. }, {. # pladform embed. 'url': 'http://video.meta.ua/7121015.video',. 'only_matching': True,. }

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-Q9THQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2425
Entropy (8bit):	4.895452531826163
Encrypted:	false
SSDEEP:	48:+uvWOJEhb9NZXgajXjlkzhcHe3jByOY71hMsC9wJTBBlpydVWrXF0ZeXaYaPZyzq:KOJEhb9NZXgaqNcHH17PMH9uTTydgx0b
MD5:	0C618B8D3D92D07775D946B58CD145E5
SHA1:	3409FE4F2D32F1C6DED020093D775B7398BBEFF3
SHA-256:	4862577F97C35D8934F6E9EAB11BBC45B7378DD2037ACB935B972BF6E7F49666
SHA-512:	1C19F6B556140A84C38520488E26761FE5F61584375B8B9D3EB9A1117D7640EA5142277C1494CF2B6D6C2C70D37929A7120A37C13DC18395FF121F82333FA741
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. urlencode_postdata,.)...class PromptFileIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?promptfile\.com/l/(?P<id>[0-9A-Z\-]+)'. _TEST = {. 'url': 'http://www.promptfile.com/l/86D1CE8462-576CAAE416',. 'md5': '5a7e285a26e0d66d9a263fae91bc92ce',. 'info_dict': {. 'id': '86D1CE8462-576CAAE416',. 'ext': 'mp4',. 'title': 'oceans.mp4',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. if re.search(r'<div.+id="not_found_msg".+>(?!We are).+</div>[^-]', webpage) is not None:. raise ExtractorError('Video %s does not exist' % video_id,. expected=True).. chash = self._

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QA30S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6063
Entropy (8bit):	4.7962279844468085
Encrypted:	false
SSDEEP:	96:VsbunJejU/Sbqh0D9riP8c3qnF39iEcEQMlVvEElXReNmY5ZydsEDrOzifspnBTF:CyJejuSD9uWz4ydsEDrOzcspBTM6NkP8
MD5:	CC496127B867CD545C757E491F312275
SHA1:	2A28DF772AFB1B55040147F48064F567AD9304DF
SHA-256:	0F19FF4AA87CFE3BE8C38BC9639E4C11EC6CB7FEC8D6947A6C13899E665A585E
SHA-512:	7ABDBA0E0A19C9D96340BF5D1628F5AEC78018CC535BA77BD7A7974AF387A0475723930B48DE1771CCE4043611213217FEF402B9BAEFF2EB4CFE78F316163787
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,. unescapeHTML,.)...class PeriscopeBaseIE(InfoExtractor):. def _call_api(self, method, query, item_id):. return self._download_json(. 'https://api.periscope.tv/api/v2/%s' % method,. item_id, query=query)...class PeriscopeIE(PeriscopeBaseIE):. IE_DESC = 'Periscope'. IE_NAME = 'periscope'. _VALID_URL = r'https?://(?:www\.)?(?:periscope\|pscp)\.tv/[^/]+/(?P<id>[^/?#]+)'. # Alive example URLs can be found here http://onperiscope.com/. _TESTS = [{. 'url': 'https://www.periscope.tv/w/aJUQnjY3MjA3ODF8NTYxMDIyMDl2zCg2pECBgwTqRpQuQD352EMPTKQjT4uqlM3cgWFA-g==',. 'md5': '65b57957972e503fcbbaeed8f4fa04ca',. 'info_dict': {. 'id': '56102209',. 'ext': 'mp4',. 'title': 'Bec Boop - ........ Fly above #London in Emirates Air Line cable

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QC4V4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2083
Entropy (8bit):	4.9613459361404955
Encrypted:	false
SSDEEP:	48:+ubZTdfQn48Qd5Qr7obZfdfFxSxABKFugZPBsbc+xN0wKBTLZvA6N1d:vZpQnBQd5QYbZfcB8cON2BTLZvA6N1d
MD5:	3C5FD11929C9902B53C53B19FEEA6C41
SHA1:	93CB462E4F951C52BC65946540E80B5790EB7C68
SHA-256:	2548703D367928688A3C98356E91B55FF50E042587F608AC8178AA0AD2A49D91
SHA-512:	CBE711A936866AD57BB4A7BD572EEF3DC03A969032E56F1226BA728056BA2D16A09EA2D74CE72D7C3AB1B6D5E32BCC616F1B26D5A48BBDBBB192638A5DA7FF53
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import js_to_json...class C56IE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\|player)\.)?56\.com/(?:.+?/)?(?:v_\|(?:play_album.+-))(?P<textid>.+?)\.(?:html\|swf)'. IE_NAME = '56.com'. _TESTS = [{. 'url': 'http://www.56.com/u39/v_OTM0NDA3MTY.html',. 'md5': 'e59995ac63d0457783ea05f93f12a866',. 'info_dict': {. 'id': '93440716',. 'ext': 'flv',. 'title': '..... .32....',. 'duration': 283.813,. },. }, {. 'url': 'http://www.56.com/u47/v_MTM5NjQ5ODc2.html',. 'md5': '',. 'info_dict': {. 'id': '82247482',. 'title': '.........',. },. 'playlist_count': 7,. 'add_ie': ['Sohu'],. }].. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url, flags=re.VERBOSE). text_id = m

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QDPDE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1891
Entropy (8bit):	4.9013141582441175
Encrypted:	false
SSDEEP:	48:+uKDRcYJtnVdWlxXVFW1BjXjlkM37a20k0lckPV5NSvxiDxDi:GlcYJtnvWlxXVFW1BqK7erNKite
MD5:	99307663E0AE2DEAF87E7FA132ABF18A
SHA1:	DF5FC98AEA555F7FB89040649D2A64EE8C377D38
SHA-256:	EE145B05E90A80B648DA6B0929C0E5260CCFD2D10A056995BC169F7F5B2DC67C
SHA-512:	F979C6908B4CDA5CDB5049E6967FE4CA905009FC280DF918A18F898209F8BA382B8B59E3AF111BC040468C8F64A27F8DF9FA5054A560142270C15031D1FB2B5F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. smuggle_url,. float_or_none,. parse_iso8601,. update_url_query,.)...class MovieClipsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?movieclips\.com/videos/.+-(?P<id>\d+)(?:\?\|$)'. _TEST = {. 'url': 'http://www.movieclips.com/videos/warcraft-trailer-1-561180739597',. 'md5': '42b5a0352d4933a7bd54f2104f481244',. 'info_dict': {. 'id': 'pKIGmG83AqD9',. 'ext': 'mp4',. 'title': 'Warcraft Trailer 1',. 'description': 'Watch Trailer 1 from Warcraft (2016). Legendary.s WARCRAFT is a 3D epic adventure of world-colliding conflict based.',. 'thumbnail': r're:^https?://.*\.jpg$',. 'timestamp': 1446843055,. 'upload_date': '20151106',. 'uploader': 'Movieclips',. },. 'add_ie': ['ThePlatform'],. }.. def _real_extract(self, url):. vid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QERRB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1344
Entropy (8bit):	5.032368348018576
Encrypted:	false
SSDEEP:	24:1R8lFvHhEifwEUlpm//Hdl+pyHPwUGktfeIXjlgtb6ylbxfXXZJr0PIln3:PuFhEif9bXHcyvJFtfjXjlkb6SxfXXDT
MD5:	E38CB8FE35836FEB4092EF31F43D0BB9
SHA1:	C6ADB4E34D4D529C65C930921FB6A806E67845C8
SHA-256:	F576B30A996E08E397584260DA7B6DEA5FB37D91153A886EAD20B027F10C6E6E
SHA-512:	8E9B766C0414176BFD9A89342B85E5E57472664A9B0652D1E2B2E6406973311C424B0D0F0BD240C0EB021DB55792E4B92C5185996FB7A6DAF0E9E482E2093725
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class WorldStarHipHopIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\|m)\.worldstar(?:candy\|hiphop)\.com/(?:videos\|android)/video\.php\?.*?\bv=(?P<id>[^&]+)'. _TESTS = [{. 'url': 'http://www.worldstarhiphop.com/videos/video.php?v=wshh6a7q1ny0G34ZwuIO',. 'md5': '9d04de741161603bf7071bbf4e883186',. 'info_dict': {. 'id': 'wshh6a7q1ny0G34ZwuIO',. 'ext': 'mp4',. 'title': 'KO Of The Week: MMA Fighter Gets Knocked Out By Swift Head Kick!'. }. }, {. 'url': 'http://m.worldstarhiphop.com/android/video.php?v=wshh6a7q1ny0G34ZwuIO',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. entries = self._parse_html5_media_entries(url, webpage, video_id).. if not entries:. return self.url_result(url, 'Generic')

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QF9GP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2408
Entropy (8bit):	4.831533853102196
Encrypted:	false
SSDEEP:	48:PunRrcyNfajzDmp+jJhiO38nDh/xrD1cSXyXAXvtfdfFA1PnBVLK7K2VOproq6GX:aR7ajzDmp+jP338n3rqSXC81f8pLKPVq
MD5:	FC01CA3D68140779E51540AD64018256
SHA1:	9502A9D375F2B56C4BA3535BCA8DAB3D9EEFDB10
SHA-256:	D063C484A7A8DC148F371F4E79F37E4CCBBD8C264913B9E3D42FFE78B1BEF4EB
SHA-512:	6E95B7507A1A8627E2EE12B88ABA308625A294A64AAEC89B742D2AAF3CA92A15B8C3BCBE4718728292BFF72C2012C619614E4D1058442AD879B145219603A141
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. dict_get,. float_or_none,.)...class PlaywireIE(InfoExtractor):. _VALID_URL = r'https?://(?:config\|cdn)\.playwire\.com(?:/v2)?/(?P<publisher_id>\d+)/(?:videos/v2\|embed\|config)/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://config.playwire.com/14907/videos/v2/3353705/player.json',. 'md5': 'e6398701e3595888125729eaa2329ed9',. 'info_dict': {. 'id': '3353705',. 'ext': 'mp4',. 'title': 'S04_RM_UCL_Rus',. 'thumbnail': r're:^https?://.*\.png$',. 'duration': 145.94,. },. }, {. # m3u8 in f4m. 'url': 'http://config.playwire.com/21772/videos/v2/4840492/zeus.json',. 'info_dict': {. 'id': '4840492',. 'ext': 'mp4',. 'title': 'ITV EL SHOW FULL',. },. 'params': {. # m3u8 download. 'skip_download': True,. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QH99R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2688
Entropy (8bit):	4.5637127282723675
Encrypted:	false
SSDEEP:	48:PuiWO872bab0qLNXhP/+beBQowE/FxzP06fJZoLOSYfmP780XDMSbBT+k6N1tc:iO87Sab0qLL+br0/7zPVJZoLOJfq78CT
MD5:	A81635F1138A8CFF8EBFBF1E50F1A6E1
SHA1:	23FA808E29E3492A578D8A1688AB2C74CE654161
SHA-256:	EA1D93F108838AEBF5CAEC23A7D6D39D4AC863AA54802F6BE94F145F47C005D3
SHA-512:	8FBB226C5B6923729DCABE474A6F0C4DC3BA63754E955ADF6BB170C8756847BD414491F02F269F28C45C1E60B8A771699AFD44A814E3971A0B2A723D4C629D7F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. int_or_none,. js_to_json,. mimetype2ext,. parse_filesize,.)...class MassengeschmackTVIE(InfoExtractor):. IE_NAME = 'massengeschmack.tv'. _VALID_URL = r'https?://(?:www\.)?massengeschmack\.tv/play/(?P<id>[^?&#]+)'.. _TEST = {. 'url': 'https://massengeschmack.tv/play/fktv202',. 'md5': 'a9e054db9c2b5a08f0a0527cc201e8d3',. 'info_dict': {. 'id': 'fktv202',. 'ext': 'mp4',. 'title': 'Fernsehkritik-TV - Folge 202',. },. }.. def _real_extract(self, url):. episode = self._match_id(url).. webpage = self._download_webpage(url, episode). title = clean_html(self._html_search_regex(. '<h3>([^<]+)</h3>', webpage, 'title')). thumbnail = self._search_regex(r'POSTER\s=\s"([^"]+)', webpage, 'thumbnail', fatal=False). sources = sel

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QHB4V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	4.881181446231953
Encrypted:	false
SSDEEP:	48:+u9rmj+W9JaeTq1jQiT0hU9CkRqadfFkZVmh3BPuB8Br:JKywJlTq1j3T0hGCkoaG6NLBr
MD5:	7FA2AAE06C814D83E80F7708774A988E
SHA1:	8ED8BD2CCAFE6B925BAD313538A81FD495A61518
SHA-256:	21A5514DB0FB1E339D161474C9EE2AAA389FBDB81BEC374AC283FC43C2EC7C4E
SHA-512:	6069BEED2EAB03E9FE6B0B7AAE779C3F1EF8F5104440BFE40F0FC72243E2D8DC68E4C357AEE6D61BC9FA48E83689C5057DFA871D909178EC2D3A5BD431CACC3F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class LocalNews8IE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?localnews8\.com/(?:[^/]+/)*(?P<display_id>[^/]+)/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.localnews8.com/news/rexburg-business-turns-carbon-fiber-scraps-into-wedding-rings/35183304',. 'md5': 'be4d48aea61aa2bde7be2ee47691ad20',. 'info_dict': {. 'id': '35183304',. 'display_id': 'rexburg-business-turns-carbon-fiber-scraps-into-wedding-rings',. 'ext': 'mp4',. 'title': 'Rexburg business turns carbon fiber scraps into wedding ring',. 'description': 'The process was first invented by Lamborghini and less than a dozen companies around the world use it.',. 'duration': 153,. 'timestamp': 1441844822,. 'upload_date': '20150910',. 'uploader_id': 'api',. }. }.. def _real_extract(self, u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QHTND.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	4.7829221925987895
Encrypted:	false
SSDEEP:	96:1Ofb9A93twWxNs5sD0ugGSN5ltNHBZNUmrvu5djtVm:YfBgtp45IhgLltLL9
MD5:	E469B4096A8C71677870167584AD7755
SHA1:	685FF7EE52A33945DBC2F65B6D6D59F596F70215
SHA-256:	830EE1FB1220842D4F1BB122A74E6D7D1E5C97981B25B166686304A5FEC6FFDB
SHA-512:	43E95B47F3FCB1108FD481A9B94B946B3EFE78B651876BA3048300BAF4997A34F20AD02F001157BE80343B6E272869474FFAFF6BEF28D2FB2E255B9AF64097A4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. unified_strdate.)...class JoveIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?jove\.com/video/(?P<id>[0-9]+)'. _CHAPTERS_URL = 'http://www.jove.com/video-chapters?videoid={video_id:}'. _TESTS = [. {. 'url': 'http://www.jove.com/video/2744/electrode-positioning-montage-transcranial-direct-current',. 'md5': '93723888d82dbd6ba8b3d7d0cd65dd2b',. 'info_dict': {. 'id': '2744',. 'ext': 'mp4',. 'title': 'Electrode Positioning and Montage in Transcranial Direct Current Stimulation',. 'description': 'md5:015dd4509649c0908bc27f049e0262c6',. 'thumbnail': r're:^https?://.*\.png$',. 'upload_date': '20110523',. }. },. {. 'url': 'http://www.jove.com/video/51796/culturing-caenorhabditis-elegans-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QIMD2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3840
Entropy (8bit):	4.840685827606199
Encrypted:	false
SSDEEP:	96:pTMiWqF8qbZj2iFzrND6HZvF+rEXIkqHfOrnkzDMztRue:+IEyOHNXI/vU
MD5:	BE6BE74EABA4494C03F9EB15CDDF2043
SHA1:	DFE6D8BE581E79970A24A65468938925EF16CCDF
SHA-256:	C8B79E37207E6614BA1158F761B9272BD78E5E79016F763A9BEF70791DF43509
SHA-512:	E2C95526543256F9E60E46171E4866A6B7A775E8139200EF1C0F453B5F6CE5A4797D50311CB9A86A74EC81000D2410938F601023601354618315DA0E3F34AF2A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. parse_age_limit,. parse_iso8601,. smuggle_url,. str_or_none,.)...class CWTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cw(?:tv(?:pr)?\|seed)\.com/(?:shows/)?(?:[^/]+/)+[^?]\?.\b(?:play\|watch)=(?P<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})'. _TESTS = [{. 'url': 'http://cwtv.com/shows/arrow/legends-of-yesterday/?play=6b15e985-9345-4f60-baf8-56e96be57c63',. 'info_dict': {. 'id': '6b15e985-9345-4f60-baf8-56e96be57c63',. 'ext': 'mp4',. 'title': 'Legends of Yesterday',. 'description': 'Oliver and Barry Allen take Kendra Saunders and Carter Hall to a remote location to keep them hidden from Vandal Savage while they figure out how to defeat him.',. 'duration': 2665,. 'series': 'Arrow',. 'season_number': 4,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QKMVQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5034
Entropy (8bit):	4.8280129419868
Encrypted:	false
SSDEEP:	96:hcQiGPqXDDAjfdrRzBPJx96SxTQWBTTWzNiWDClgtm6NGzpcIK+lkPkiCc3IoU3:WQfuDMdrJxcSxTQyTTJj6N4p3dipIf
MD5:	BF38E7F42FD988685828368DB9AAB1FA
SHA1:	09216D1D340F7ADE1525DF1D9E08791DDC45B1CC
SHA-256:	D99D22A404B538196FFDDC4143C8C30D0BADDA44957BFA0FC0AD908D84AD1976
SHA-512:	219259F3CB335AA856A5066A9B96BEFBFF7EEFF32095259058E89DF436A3E8F3407105F2C2DA297DA622B8D17977596931E643223F4838CE42794C41F23572DA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..utils import (. orderedSet,. urlencode_postdata,.)...class BitChuteIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?bitchute\.com/(?:video\|embed\|torrent/[^/]+)/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.bitchute.com/video/szoMrox2JEI/',. 'md5': '66c4a70e6bfc40dcb6be3eb1d74939eb',. 'info_dict': {. 'id': 'szoMrox2JEI',. 'ext': 'mp4',. 'title': 'Fuck bitches get money',. 'description': 'md5:3f21f6fb5b1d17c3dee9cf6b5fe60b3a',. 'thumbnail': r're:^https?://.*\.jpg$',. 'uploader': 'Victoria X Rave',. },. }, {. 'url': 'https://www.bitchute.com/embed/lbb5G1hjPhw/',. 'only_matching': True,. }, {. 'url': 'https://www.bitchute.com/torrent/Zee5BE49045h/szoMrox2JEI.webtorrent',. 'only_matching': True,. }].. def _real_e

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QLGIO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3413
Entropy (8bit):	4.815199896758509
Encrypted:	false
SSDEEP:	96:khKzn3z5a9XrVv7fY7RzC8c3zniIlueaFRd:jz39aHDQlz++ey
MD5:	A2D30FEB599C8F39427978DFD65BD0A6
SHA1:	7868CA5B5775E1C9A17CBD7A7C93B6754399D84C
SHA-256:	BDA791E19AF5907CB480FE48B44DADC6E03E80FDC63781304F33D2EEEED3A15A
SHA-512:	E023B556128D27A9FF315AFD653981DD83D1FC02A936899FB03E8F8EDAC7B84233527F29DDE2B84C50CEDDF49B45114D3D8EAA92E88FF591637A91B4E35E8D08
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import ExtractorError...class Vbox7IE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:[^/]+\.)?vbox7\.com/. (?:. play:\|. (?:. emb/external\.php\|. player/ext\.swf. )\?.*?\bvid=. ). (?P<id>[\da-fA-F]+). '''. _GEO_COUNTRIES = ['BG']. _TESTS = [{. 'url': 'http://vbox7.com/play:0946fff23c',. 'md5': 'a60f9ab3a3a2f013ef9a967d5f7be5bf',. 'info_dict': {. 'id': '0946fff23c',. 'ext': 'mp4',. 'title': '.......: ......... ... .. ........ .. ........',. 'description': '.. ...... .. . ....

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QQMI0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2158
Entropy (8bit):	4.661570909766049
Encrypted:	false
SSDEEP:	48:Pu0yKVOuVOXqtiFM+faXUPp6dfFklkqFZbl4b+TMBTXX3CXj+eBhBdAt46Nq:/AuVOXqtyvSXUPp6tIbl4MMBT3Y+uBik
MD5:	A2D8C6B0A157E9B5B031FB5FF93C7823
SHA1:	012EA1945CB8D669CB7D10DE596A440D54A88412
SHA-256:	04B06145DBD0DFDC558B2D341D23211F6095133149765C3D0D74072BC8ADBE09
SHA-512:	6C08FC0BD7BB356EDBFFBBA715801FCE056A5AAF8B3274F4376BE99E9E23F6F8558CE40C74F04DDAAF5C0A937359DF331E8FE34D2AACA2795F841470728324AA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import qualities...class UnistraIE(InfoExtractor):. _VALID_URL = r'https?://utv\.unistra\.fr/(?:index\|video)\.php\?id_video\=(?P<id>\d+)'.. _TESTS = [. {. 'url': 'http://utv.unistra.fr/video.php?id_video=154',. 'md5': '736f605cfdc96724d55bb543ab3ced24',. 'info_dict': {. 'id': '154',. 'ext': 'mp4',. 'title': 'M!ss Yella',. 'description': 'md5:104892c71bd48e55d70b902736b81bbf',. },. },. {. 'url': 'http://utv.unistra.fr/index.php?id_video=437',. 'md5': '1ddddd6cccaae76f622ce29b8779636d',. 'info_dict': {. 'id': '437',. 'ext': 'mp4',. 'title': 'Prix Louise Weiss 2014',. 'description': 'md5:cc3a8735f079f4fb6b0b570fc10c135a',. },. }. ].. def _real_extr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QSMG3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6289
Entropy (8bit):	4.633539714924295
Encrypted:	false
SSDEEP:	192:iHNxWgpTqOkETSiMcieTbe0XZZnvSqXedyD9:eNxWgp+OkPiDieTbeMZZnvPXedyD9
MD5:	34960F94A8376DFCAB3FF8E9FA624B95
SHA1:	F2DEBEE369D9C6273171E95271C09251342D8A97
SHA-256:	B59CE36BFD2C7814DE22E3433B0A1514BDBFF1E2A9A68CF339020B5A77EDBCE0
SHA-512:	7099E3D6E7559EB69E42F593A4ABE7ED28F3FE7B110A251132A095CD46EF41FC8068AFB9AA8C77D2DD78F33BE7EE7C914FD7519D6825C636A53F9DCA7C5B4A00
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. float_or_none,. parse_iso8601,. str_or_none,. try_get,. unescapeHTML,. url_or_none,. ExtractorError,.)...class RteBaseIE(InfoExtractor):. def _real_extract(self, url):. item_id = self._match_id(url).. info_dict = {}. formats = [].. ENDPOINTS = (. 'https://feeds.rasset.ie/rteavgen/player/playlist?type=iptv&format=json&showId=',. 'http://www.rte.ie/rteavgen/getplaylist/?type=web&format=json&id=',. ).. for num, ep_url in enumerate(ENDPOINTS, start=1):. try:. data = self._download_json(ep_url + item_id, item_id). except ExtractorError as ee:. if num < len(ENDPOINTS) or formats:. continue. if isinstance(ee.cause, compat_HTTPError) and ee.cause.code == 404:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QT9GV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	995
Entropy (8bit):	5.177264353530179
Encrypted:	false
SSDEEP:	24:zi8lFvsGu1xCfwsb8rhR1/pdlFmtlVhD/teZSHPw983tfWXjron:+uG11xCf1Q9jpRmtDR/tZvf3tfWXjEn
MD5:	B1A97906F0A4E65F2DC573ACEAC1E4D6
SHA1:	FDA51898EFD183F4B948835DCAAE35EB3C4A4FC2
SHA-256:	11163A8C1260380D6FB38758C16CD9BC6A9D5A1D9442230C592A3C569102C2CF
SHA-512:	365CADB80517A493AD8E482D6B99826F4B9C2AE439C4B24728A557B20FFEEE393EED903889630608D4B4E11A478E5F1DC0BABD496D655D30D22751A6EB0F61BA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class OutsideTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?outsidetv\.com/(?:[^/]+/)*?play/[a-zA-Z0-9]{8}/\d+/\d+/(?P<id>[a-zA-Z0-9]{8})'. _TESTS = [{. 'url': 'http://www.outsidetv.com/category/snow/play/ZjQYboH6/1/10/Hdg0jukV/4',. 'md5': '192d968fedc10b2f70ec31865ffba0da',. 'info_dict': {. 'id': 'Hdg0jukV',. 'ext': 'mp4',. 'title': 'Home - Jackson Ep 1 \| Arbor Snowboards',. 'description': 'md5:41a12e94f3db3ca253b04bb1e8d8f4cd',. 'upload_date': '20181225',. 'timestamp': 1545742800,. }. }, {. 'url': 'http://www.outsidetv.com/home/play/ZjQYboH6/1/10/Hdg0jukV/4',. 'only_matching': True,. }].. def _real_extract(self, url):. jw_media_id = self._match_id(url). return self.url_result(. 'jwplatform:' + jw_media_id, 'JWPlatform', jw_media_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-QTLN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2215
Entropy (8bit):	4.67510422229021
Encrypted:	false
SSDEEP:	48:+u+nfTbYDCx6clN8Wn+giJoXBBNgmmYBMYloL5NluRwv4mDXaD/w0HeU8cflyT6y:ifgu0clqWn+FJPmKYO9NlC+4mza/w0+1
MD5:	B50EB09F077A6C859DD7F87E2E0E9234
SHA1:	114D3E94800F50318C6E8CE198317209C4659DA4
SHA-256:	77241AC6FC20F96133C45FAFCFF808A0EA950EC1E0FFDA3D58CE94FB73453EFD
SHA-512:	3E08AD51C6BE53744B405059DACEAEBD6071404CFFA9A4DFCCA4B8FC0EF5D689519CF5EC3EC19A2E8E48A39B81DF3EF45F8C17979394AFB1564BB925B7515E95
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_timestamp,.)...class CamTubeIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\|api)\.)?camtube\.co/recordings?/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://camtube.co/recording/minafay-030618-1136-chaturbate-female',. 'info_dict': {. 'id': '42ad3956-dd5b-445a-8313-803ea6079fac',. 'display_id': 'minafay-030618-1136-chaturbate-female',. 'ext': 'mp4',. 'title': 'minafay-030618-1136-chaturbate-female',. 'duration': 1274,. 'timestamp': 1528018608,. 'upload_date': '20180603',. 'age_limit': 18. },. 'params': {. 'skip_download': True,. },. }].. _API_BASE = 'https://api.camtube.co'.. def _real_extract(self, url):. display_id = self._match_id(url).. token = self._download_json(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-R5FBN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2173
Entropy (8bit):	5.051861109066685
Encrypted:	false
SSDEEP:	48:PuxV+Au1ffURZtdWLPEaMG1EMoYQT3j5/n8XtXAtal/BKqDspijXjlkGU:0V+xNfitdWgKtoYQ7juhmalYn0qr
MD5:	510463FC50A7637B08AE61A75BDAFDB6
SHA1:	5621959DDAE35075BB759A416209401BCC7B8329
SHA-256:	04CA44BFB7A9FC06F6D3233AB9ECB735582E7E0B4BA32BA65D614346328B82A7
SHA-512:	F051B314427237D24A10E8BEB29C0F1769516ECD3143242718920F0A49EDF877E7B0350FC50F05F083EEEC1365818D3DC1A63758D5379FA3E14007587B8F2538
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .mtv import MTVIE...class CMTIE(MTVIE):. IE_NAME = 'cmt.com'. _VALID_URL = r'https?://(?:www\.)?cmt\.com/(?:videos\|shows\|(?:full-)?episodes\|video-clips)/(?P<id>[^/]+)'.. _TESTS = [{. 'url': 'http://www.cmt.com/videos/garth-brooks/989124/the-call-featuring-trisha-yearwood.jhtml#artist=30061',. 'md5': 'e6b7ef3c4c45bbfae88061799bbba6c2',. 'info_dict': {. 'id': '989124',. 'ext': 'mp4',. 'title': 'Garth Brooks - "The Call (featuring Trisha Yearwood)"',. 'description': 'Blame It All On My Roots',. },. 'skip': 'Video not available',. }, {. 'url': 'http://www.cmt.com/videos/misc/1504699/still-the-king-ep-109-in-3-minutes.jhtml#id=1739908',. 'md5': 'e61a801ca4a183a466c08bd98dccbb1c',. 'info_dict': {. 'id': '1504699',. 'ext': 'mp4',. 'title': 'Still The King Ep. 109 in 3 Minutes',. 'description':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-R77SL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2380
Entropy (8bit):	4.915227924117357
Encrypted:	false
SSDEEP:	48:+u5NQfFqz9YV6goCqtfjXhkO5LDivFWmxB73XqGl3kpulBl8wF6Nz:NAwz9YcFfa4DivFVTXdl3TPF6Nz
MD5:	7998EA5B96361B2FBFDC057C28FBEF3E
SHA1:	4AABEC619A97A7C21B51F59F906DD0A2ABEE374B
SHA-256:	891219E10DE604301FA2F1D9C6D97525DB62B5A2FF35B5ED781F1338E8804793
SHA-512:	B1A674A29D854A02D10BCAD584F1B36A68B6B9D3DEA31FF0EBD3F710323C72EF7475E2AD2C8CF23EFD3F2DDB6888945B6A55CF75016F055C4A93101571316860
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. merge_dicts,. urljoin,.)...class WakanimIE(InfoExtractor):. _VALID_URL = r'https://(?:www\.)?wakanim\.tv/[^/]+/v2/catalogue/episode/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.wakanim.tv/de/v2/catalogue/episode/2997/the-asterisk-war-omu-staffel-1-episode-02-omu',. 'info_dict': {. 'id': '2997',. 'ext': 'mp4',. 'title': 'Episode 02',. 'description': 'md5:2927701ea2f7e901de8bfa8d39b2852d',. 'series': 'The Asterisk War (OmU.)',. 'season_number': 1,. 'episode': 'Episode 02',. 'episode_number': 2,. },. 'params': {. 'format': 'bestvideo',. 'skip_download': True,. },. }, {. # DRM Protected. 'url': 'https://www.wakanim.tv/de/v2/catalogue/episode/7843/sword-art-online-alicization-omu-arc-2

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-RACRR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1788
Entropy (8bit):	4.94110463067315
Encrypted:	false
SSDEEP:	48:PuE8XAj5YvY2yadfFkI7kcVkBx3NfpwyxNVhv:F8QFYvY/aacC3NfLrV1
MD5:	C2FAA18C0AFA00C8C0E0AC6B2F6ADDE2
SHA1:	79BB8705EAC7D37313356D43748618E023C570B4
SHA-256:	81DF6F0C3C1DE042C026741F43F2015233A790CB543933EF05F844F6CD9B5C65
SHA-512:	2E71D6955F6AD2922DE7FC7B45B2012D20E9E0B756FC50B55A4E433C1D18BA6AFEC7A34DE1A330189F3B55164B95DA36D2A366A481D1BC09837A94D396F66A38
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote...class PhotobucketIE(InfoExtractor):. _VALID_URL = r'https?://(?:[a-z0-9]+\.)?photobucket\.com/.(([\?\&]current=)\|_)(?P<id>.)\.(?P<ext>(flv)\|(mp4))'. _TEST = {. 'url': 'http://media.photobucket.com/user/rachaneronas/media/TiredofLinkBuildingTryBacklinkMyDomaincom_zpsc0c3b9fa.mp4.html?filters[term]=search&filters[primary]=videos&filters[secondary]=images&sort=1&o=0',. 'md5': '7dabfb92b0a31f6c16cebc0f8e60ff99',. 'info_dict': {. 'id': 'zpsc0c3b9fa',. 'ext': 'mp4',. 'timestamp': 1367669341,. 'upload_date': '20130504',. 'uploader': 'rachaneronas',. 'title': 'Tired of Link Building? Try BacklinkMyDomain.com!',. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). vide

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-REQL1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10008
Entropy (8bit):	4.686136357946664
Encrypted:	false
SSDEEP:	192:oq9krNKAqV8dkvL8d6rXcLAXVkjtdjvqt+IuKYi6flzS4TnaDiaHO6NlJRmXtli:oqirNKAc8dkj8d6rXcUlkrjyDuKoRS4I
MD5:	E493BB9D1F13E41D18ED2C7239C1FD87
SHA1:	1D3DB7C7C861A417A176B90B7CF223DCD9850264
SHA-256:	4B5095B90DE2777DD40659697E7BD41125ECC1166E688AC1AD23BC8277553C66
SHA-512:	FB21CB0339BD8283CDFB11E99D8B928E2F6DF9674749AAF55E43E013DB5FA45A54FB8C6E89CF3DD43BD84273CFE42A950EF1AD66EC98C85725F59A25E2B43291
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..utils import (. urlencode_postdata,. int_or_none,. unified_strdate,.)...class VierIE(InfoExtractor):. IE_NAME = 'vier'. IE_DESC = 'vier.be and vijf.be'. _VALID_URL = r'''(?x). https?://. (?:www\.)?(?P<site>vier\|vijf)\.be/. (?:. (?:. [^/]+/videos\|. video(?:/[^/]+)*. )/. (?P<display_id>[^/]+)(?:/(?P<id>\d+))?\|. (?:. video/v3/embed\|. embed/video/public. )/(?P<embed_id>\d+). ). '''. _NETRC_MACHINE = 'vier'. _TESTS = [{. 'url': 'http://www.vier.be/planb/videos/het-wordt-warm-de

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-RGTIN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	953
Entropy (8bit):	5.065618082899809
Encrypted:	false
SSDEEP:	24:zi8lFv9G1X1uwNszMMcL9K/Edla0HbEaeIXjlgtlB4RA2:+uvaFuVXcgEXEajXjlklBcA2
MD5:	12059C87F0C979E236EDB7D53C9DEE37
SHA1:	087715FF0E260D789AE9CA38C787541F9FE59BEC
SHA-256:	606A86B866287FB2FEF8A7192CF111FB43EFB5947475286D9154783192CDFEC6
SHA-512:	75FA74C0FBC8BD34391093C31086A8D68B0CDD42DAA59FE796887FEAD54BFBD62857A1FFFECCC51DCE6678465C3EA66328E2BD04DA02905E6FF1DBECFD2FE161
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class LCIIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lci\.fr/[^/]+/[\w-]+-(?P<id>\d+)\.html'. _TEST = {. 'url': 'http://www.lci.fr/international/etats-unis-a-j-62-hillary-clinton-reste-sans-voix-2001679.html',. 'md5': '2fdb2538b884d4d695f9bd2bde137e6c',. 'info_dict': {. 'id': '13244802',. 'ext': 'mp4',. 'title': 'Hillary Clinton et sa quinte de toux, en plein meeting',. 'description': 'md5:a4363e3a960860132f8124b62f4a01c9',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). wat_id = self._search_regex(. (r'data-watid=[\'"](\d+)', r'idwat["\']?\s:\s["\']?(\d+)'),. webpage, 'wat id'). return self.url_result('wat:' + wat_id, 'Wat', wat_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-RK3CK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.760331876675233
Encrypted:	false
SSDEEP:	48:+uGf6BmF0VVoc1vPVfn+9byeu6LvnsfJnfFI7hb4Ac4NSXM6ILFMiPP:6mmSV31vPVfn+9byetvsfJib4p4NSXMx
MD5:	195013B71CBE43A1FEB96B7F90ACB7C3
SHA1:	A99B3B7E2E8B180BECE5DF617F01C2459EB50A2B
SHA-256:	A10077016286C40C272EA823889ED8578E62188A0D8E1D0DC4D19D8E5925820C
SHA-512:	4D59E34F1D3E937016D3074CA13BAF7E338CB7E5B5A29F812947187A84047B744F856262608A87431C5F265B6B613CADAE76934FBF33AFE8ECC9E1881B109EE1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class SeekerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?seeker\.com/(?P<display_id>.*)-(?P<article_id>\d+)\.html'. _TESTS = [{. # player.loadRevision3Item. 'url': 'http://www.seeker.com/should-trump-be-required-to-release-his-tax-returns-1833805621.html',. 'md5': '30c1dc4030cc715cf05b423d0947ac18',. 'info_dict': {. 'id': '76243',. 'ext': 'webm',. 'title': 'Should Trump Be Required To Release His Tax Returns?',. 'description': 'Donald Trump has been secretive about his "big," "beautiful" tax returns. So what can we learn if he decides to release them?',. 'uploader': 'Seeker Daily',. 'uploader_id': 'seekerdaily',. }. }, {. 'url': 'http://www.seeker.com/changes-expected-at-zoos-following-recent-gorilla-lion-shootings-1834116536.html',. 'playlist': [.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-RNTGF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9994
Entropy (8bit):	4.335530275625053
Encrypted:	false
SSDEEP:	192:12U0977FFC+NGvBB3J883py/ToiT29URxua6d7MiTf6N6QeXeA:1S9PFFC+NGvBB3Npio9URxua6d7JTf6S
MD5:	1DF2E5BC16576626EE438F615FFB5785
SHA1:	B747404B74538B24FE5E2035519B35CA791FA5DA
SHA-256:	98546A1743F8793DA109415AB60702CEB179512A2E9FBBAE3F85017353E20977
SHA-512:	989CFF5726AED9290A193E1860236D89C1EA7AA53C5259E61A0D16575081C1AA5E9AFFBB6D1C5594A2D9E912A702D2B80FFAFA82A3D89C787F55D11945E78C73
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .gigya import GigyaBaseIE..from ..compat import compat_str.from ..utils import (. int_or_none,. parse_duration,. try_get,. unified_timestamp,.)...class MedialaanIE(GigyaBaseIE):. _VALID_URL = r'''(?x). https?://. (?:www\.\|nieuws\.)?. (?:. (?P<site_id>vtm\|q2\|vtmkzoom)\.be/. (?:. video(?:/[^/]+/id/\|/?\?.?\baid=)\|. (?:[^/]+/). ). ). (?P<id>[^/?#&]+). '''. _NETRC_MACHINE = 'medialaan'. _APIKEY = '3_HZ0FtkMW_gOyKlqQzW5_0FHRC7Nd5XpXJZcDdXY4pk5eES2ZWmejRW5egwVm4ug-'. _SITE_TO_APP_ID = {. 'vtm': 'vtm_watch',. 'q2': 'q2',. 'vtmkzoom': 'vtmkzoom',. }. _TESTS = [{. # vod. 'url': 'http://vtm.be/video/volledi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ROAN0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3875
Entropy (8bit):	4.600607903533797
Encrypted:	false
SSDEEP:	96:WvqRzxRLXBz4Bv99fJsR2EZVWnBu5y/BTL1xlEuE6NG0HTafOuD8+/xK:sOCBvHJswbnBu5KTL1DVE6Nls0L
MD5:	AE8CF7D612851397410AED9442EAF2B2
SHA1:	15788FEA1D819DC284B80C7031B0D3229738999D
SHA-256:	5ED98B5AEC805BC9238143E66DED8FDAB1033F3D732E45A21AD6FCD11DF06268
SHA-512:	501F35101F6D63E801DB702D2452287C5F2A6D0B5E4544D90A37F46A75B605DE402B4693E777724E6CF9BA9BFC5F6D856BD887F7B2F1CF22A03078E9B0CDCFD4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,. try_get,. url_or_none,.)...class CCCIE(InfoExtractor):. IE_NAME = 'media.ccc.de'. _VALID_URL = r'https?://(?:www\.)?media\.ccc\.de/v/(?P<id>[^/?#&]+)'.. _TESTS = [{. 'url': 'https://media.ccc.de/v/30C3_-_5443_-_en_-_saal_g_-_201312281830_-_introduction_to_processor_design_-_byterazor#video',. 'md5': '3a1eda8f3a29515d27f5adb967d7e740',. 'info_dict': {. 'id': '1839',. 'ext': 'mp4',. 'title': 'Introduction to Processor Design',. 'creator': 'byterazor',. 'description': 'md5:df55f6d073d4ceae55aae6f2fd98a0ac',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20131228',. 'timestamp': 1388188800,. 'duration': 3710,. 'tags': list,. }. }, {. 'url': 'https://media.ccc.de/v/32c3-736

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ROCOQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14325
Entropy (8bit):	4.874080009701853
Encrypted:	false
SSDEEP:	384:2TXHM75gMzr/ExKR66xqwliB07b15Vd5+135N55ksw0TsW0ZExet5mg+G/cX6rFu:Tgerssw6DiB07b15Vd5035N55ksw0Tsk
MD5:	233DEF2963B0BBEF820C788F4BC9C3EF
SHA1:	5FF4E5EC3F0A7989485AD653C6FB867C1ECB8B9A
SHA-256:	8B6D96AB2115DB6EAFAFE06FA51F93AB63A77038581C7E2CFEF17EFADDBE9019
SHA-512:	2A1C960605723E5D317CA59F85462337754FB30E8687365DE84B88CEC0D962DC4747C96043937D599D1F718940C15C88C6A55D4986F88E9ABFDE4EFECF49367A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.from uuid import uuid4..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,. try_get,. url_or_none,. urlencode_postdata,.)...class ZattooPlatformBaseIE(InfoExtractor):. _power_guide_hash = None.. def _host_url(self):. return 'https://%s' % (self._API_HOST if hasattr(self, '_API_HOST') else self._HOST).. def _login(self):. username, password = self._get_login_info(). if not username or not password:. self.raise_login_required(. 'A valid %s account is needed to access this media.'. % self._NETRC_MACHINE).. try:. data = self._download_json(. '%s/zapi/v2/account/login' % self._host_url(), None, 'Logging in',. data=urlencode_postdata({. 'login': username,. 'pa

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ROE1A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2340
Entropy (8bit):	4.888603053372565
Encrypted:	false
SSDEEP:	48:+uDZ1hoKVvcR1qajXhk5BDZBgJSBDg9KYFhsFuXnFXXuXwNidaCvCzT+x6Ng:fZ1GKV02aalBQv9DuQFD6jvC86Ng
MD5:	8F9FD3899CC84D45000BD2E91BFF1A3A
SHA1:	52102C97C73E506F4FB5758D1D42FE0291776807
SHA-256:	25319B817EF95DC357CC097629887930CD4821E38C9F3F3693E9C68B616C2A33
SHA-512:	E19EF6A723543EF571A9FAEDE896CB8E0BEC9B856F496B6E12786EDC13D862B205F2837F06A39D9354F293E583DF90340527616D9F5192DB57081B491E31432C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class KaraoketvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?karaoketv\.co\.il/[^/]+/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.karaoketv.co.il/%D7%A9%D7%99%D7%A8%D7%99_%D7%A7%D7%A8%D7%99%D7%95%D7%A7%D7%99/58356/%D7%90%D7%99%D7%96%D7%95%D7%9F',. 'info_dict': {. 'id': '58356',. 'ext': 'flv',. 'title': '...... .. .....',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). api_page_url = self._search_regex(. r'<iframe[^>]+src=(["\'])(?P<url>https?://www\.karaoke\.co\.il/api_play\.php\?.+?)\1',. webpage, 'API play URL', group='url').. api_page = self._download_webpage(api_page_url, video_id). vid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-RQ5SH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10631
Entropy (8bit):	4.655941577435463
Encrypted:	false
SSDEEP:	192:y+WAUEvXmE5+ZaLPh2oRN70xh5pdtCp1t5p3pvLjlM2K7oFXRHkbhT36N00cy3v:hnUEvXmE5+Zg5xN7WdtC1t7ZDjlM2K7a
MD5:	BDE141451677AD19168A0D622284696D
SHA1:	0EEA870007B23D981010E773B41C178B44445C25
SHA-256:	EAFD8DCC022407C5293C1CC1725D5A99BE576B39706EF4C2E7C013B834549F8F
SHA-512:	0A13153068026B63B03132230178EE883A565EB754ACFA2DB942E53EEF41B85C7331B24B47E0F80DB846C0C19EC1A164AD14157620CBD1A7994556A5B57EF714
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import json.import hashlib.import hmac.import random.import string.import time..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_urllib_parse_urlencode,. compat_urllib_parse,.).from ..utils import (. ExtractorError,. float_or_none,. int_or_none,.)...class VRVBaseIE(InfoExtractor):. _API_DOMAIN = None. _API_PARAMS = {}. _CMS_SIGNING = {}. _TOKEN = None. _TOKEN_SECRET = ''.. def _call_api(self, path, video_id, note, data=None):. # https://tools.ietf.org/html/rfc5849#section-3. base_url = self._API_DOMAIN + '/core/' + path. query = [. ('oauth_consumer_key', self._API_PARAMS['oAuthKey']),. ('oauth_nonce', ''.join([random.choice(string.ascii_letters) for _ in range(32)])),. ('oauth_signature_method', 'HMAC-SHA1'),. ('oauth_timestamp', int(time.time())),. ]. if self._TOKEN:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-RTUM8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25467
Entropy (8bit):	4.652449888556885
Encrypted:	false
SSDEEP:	768:9gShZTthtTUelxdnEef2l+e4ESUudYl8dK4S3Tt8j7i:CShZTthtTUelxdnEeulAVUudYl8dKF3h
MD5:	F2AAB9182459D334666CF9D555C4339D
SHA1:	1EB63CEA5875D2EFCC0A730FDCD928108E7B2C38
SHA-256:	94A4FDB86D45C55EF902B5E82F9A0C8AA508341BF8F654B5957E8E970207C6CA
SHA-512:	E62D1EA6525FABB933CF11593902E8D386BABE3B0EFD5BD11C90D97FA98A401B18FFBCAA0399B7FAE2512E6A4E928A8D7AE47BCAC75B094FB85B287B4E2619CD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re.import random.import json..from .common import InfoExtractor.from ..compat import (. compat_kwargs,. compat_parse_qs,. compat_str,. compat_urllib_parse_urlencode,. compat_urllib_parse_urlparse,.).from ..utils import (. clean_html,. ExtractorError,. float_or_none,. int_or_none,. orderedSet,. parse_duration,. parse_iso8601,. qualities,. try_get,. unified_timestamp,. update_url_query,. url_or_none,. urljoin,.)...class TwitchBaseIE(InfoExtractor):. _VALID_URL_BASE = r'https?://(?:(?:www\|go\|m)\.)?twitch\.tv'.. _API_BASE = 'https://api.twitch.tv'. _USHER_BASE = 'https://usher.ttvnw.net'. _LOGIN_FORM_URL = 'https://www.twitch.tv/login'. _LOGIN_POST_URL = 'https://passport.twitch.tv/login'. _CLIENT_ID = 'kimne78kx3ncx6brgo4mv6wki5h1ko'. _NETRC_MACHINE = 'twitch'.. def _handle_error(self, response):. if not isinstance(response,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-S2K5T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1411
Entropy (8bit):	4.8352967177229385
Encrypted:	false
SSDEEP:	24:zi8lFvcGQ3fwBKDTXmP/7Fdl+cMFNZxqHPwASPvPw2p2PtfeIXlA1ZDAtdhDckuH:+umV3fxDan7F3WNZIv8PXgPtfjXMZDEs
MD5:	025B4E7326D23DA05F8C83870F2643EC
SHA1:	B0C9C748404429F9D8E21476415A101DAF75A877
SHA-256:	E59204B4D360309EDC9E9200A2ACA6280FD60716F0CBECC58C3D744E937E8612
SHA-512:	2353472AD9EB6E7E1AC5D90FFF018EEDBDB4A182C0CCEE671ACBA0EA4FDDCA7F1C98B1C2035741CC7D19E93364241FB343A0A9632083E2C1AC6FBDF952184671
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import urljoin...class YourUploadIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:yourupload\.com/(?:watch\|embed)\|embed\.yourupload\.com)/(?P<id>[A-Za-z0-9]+)'. _TESTS = [{. 'url': 'http://yourupload.com/watch/14i14h',. 'md5': '5e2c63385454c557f97c4c4131a393cd',. 'info_dict': {. 'id': '14i14h',. 'ext': 'mp4',. 'title': 'BigBuckBunny_320x180.mp4',. 'thumbnail': r're:^https?://.*\.jpe?g',. }. }, {. 'url': 'http://www.yourupload.com/embed/14i14h',. 'only_matching': True,. }, {. 'url': 'http://embed.yourupload.com/14i14h',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. embed_url = 'http://www.yourupload.com/embed/%s' % video_id.. webpage = self._download_webpage(embed_url, video_id).. title

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-S2TEF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	17336
Entropy (8bit):	4.901696700667971
Encrypted:	false
SSDEEP:	384:ec/IGOgd9kNnUU5K2QFJcwkyTRn6NfFMjV5haRAR/ELhhT9+6NX2FfVMwikETx6Z:b/IBgPkN2kyTt8fuB3WhhTY8XMAkETxC
MD5:	B9FD13951B3065F45B7B0C4B0BB33644
SHA1:	D9E7DE7A2E1DBF745A1C0B33457EB8BDBCC2DDCB
SHA-256:	8D693D53CD9ABB5F4CFE9992ADB6061FE1CBD0618B32787ECB2EA7E2CC9AFBD2
SHA-512:	D3A7506711894C4E503CBD5CCE602A4ACB085196019A8DBC22CCF91F5813C677F6FE09D2A7EA68D41E93A7E670E418E2815A21E2A571F051975CB54A8455F0AC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from hashlib import md5.from base64 import b64encode.from datetime import datetime.import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_str,. compat_itertools_count,.).from ..utils import (. sanitized_Request,. float_or_none,.)...class NetEaseMusicBaseIE(InfoExtractor):. _FORMATS = ['bMusic', 'mMusic', 'hMusic']. _NETEASE_SALT = '3go8&$833h0k(2)2'. _API_BASE = 'http://music.163.com/api/'.. @classmethod. def _encrypt(cls, dfsid):. salt_bytes = bytearray(cls._NETEASE_SALT.encode('utf-8')). string_bytes = bytearray(compat_str(dfsid).encode('ascii')). salt_len = len(salt_bytes). for i in range(len(string_bytes)):. string_bytes[i] = string_bytes[i] ^ salt_bytes[i % salt_len]. m = md5(). m.update(bytes(string_bytes)). result = b64encode(m.digest()).decode('ascii'). return result.repla

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-S3689.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	4.432738310028167
Encrypted:	false
SSDEEP:	96:hO4CVkIHpccCfWFUJYF+2XFxC5yJv6v8nyd+Jz6oF8vvOOLJ2ABTCFoNgns6No:IZKMpccwWuJYF5gycvd+Jz6oavvOOLJ5
MD5:	34A174218219AFF0D895141E9509862A
SHA1:	25D944ED9692AAB2E7D0F342438E87A6B5E348A8
SHA-256:	F0206262E8181BE802295BFE03CEFFD06A465928F66A4ABD25E39E85F06C98AE
SHA-512:	43DC609E5F42A49E9B79C1CB46C2F4B9FD3C0C4DD1271C671AAF20854565C6924F567455FB81BED6E3E58393CB5D82398498CA01F3BE872D3D3BC6473A6E0172
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_str,. compat_urllib_parse_urlparse,.).from ..utils import (. determine_ext,. int_or_none,. try_get,. qualities,.)...class SixPlayIE(InfoExtractor):. IE_NAME = '6play'. _VALID_URL = r'(?:6play:\|https?://(?:www\.)?(?P<domain>6play\.fr\|rtlplay\.be\|play\.rtl\.hr\|rtlmost\.hu)/.+?-c_)(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://www.6play.fr/minute-par-minute-p_9533/le-but-qui-a-marque-lhistoire-du-football-francais-c_12041051',. 'md5': '31fcd112637baa0c2ab92c4fcd8baf27',. 'info_dict': {. 'id': '12041051',. 'ext': 'mp4',. 'title': 'Le but qui a marqu. l\'histoire du football fran.ais !',. 'description': 'md5:b59e7e841d646ef1eb42a7868eb6a851',. },. }, {. 'url': 'https://www.rtlplay.be/rtl-info-13h-p_8551/les-titres-du-rtlinfo-13h-c_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-S47J9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	18642
Entropy (8bit):	4.565526883511982
Encrypted:	false
SSDEEP:	384:ZN6O+B06qD+ZYoGdb0OrVgeuP0LZ/11vgpTZ1MaHxNw26NWBhg:fXVgXP0LZ/11vgpTZSaRJ8WA
MD5:	C6920EB3C43C00AA504AF2F4F093CB4C
SHA1:	811500202797B1D59BACEE028F1751762AA3F645
SHA-256:	DCFD513D45A5DDD15CDD132F7EE6EC2D8C4E40E31B8B590E8D8D5EB5850FD67A
SHA-512:	F4B00B6FE845CB00468A41A099F62EF715B2F7EDBBF352865B07E0589DD14F612B981E931DF1A8B00B385135E26F628BCF98C90DDF2F536F8AD2BBF6446ED57A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import datetime..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import (. determine_ext,. dict_get,. ExtractorError,. int_or_none,. float_or_none,. parse_duration,. parse_iso8601,. remove_start,. try_get,. unified_timestamp,. urlencode_postdata,. xpath_text,.)...class NiconicoIE(InfoExtractor):. IE_NAME = 'niconico'. IE_DESC = '......'.. _TESTS = [{. 'url': 'http://www.nicovideo.jp/watch/sm22312215',. 'md5': 'd1a75c0823e2f629128c43e1212760f9',. 'info_dict': {. 'id': 'sm22312215',. 'ext': 'mp4',. 'title': 'Big Buck Bunny',. 'thumbnail': r're:https?://.*',. 'uploader': 'takuya0301',. 'uploader_id': '2698420',. 'upload_date': '20131123',. 'timestamp': int, # timestamp is unstable.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-S4T0E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2401
Entropy (8bit):	5.1195636458074985
Encrypted:	false
SSDEEP:	48:+uyY7wOrMDy7i/SmU5tXjlLmE95OoJCgIejShLhfJoXhhIqnAlVNVWCbH:WY7wbDy7PmU57mmPCgIm6JadAJ7
MD5:	166B9EAD07F3A70C3E68DCECFBCDDE0B
SHA1:	B6CC612CF89CCE935D41C214DFDD49EF7C5326C3
SHA-256:	7FBB384ECA5FD9BFF419E508E242B0A85C9D50DC0A85C39CB3D650C59E8D857F
SHA-512:	43695EAF9C0D08F694F5F19F90BCA7F9F2796B94EC76CA961A46245143F93BD95D65CF2CC27E9FBDAF40C7114BE860FD8AC341C9A563B39E9495A85ECEBA1D7A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .brightcove import BrightcoveNewIE...class TVANouvellesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?tvanouvelles\.ca/videos/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.tvanouvelles.ca/videos/5117035533001',. 'info_dict': {. 'id': '5117035533001',. 'ext': 'mp4',. 'title': 'L.industrie du taxi d.nonce l.entente entre Qu.bec et Uber: explications',. 'description': 'md5:479653b7c8cf115747bf5118066bd8b3',. 'uploader_id': '1741764581',. 'timestamp': 1473352030,. 'upload_date': '20160908',. },. 'add_ie': ['BrightcoveNew'],. }. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/1741764581/default_default/index.html?videoId=%s'.. def _real_extract(self, url):. brightcove_id = self._match_id(url). return self.url_result(. self.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-S5520.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2717
Entropy (8bit):	4.6416041037493
Encrypted:	false
SSDEEP:	48:+u7cFfBQNdtE4/bVfJoXjCYuhbuXmkZZP4nqG3FJBTefmUANbj8c0F6NNFn:MdBQdtEWbVfJgkZkZlKdVJBTeOUANbj5
MD5:	3419C163722C40B94CCDAD38B1C21783
SHA1:	4E228A1B79805D9448569CA465C2260DEA21B660
SHA-256:	356E0C4D15FCDFD0B24F0B15F8DFA28AF00FD280E72DA0596BE858105226CA2B
SHA-512:	44F937F87940B9248C6CB2C71D0B51D4B2CA6A6AD89E25FA349403A9E6F9E163C0F930FB3DF06472C62FAA8450355C77DF581C6642EB245DB8013C451A651A8F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_duration,. parse_iso8601,.)...class ComCarCoffIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?comediansincarsgettingcoffee\.com/(?P<id>[a-z0-9\-]*)'. _TESTS = [{. 'url': 'http://comediansincarsgettingcoffee.com/miranda-sings-happy-thanksgiving-miranda/',. 'info_dict': {. 'id': '2494164',. 'ext': 'mp4',. 'upload_date': '20141127',. 'timestamp': 1417107600,. 'duration': 1232,. 'title': 'Happy Thanksgiving Miranda',. 'description': 'Jerry Seinfeld and his special guest Miranda Sings cruise around town in search of coffee, complaining and apologizing along the way.',. },. 'params': {. 'skip_download': 'requires ffmpeg',. }. }].. def _real_extract(self, url):. display_id =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SB2MT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2792
Entropy (8bit):	4.80324560725895
Encrypted:	false
SSDEEP:	48:+uQ5VV4NIKgPfTJAZubXQZXwH9x3XovXXWcXx9Xgx9XrIGo4sFEWlfFIGiDQ:85QwHtcuzQlqHovnPDgXaMWaQ
MD5:	1CE7E8AA0D1EF0571EB931BD5D2F04B0
SHA1:	F1A4D4D9890E4F5274844F3F431F4BCB6C421EF3
SHA-256:	84DC9BE3945DD838CD86FE7ECC2D6214FF4BEF100F23CD06F4BF786566D770FC
SHA-512:	EF6423BEFDB48118BD2CFF771AC6F79A7A052C37B38AA87EDA1A7CF3C98457B68255B1B8D56A7925641FAE5B2A0A9E9ED6252AF49B66A3C8A5D93FB125E84724
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class BellMediaIE(InfoExtractor):. _VALID_URL = r'''(?x)https?://(?:www\.)?. (?P<domain>. (?:. ctv\|. tsn\|. bnn(?:bloomberg)?\|. thecomedynetwork\|. discovery\|. discoveryvelocity\|. sciencechannel\|. investigationdiscovery\|. animalplanet\|. bravo\|. mtv\|. space\|. etalk. )\.ca\|. much\.com. )/.*?(?:\bvid(?:eoid)?=\|-vid\|~\|%7E\|/(?:episode)?)(?P<id>[0-9]{6,})'''. _TESTS = [{. 'url': 'https://www.bnnbloomberg.ca/video/david-cockfield-s-top-picks~1403070',. 'md5': '36d3ef559cfe8af8efe15922cd3ce950',. 'info_dict': {. 'id': '1403070',. 'ext': 'flv',. 'title': 'David Cockfield\'s Top Picks',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SD2RB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6254
Entropy (8bit):	5.162109472431887
Encrypted:	false
SSDEEP:	192:gCpZOTC2Pf5x8Oio5BLdo3O3sydKck70A6NE:gCpZOTCYH8/ojm3EDdKc9A6NE
MD5:	76FA3BF7068AC99DE3AD58E89E0DC02B
SHA1:	801A4D31375F29DDBD5EF9ABA5075E13318F8EEB
SHA-256:	67DB6543C44B8B5BDA518325227504A339913670D2758F6CB0E108A451B6AB3B
SHA-512:	66233EB7EF46642801D7A586821CCA07AF71C91DAF658B0C8E9877241B8F7A9EFD13D00A46635439EF9E47B5DB46B4D8B81F1F769403CB5CF8CC61D1121D8310
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. smuggle_url,. unsmuggle_url,.)...class LiTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?litv\.tv/(?:vod\|promo)/[^/]+/(?:content\.do)?\?.*?\b(?:content_)?id=(?P<id>[^&]+)'.. _URL_TEMPLATE = 'https://www.litv.tv/vod/%s/content.do?id=%s'.. _TESTS = [{. 'url': 'https://www.litv.tv/vod/drama/content.do?brc_id=root&id=VOD00041610&isUHEnabled=true&autoPlay=1',. 'info_dict': {. 'id': 'VOD00041606',. 'title': '...',. },. 'playlist_count': 50,. }, {. 'url': 'https://www.litv.tv/vod/drama/content.do?brc_id=root&id=VOD00041610&isUHEnabled=true&autoPlay=1',. 'md5': '969e343d9244778cb29acec608e53640',. 'info_dict': {. 'id': 'VOD00041610',. 'ext': 'mp4',. 'title': '....1.',. 'thumbnai

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SD43J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8735
Entropy (8bit):	4.738155974179003
Encrypted:	false
SSDEEP:	192:1cXNiplhQSmH5NiF7qKOafxlNzwTl70yXodFb2z4FTa36N0s:14cQS8ziF+KOafxlNwTP4dFb2z4FTa3W
MD5:	48879161E7F00CA7D4E03F23A220E26F
SHA1:	BC8E6F09036E77CC69A6F6C53987C8D2EB1E1535
SHA-256:	A764FC8D843202C5546F76BACD1AAAE04D583A2622EDA7A528576ABC80020A94
SHA-512:	E5B2385323059DF8066ACE6B004786BBB3D963ABC78A1B04DF3E1915E472FF798DC0E8C92F35B9EBDCEC30C01B4E8E52D1650B5B81A10BC107941B32D09C361B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import binascii.import json.import os.import random..from .common import InfoExtractor.from ..aes import aes_cbc_decrypt.from ..compat import (. compat_b64decode,. compat_ord,.).from ..utils import (. bytes_to_intlist,. bytes_to_long,. ExtractorError,. float_or_none,. intlist_to_bytes,. long_to_bytes,. pkcs1pad,. strip_or_none,. urljoin,.)...class ADNIE(InfoExtractor):. IE_DESC = 'Anime Digital Network'. _VALID_URL = r'https?://(?:www\.)?animedigitalnetwork\.fr/video/[^/]+/(?P<id>\d+)'. _TEST = {. 'url': 'http://animedigitalnetwork.fr/video/blue-exorcist-kyoto-saga/7778-episode-1-debut-des-hostilites',. 'md5': 'e497370d847fd79d9d4c74be55575c7a',. 'info_dict': {. 'id': '7778',. 'ext': 'mp4',. 'title': 'Blue Exorcist - Ky.to Saga - .pisode 1',. 'description': 'md5:2f7b5aa76edbc1a7a92cedcda8a528d5',. }.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SEMJ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2852
Entropy (8bit):	4.611882404231231
Encrypted:	false
SSDEEP:	48:+uhWOL2JefNB6QuvfvQ9aXQ1XQjtfjXjbKiGlMthj2g3jOwXVqpwIaJkNEj/Cek6:YOyKWQuXva6oefGjlw2g3jlkOI2kNEDr
MD5:	9526F5446C9E91222ECE9767F30AD666
SHA1:	509EC0E8525F040849620C08DD99C7C1BE81E2BC
SHA-256:	1A6431D3FDD72E6DD9BB71B2CD62FC18B5C4A566AF09B98232943E7751C7BA1D
SHA-512:	DDB6642CD9985CFF1998EA462D39F97824E20F0B6F3132459EB5C98EB34BF06B8DBED31C2BDB06D7AD2F9161369692EFED1BA7159CBCE5A09982C65AA9D60365
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. strip_or_none,. xpath_attr,. xpath_text,.)...class InaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ina\.fr/(?:video\|audio)/(?P<id>[A-Z0-9_]+)'. _TESTS = [{. 'url': 'http://www.ina.fr/video/I12055569/francois-hollande-je-crois-que-c-est-clair-video.html',. 'md5': 'a667021bf2b41f8dc6049479d9bb38a3',. 'info_dict': {. 'id': 'I12055569',. 'ext': 'mp4',. 'title': 'Fran.ois Hollande "Je crois que c\'est clair"',. 'description': 'md5:3f09eb072a06cb286b8f7e4f77109663',. }. }, {. 'url': 'https://www.ina.fr/video/S806544_001/don-d-organes-des-avancees-mais-d-importants-besoins-video.html',. 'only_matching': True,. }, {. 'url': 'https://www.ina.fr/audio/P16173408',. 'only_matching': True,. }, {. 'url': 'https://

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SMQPF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3229
Entropy (8bit):	4.8025970080066
Encrypted:	false
SSDEEP:	96:T5JunK/zLsvnBGPtfa3iDmjsKKj+3Xacci8I0D:lJ01vnBGPNaEbP
MD5:	A082672A0E47EE76BFD03991FF907B43
SHA1:	4BE580F3FA90F3B3A752828A958B89646E486DDB
SHA-256:	0093661ABB0EABDF7EC946FBF8B39FDFF4E36F16F31053FEBC4D46A5812D5912
SHA-512:	37CBEDBD6745F50C12411D43480444F15C394B9DA5BD0928F0134779DC944315A10DA91A000A38855966F3B5A7C4F10AFCA8BA7DD63700D488A6B8DC7B17037D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. unified_strdate,.)...class CamWithHerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?camwithher\.tv/view_video\.php\?.*\bviewkey=(?P<id>\w+)'.. _TESTS = [{. 'url': 'http://camwithher.tv/view_video.php?viewkey=6e9a24e2c0e842e1f177&page=&viewtype=&category=',. 'info_dict': {. 'id': '5644',. 'ext': 'flv',. 'title': 'Periscope Tease',. 'description': 'In the clouds teasing on periscope to my favorite song',. 'duration': 240,. 'view_count': int,. 'comment_count': int,. 'uploader': 'MileenaK',. 'upload_date': '20160322',. 'age_limit': 18,. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'http://camwithher.tv/view_video.php?viewkey=6dfd8b7c97531a459937',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SMTMI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	4.952804623458931
Encrypted:	false
SSDEEP:	96:dQqLTIn77/VNVUdM+DfWeS9p8if6EbxPljbpjLUfz5VCAtfO0Fs7e0vAbKix5:d5L0H/VNVUdvDWeS6zEb1FNjLsVCANJh
MD5:	6B1470C026C59E5698F997B04021AE2E
SHA1:	AD3ACCC3880B445B59EBBF11D259AB441C46C96E
SHA-256:	10CEEF367DA8CB07F9C685E6CB9478119ED5DB76E8157F5A30A2187F2F39A491
SHA-512:	B118C2FC40D63AE6E97324CA84D1BD9106972190F85165B3845A513EB23090BB40318D9F3D2274BDB2C843FD556D356AECD178C92D99559ED2DE4EE1C06C14EA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .kaltura import KalturaIE.from ..utils import extract_attributes...class AsianCrushIE(InfoExtractor):. _VALID_URL_BASE = r'https?://(?:www\.)?(?P<host>(?:(?:asiancrush\|yuyutv\|midnightpulp)\.com\|cocoro\.tv))'. _VALID_URL = r'%s/video/(?:[^/]+/)?0+(?P<id>\d+)v\b' % _VALID_URL_BASE. _TESTS = [{. 'url': 'https://www.asiancrush.com/video/012869v/women-who-flirt/',. 'md5': 'c3b740e48d0ba002a42c0b72857beae6',. 'info_dict': {. 'id': '1_y4tmjm5r',. 'ext': 'mp4',. 'title': 'Women Who Flirt',. 'description': 'md5:7e986615808bcfb11756eb503a751487',. 'timestamp': 1496936429,. 'upload_date': '20170608',. 'uploader_id': 'craig@crifkin.com',. },. }, {. 'url': 'https://www.asiancrush.com/video/she-was-pretty/011886v-pretty-episode-3/',. 'only_matching': True,. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SOFHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7339
Entropy (8bit):	4.671202612664414
Encrypted:	false
SSDEEP:	192:YC0V8hQjYdVCjht+IOyTqAaGSTVv54MWlbObqTobiysTKR6N5pAa8R0Y:f0V86E7Cjht+hyTqJzJv4ObqTobiysTc
MD5:	D347ACE0A0469A1EC193FADB5DD6EC30
SHA1:	B06FF5010D3ACD630B5390AC01123A1F301BAC18
SHA-256:	63228AE21662EC1887BC07E433C03D47422DD7CD79EB6F1CBDD3FFCDF17A3607
SHA-512:	0F12AE6D8A32DAA5A4FE84D100B8E4B5F4190C59040AE3D838CA9C6EB2F0B235A2BA006363EFA92E5630E643DA2E5C20A5E26288767B6A12C9A65DE4B2EDBBA4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import hmac.import time.import uuid..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. str_or_none,. try_get,. url_or_none,.)...class HotStarBaseIE(InfoExtractor):. _AKAMAI_ENCRYPTION_KEY = b'\x05\xfc\x1a\x01\xca\xc9\x4b\xc4\x12\xfc\x53\x12\x07\x75\xf9\xee'.. def _call_api_impl(self, path, video_id, query):. st = int(time.time()). exp = st + 6000. auth = 'st=%d~exp=%d~acl=/*' % (st, exp). auth += '~hmac=' + hmac.new(self._AKAMAI_ENCRYPTION_KEY, auth.encode(), hashlib.sha256).hexdigest(). response = self._download_json(. 'https://api.hotstar.com/' + path, video_id, headers={. 'hotstarauth': auth,. 'x-country-code': 'IN',. 'x-platform-code': 'JIO',. }, query=query). if re

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SRIBD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	20722
Entropy (8bit):	4.488414715022578
Encrypted:	false
SSDEEP:	384:JrHt9punJle4a5BQN5RIpZDcEM5VpcgCK3SiwwOlfmHVMTy6N++h/crMcssh3kNY:5ycgCK3SiwwOleHVMTy8ossh3kNBVBsv
MD5:	F14D920CA55700E43C6890FC01C15DFF
SHA1:	E43FBDF29089D3B75CE4DBD4AF5B790D7DDF0FB6
SHA-256:	E87E7C31F78E9CB58D2A877A6DE258A815B0F2060E556D56F9C104D811E43AE3
SHA-512:	271475318F60F32492099EEB46C3A8336DC18EC5170B8D54E6EB730CB84E5B8F866F7E9023B953EBA7F3D01F3F7571BB27BD1254FA631892EEC3DFAA8CC93579
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,. compat_urlparse,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_iso8601,. qualities,. smuggle_url,. try_get,. unsmuggle_url,. update_url_query,. url_or_none,.)...class TVPlayIE(InfoExtractor):. IE_NAME = 'mtg'. IE_DESC = 'MTG services'. _VALID_URL = r'''(?x). (?:. mtg:\|. https?://. (?:www\.)?. (?:. tvplay(?:\.skaties)?\.lv(?:/parraides)?\|. (?:tv3play\|play\.tv3)\.lt(?:/programos)?\|. tv3play(?:\.tv3)?\.ee/sisu\|. (?:tv(?:3\|6\|8\|10)play\|viafree)\.se/program\|. (?:(?:tv3play\|viasat4play\|tv6p

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SS236.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3020
Entropy (8bit):	4.673002562051286
Encrypted:	false
SSDEEP:	48:+uEWOwCKocz/jzd8BhPIULtSi01JoXjlhlbYOyl7fuqtcTMd0LO0YtBTtHjN3a6G:TONKog/XGhPltSiqJslbSNDtcgd0LOfC
MD5:	B6D2E72C4548034F8553C6BC8A37FB52
SHA1:	603F94677DA465ABBEF6ABD1DB756CA4E8F2DFFA
SHA-256:	A1F9601A815361D109C078B6BF267077AFC5F77533553B19C09F1F0BEFDEDAA9
SHA-512:	EB9F6938EB06CD494205A6F006CF02C753EFF53658B87189793644806AA6FCAC565AA139AF8CA46A24EC307E10BD715B2E456F15B8976C2C227D1298F5671D11
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. extract_attributes,. get_element_by_class,. int_or_none,. parse_duration,. parse_iso8601,.)...class TV5MondePlusIE(InfoExtractor):. IE_DESC = 'TV5MONDE+'. _VALID_URL = r'https?://(?:www\.)?tv5mondeplus\.com/toutes-les-videos/[^/]+/(?P<id>[^/?#]+)'. _TEST = {. 'url': 'http://www.tv5mondeplus.com/toutes-les-videos/documentaire/tdah-mon-amour-tele-quebec-tdah-mon-amour-ep001-enfants',. 'md5': '12130fc199f020673138a83466542ec6',. 'info_dict': {. 'id': 'tdah-mon-amour-tele-quebec-tdah-mon-amour-ep001-enfants',. 'ext': 'mp4',. 'title': 'Tdah, mon amour - Enfants',. 'description': 'md5:230e3aca23115afcf8006d1bece6df74',. 'upload_date': '20170401',. 'timestamp': 1491022860,. }. }. _GEO_BYPASS = False.. def _real_extract(se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-SVSKU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2412
Entropy (8bit):	4.9309054362841165
Encrypted:	false
SSDEEP:	48:+uvWOJoN+xflcNlmHb5lntfdfFQYvbOWBBVvtXcB3Twwdagy1beXR9BnVx6/6NF+:KOJQ+5iNGb53fTlFX+Ny1bc7s6NF+
MD5:	238193B28DBA51A2AEAE9628D4AE9693
SHA1:	B7920E685D16BFB9A87581771F66DAC325DFB45D
SHA-256:	BD5CD93D5AFB777A15499CFA5E8C48BD22D1DC58FFA93548E677A0DAE95E2B38
SHA-512:	5B20C7E43F57DFEBA91394C83B9D3C1E3120446C04C53AFBE70BA1C044435F2CBDD0A692F5ABDD96483A425F7D3E85EFFE022819AF93D37F5ED596D9D079E69F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. unescapeHTML,.)...class CJSWIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?cjsw\.com/program/(?P<program>[^/]+)/episode/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://cjsw.com/program/freshly-squeezed/episode/20170620',. 'md5': 'cee14d40f1e9433632c56e3d14977120',. 'info_dict': {. 'id': '91d9f016-a2e7-46c5-8dcb-7cbcd7437c41',. 'ext': 'mp3',. 'title': 'Freshly Squeezed . Episode June 20, 2017',. 'description': 'md5:c967d63366c3898a80d0c7b0ff337202',. 'series': 'Freshly Squeezed',. 'episode_id': '20170620',. },. }, {. # no description. 'url': 'http://cjsw.com/program/road-pops/episode/20170707/',. 'only_matching': True,. }].. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). prog

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-T0J2H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	4.455459272137363
Encrypted:	false
SSDEEP:	48:+uoWODyZS40fRLyNbX3NqaJ8hr1+Bn95EpYHKc1nxPjNBT+6NYbtc:HODyZS40fRLgX3saJiO95EIKc1nxPZBH
MD5:	8723F038F3AEAFA1789CA36513A31378
SHA1:	1E0BE257D85F92D77DD73EC31769AD6913B0AF07
SHA-256:	46B3173E761200C0386F0B65C7C14615C8F4FD639AB0289BA36B6071F664029C
SHA-512:	62CF4E19C4E1850921D9DBF2B6670C0B3C76433DE425979F4A8A3BB5C6EFFF1157A6944847C23EFCF499EC56CE0E866DD4F1BC02559757713060E34ACD014F60
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. js_to_json,.)...class MuenchenTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?muenchen\.tv/livestream'. IE_DESC = 'm.nchen.tv'. _TEST = {. 'url': 'http://www.muenchen.tv/livestream/',. 'info_dict': {. 'id': '5334',. 'display_id': 'live',. 'ext': 'mp4',. 'title': 're:^m.nchen.tv-Livestream [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'is_live': True,. 'thumbnail': r're:^https?://.\.jpg$'. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. display_id = 'live'. webpage = self._download_webpage(url, display_id).. title = self._live_title(self._og_search_title(webpage)).. data_js = self._search_regex(. r'(?s)\nplaylist:\s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-T15LO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4156
Entropy (8bit):	5.095850204253975
Encrypted:	false
SSDEEP:	96:tO4U5X1CNvof7M23aa6aLOG3vNBTuxz/NC6NWLG7oND4LoqImCrAfJsDFMkf:cVz8ve7P3aeLOG3vTTui6N65D4LoqTz+
MD5:	AA95D08F6F92581F2A47A4BC92CB1E39
SHA1:	EE0F14D67CFEE3204AB1BAFAB67562E028891504
SHA-256:	4307C87D5930617CAF65098127CC72263C73E7927DFC50177EE73DE14FA6EC49
SHA-512:	0E01128B9AFE59829D9AA7D986935C6082CEEFE4F345C74D1450AA393ACBF646CC2C6CD4B0975D57FAD017C372BCA4A3838A48C7002CFF4D3B16A6F499E3EFEC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. int_or_none,. url_or_none,.)...class RENTVIE(InfoExtractor):. _VALID_URL = r'(?:rentv:\|https?://(?:www\.)?ren\.tv/(?:player\|video/epizod)/)(?P<id>\d+)'. _TESTS = [{. 'url': 'http://ren.tv/video/epizod/118577',. 'md5': 'd91851bf9af73c0ad9b2cdf76c127fbb',. 'info_dict': {. 'id': '118577',. 'ext': 'mp4',. 'title': '.............. ..........: "........ ....... .......... XXI ...."',. 'timestamp': 1472230800,. 'upload_date': '20160826',. }. }, {. 'url': 'http://ren.tv/player/118577',. 'only_matching': True,. }, {. 'url': 'rentv:118577',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-T4UT6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4679
Entropy (8bit):	4.714557259885319
Encrypted:	false
SSDEEP:	96:2ZoqmJtRod74YdQ+8rUWB1raXeABffxH6EfWj++BT4Oq6NjM:2ZLsje79WB1AeUffxaEujtTG6NjM
MD5:	AEB3B1B966BA85879BB5AF3443311743
SHA1:	BBF1B27FBFE51AD2FB68BAF94D8383467574AD16
SHA-256:	076CC75BF37358C47581372933557020BFA87A0FB5D3D9D088352993300C6CEE
SHA-512:	4D058E6EBD667C421186768079417FC8434770F1D7D7C4B85A08AB3C9CC1C72C46A838C0E27839A3FAA07119E12477C9E64F04117F45FD1A71092D802FDFC761
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .theplatform import ThePlatformFeedIE.from ..utils import (. ExtractorError,. int_or_none,. find_xpath_attr,. xpath_element,. xpath_text,. update_url_query,.)...class CBSBaseIE(ThePlatformFeedIE):. def _parse_smil_subtitles(self, smil, namespace=None, subtitles_lang='en'):. subtitles = {}. for k, ext in [('sMPTE-TTCCURL', 'tt'), ('ClosedCaptionURL', 'ttml'), ('webVTTCaptionURL', 'vtt')]:. cc_e = find_xpath_attr(smil, self._xpath_ns('.//param', namespace), 'name', k). if cc_e is not None:. cc_url = cc_e.get('value'). if cc_url:. subtitles.setdefault(subtitles_lang, []).append({. 'ext': ext,. 'url': cc_url,. }). return subtitles...class CBSIE(CBSBaseIE):. _VALID_URL = r'(?:cbs:\|https?://(?:www\.)?(?:cbs\.com/shows/[^/]+/video\|colbertlateshow\.com/(?:video\|podcasts)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-T5JDG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	4.845406996005191
Encrypted:	false
SSDEEP:	48:+ur1dOMWuOnXBEjXjlkeXNxGgPOs746g0anGly7:31dOMWuOnXBEqOxXn4B0an8o
MD5:	944E5740D5E8F4E7E4DC2BAA14A31DD2
SHA1:	B055D1782360080FE09B90351507A3D8B7AFC1AD
SHA-256:	12F91AAD6562439E028D08F01BB372EFF10927C3B90DF75F6A39DFA6BDB4A5C4
SHA-512:	336984B9975EF45C5A3635E0A7E51C552ABDBEA71C4162B53B87E84E3ABB941AC5BDA394E50A0218A2326097121383FBAB3B25BD9642C9A6D6C7E91BBD70B7B6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. str_to_int,. ExtractorError.)...class AppleConnectIE(InfoExtractor):. _VALID_URL = r'https?://itunes\.apple\.com/\w{0,2}/?post/idsa\.(?P<id>[\w-]+)'. _TEST = {. 'url': 'https://itunes.apple.com/us/post/idsa.4ab17a39-2720-11e5-96c5-a5b38f6c42d3',. 'md5': 'e7c38568a01ea45402570e6029206723',. 'info_dict': {. 'id': '4ab17a39-2720-11e5-96c5-a5b38f6c42d3',. 'ext': 'm4v',. 'title': 'Energy',. 'uploader': 'Drake',. 'thumbnail': r're:^https?://.\.jpg$',. 'upload_date': '20150710',. 'timestamp': 1436545535,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. try:. video_json = self._html_search_regex(. r'class="auc-video-data">(\{.?\})', webpage,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-T7DM9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	5.093263475458913
Encrypted:	false
SSDEEP:	48:+u19o7sAQVPFIucynb0jXhkdBSYBb775qGl3kuhBTeeBeaLbSt46Ng:87AVPFIucyQal5dl3NhBTeqbSt46Ng
MD5:	28EC505B949E66C1A171EFB767C98205
SHA1:	6413948CC0C630E7454EEBDFD87F232A85130005
SHA-256:	75687E2F0ED68A052E31021A85C6CFB0C86C3BDC61292887D873FEB50517F155
SHA-512:	BF34641BC66CDA8D22C7A836FB09A750BF29A8A3812D8509D3CBCA80FE8E659D65C9E91DBF907AA7661AADBF4EADBDA737EC38E394AD15F4C9A4ACF8EA8119BA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class ZypeIE(InfoExtractor):. _VALID_URL = r'https?://player\.zype\.com/embed/(?P<id>[\da-fA-F]+)\.js\?.?api_key=[^&]+'. _TEST = {. 'url': 'https://player.zype.com/embed/5b400b834b32992a310622b9.js?api_key=jZ9GUhRmxcPvX7M3SlfejB6Hle9jyHTdk2jVxG7wOHPLODgncEKVdPYBhuz9iWXQ&autoplay=false&controls=true&da=false',. 'md5': 'eaee31d474c76a955bdaba02a505c595',. 'info_dict': {. 'id': '5b400b834b32992a310622b9',. 'ext': 'mp4',. 'title': 'Smoky Barbecue Favorites',. 'thumbnail': r're:^https?://.\.jpe?g',. },. }.. @staticmethod. def _extract_urls(webpage):. return [. mobj.group('url'). for mobj in re.finditer(. r'<script[^>]+\bsrc=(["\'])(?P<url>(?:https?:)?//player\.zype\.com/embed/[\da-fA-F]+\.js\?.*?api_key=.+?)\1',. webpage)].. def _real_extra

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-T93QJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3446
Entropy (8bit):	4.734751452304194
Encrypted:	false
SSDEEP:	96:nUU/q2UXXj2B1vk9f1iE5c5BTJxLDnSIdKNx/PnF/3Wwt/860F6Nq:nUUyDazvkd1ipXTJ1DqtMP6Nq
MD5:	1C4DB53AA6DDB9D3D57C2F2B0DAAD5E3
SHA1:	C0AC86944CBF4BDADAA254B2E9C805CB0B1CAD59
SHA-256:	58AFB4136EF3FBC3365079D3EFAE82C6EFE41EE40A8D247E0558FCA0A3F8BCA3
SHA-512:	5402D1C41A0DF7BB211762B90FF87DAAA548D982C75269D707B0467F128B87492413493D89E053BE4FBCE9C38E5FB11721078D5909AEBD1CB433F7319EBB323B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. remove_end,. remove_start,. str_to_int,. unified_strdate,.)...class PinkbikeIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.)?pinkbike\.com/video/\|es\.pinkbike\.org/i/kvid/kvid-y5\.swf\?id=)(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.pinkbike.com/video/402811/',. 'md5': '4814b8ca7651034cd87e3361d5c2155a',. 'info_dict': {. 'id': '402811',. 'ext': 'mp4',. 'title': 'Brandon Semenuk - RAW 100',. 'description': 'Official release: www.redbull.ca/rupertwalker',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 100,. 'upload_date': '20150406',. 'uploader': 'revelco',. 'location': 'Victoria, British Columbia, Canada',. 'view_count': int,. 'comment_count': int,. }. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-T9EP5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2625
Entropy (8bit):	5.008694010859418
Encrypted:	false
SSDEEP:	48:+u5qPEzD/N03rD1awESFAbf4aqG/4YObVBT/zFC73UNe6NY/gwqKElfFIf4zKM4U:YsD/NYrQwEt4adA7VBTJC73UNe6NY/gt
MD5:	A264F1A6A1E23F35AD34497ADD7AE3C7
SHA1:	B03F7285D9478F97749785C190A929EE3FC81F69
SHA-256:	EDD9C74C7D06C247757E1C602A149AB4DDA57F43A0123A2E0EFBB07684668EB6
SHA-512:	38FE1BEA86CD08FB04370654C9F9386089B711A1AA6198BDD3C630BE9CFB391EF166C6AE6289F5A0A23F3B34AF1D8F72EF039A4C18093251818F0DD00BE38D1E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. float_or_none,. ExtractorError,.)...class UplynkIE(InfoExtractor):. IE_NAME = 'uplynk'. _VALID_URL = r'https?://.?\.uplynk\.com/(?P<path>ext/[0-9a-f]{32}/(?P<external_id>[^/?&]+)\|(?P<id>[0-9a-f]{32}))\.(?:m3u8\|json)(?:.?\bpbs=(?P<session_id>[^&]+))?'. _TEST = {. 'url': 'http://content.uplynk.com/e89eaf2ce9054aa89d92ddb2d817a52e.m3u8',. 'info_dict': {. 'id': 'e89eaf2ce9054aa89d92ddb2d817a52e',. 'ext': 'mp4',. 'title': '030816-kgo-530pm-solar-eclipse-vid_web.mp4',. 'uploader_id': '4413701bf5a1488db55b767f8ae9d4fa',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. def _extract_uplynk_info(self, uplynk_content_url):. path, external_id, video_id, session_id = re.match(UplynkIE._VALID_URL, uplynk_content_url).groups().

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TA7KJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	896
Entropy (8bit):	5.145762931416938
Encrypted:	false
SSDEEP:	24:zi8lFv+G8Cew3t4+crgIgt/XxdlHE5f/T2gaeIXjrFE:+uArWturGXx45HT2gajXjrFE
MD5:	7422AF19C8029B85E07C5B7BDD7D26E1
SHA1:	318B133793BC517938A77E01F2CA12C89BB74777
SHA-256:	FFFF16CA0B80406351E48988458ECD2234DC649B5EFD2CD138FBE4AE792C4B9B
SHA-512:	3C66BE559F5F52D11F972E4DFC3334A5AD5F802081E82DFBC782A7A74E5DD78F5393C5F501DD1A8913FDF2539F5762F12B0140155F3F2B9D57F44C7397F9EFDA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class M6IE(InfoExtractor):. IE_NAME = 'm6'. _VALID_URL = r'https?://(?:www\.)?m6\.fr/[^/]+/videos/(?P<id>\d+)-[^\.]+\.html'.. _TEST = {. 'url': 'http://www.m6.fr/emission-les_reines_du_shopping/videos/11323908-emeline_est_la_reine_du_shopping_sur_le_theme_ma_fete_d_8217_anniversaire.html',. 'md5': '242994a87de2c316891428e0176bcb77',. 'info_dict': {. 'id': '11323908',. 'ext': 'mp4',. 'title': 'Emeline est la Reine du Shopping sur le th.me . Ma f.te d.anniversaire ! .',. 'description': 'md5:1212ae8fb4b7baa4dc3886c5676007c2',. 'duration': 100,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). return self.url_result('6play:%s' % video_id, 'SixPlay', video_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TAOFT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4134
Entropy (8bit):	4.739967978432912
Encrypted:	false
SSDEEP:	96:I/d/dZRRwViMUI8vSeVfcfQ1VOx3NaRpINRviv2TIavnLtk:ERdZjwcTVvnVcfsVO5NaXcvJ6
MD5:	9AB355A119E08E1C09E2F5FA4DEC0A11
SHA1:	3EB4AF5F026D9C40045FE25E292C170F3F540582
SHA-256:	D298694544A895D7C0B86698239145C977EA81406FEABD339F5520AE95682E7A
SHA-512:	7A7B8C8FA90394494D332A076BE268D495D65399E0B899C025B4802BF10B786F70FE9FFE8C83F243F4F79F3A02F37D01D7166826862E3CC5A8132513FBB4BA94
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote,. compat_urlparse,.).from ..utils import (. ExtractorError,. clean_html,. get_element_by_id,.)...class VeeHDIE(InfoExtractor):. _VALID_URL = r'https?://veehd\.com/video/(?P<id>\d+)'.. # Seems VeeHD videos have multiple copies on several servers, all of. # whom have different MD5 checksums, so omit md5 field in all tests. _TESTS = [{. 'url': 'http://veehd.com/video/4639434_Solar-Sinter',. 'info_dict': {. 'id': '4639434',. 'ext': 'mp4',. 'title': 'Solar Sinter',. 'uploader_id': 'VideoEyes',. 'description': 'md5:46a840e8692ddbaffb5f81d9885cb457',. },. 'skip': 'Video deleted',. }, {. 'url': 'http://veehd.com/video/4905758_Elysian-Fields-Channeling',. 'info_dict': {. 'id': '4905758',. 'ext': 'mp4'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TD991.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3173
Entropy (8bit):	4.8192059818017015
Encrypted:	false
SSDEEP:	96:KOamBhXjC8wzR8cyTa2fXUAEzMhPLOt3vsBTe8pt46Ng:HaKVwzUa2fXU/CLOt3vETG6Ng
MD5:	71B47ADEAB76076CB0D36A4316270680
SHA1:	9EEAA5EE2418CB18E9468BA4FB2832BE47904FE6
SHA-256:	DA0A65A6E1B5033062959C0D351331CEC33138B45E4E3F5B6FDB42654E496A85
SHA-512:	2142F92DCBF67641CCD14C02AF21D73F131385F303A9AA9922739A70444FC41EC7E687241E689C55DFCD0802DB7C251C61036B40125471946F8B4F26DAB8A994
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. js_to_json,. url_or_none,.)...class APAIE(InfoExtractor):. _VALID_URL = r'https?://[^/]+\.apa\.at/embed/(?P<id>[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12})'. _TESTS = [{. 'url': 'http://uvp.apa.at/embed/293f6d17-692a-44e3-9fd5-7b178f3a1029',. 'md5': '2b12292faeb0a7d930c778c7a5b4759b',. 'info_dict': {. 'id': 'jjv85FdZ',. 'ext': 'mp4',. 'title': '"Blau ist mysteri.s": Die Blue Man Group im Interview',. 'description': 'md5:d41d8cd98f00b204e9800998ecf8427e',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 254,. 'timestamp': 1519211149,. 'upload_date': '20180221',. },. }, {. 'url': 'https://uvp-apapublisher.sf.apa.at/embed/2f94e9e6-d945-4db2-9548-f9a41ebf7b78',. 'only_matching': True,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TFGUO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4580
Entropy (8bit):	4.596733685863675
Encrypted:	false
SSDEEP:	96:kSw5q73nintvnOg5x/zoa5mOZm20IuGXpOwXrkOkPJSDrBTe1itDNRF6Ng:kSws73itvOgLfVjPtZOYmcDdTX6Ng
MD5:	986BF3E4ABC7F9C7EC5C3C83476A917F
SHA1:	A4E93177850BC1ECBDEF1DAF6C43B36D87B87A7B
SHA-256:	7555A806B670725FD555FB37CEC0754556F9D265916EB0B7F65D4448B94987DD
SHA-512:	4BE20D60B5CB4AA37DE0AA9A37682305833FDEBCDE254872C57C944144305F02BEDC27FA30ABB859001BCD63EA7B677937DE7A53ED3218EF485AFA95A844BE84
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_parse_qs.from ..utils import (. xpath_text,. xpath_element,. int_or_none,. parse_iso8601,. ExtractorError,.)...class RICEIE(InfoExtractor):. _VALID_URL = r'https?://mediahub\.rice\.edu/app/[Pp]ortal/video\.aspx\?(?P<query>.+)'. _TEST = {. 'url': 'https://mediahub.rice.edu/app/Portal/video.aspx?PortalID=25ffd62c-3d01-4b29-8c70-7c94270efb3e&DestinationID=66bc9434-03bd-4725-b47e-c659d8d809db&ContentID=YEWIvbhb40aqdjMD1ALSqw',. 'md5': '9b83b4a2eead4912dc3b7fac7c449b6a',. 'info_dict': {. 'id': 'YEWIvbhb40aqdjMD1ALSqw',. 'ext': 'mp4',. 'title': 'Active Learning in Archeology',. 'upload_date': '20140616',. 'timestamp': 1402926346,. }. }. _NS = 'http://schemas.datacontract.org/2004/07/ensembleVideo.Data.Service.Contracts.Models.Player.Config'.. def _real_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TGON2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3375
Entropy (8bit):	4.483707203021895
Encrypted:	false
SSDEEP:	96:KP/IkGeNiLXkfzzoWqez2aROG+0TNExBzo2zAmVNs6Nz:C/IkD+XSzzke6YOG+0K/zoF6Nz
MD5:	3B3DBF23C9786760D7BA382B4CBBAB90
SHA1:	79AD35B1821BEB686FE3ED3A2B48689FCC95E770
SHA-256:	01FE8FB677B5FA2202CF43846D63F40FEBD7001DDFABE187D1FC43980C59363F
SHA-512:	0FCB86C25DDCC8801B1630C2FDCEFA69F461F3CDEC9339AF605C86FAD8417C699E7CAB7E38C87F76CF5A24048354A65E3B4B921DA3D65BBBAA39402428842599
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. merge_dicts,. mimetype2ext,. url_or_none,.)...class AparatIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?aparat\.com/(?:v/\|video/video/embed/videohash/)(?P<id>[a-zA-Z0-9]+)'.. _TESTS = [{. 'url': 'http://www.aparat.com/v/wP8On',. 'md5': '131aca2e14fe7c4dcb3c4877ba300c89',. 'info_dict': {. 'id': 'wP8On',. 'ext': 'mp4',. 'title': '... ..... 11 - .....',. 'description': 'md5:096bdabcdcc4569f2b8a5e903a3b3028',. 'duration': 231,. 'timestamp': 1387394859,. 'upload_date': '20131218',. 'view_count': int,. },. }, {. # multiple formats. 'url': 'https://www.aparat.com/v/8dflw/',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. # Pro

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TJML1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	4.800779868816139
Encrypted:	false
SSDEEP:	48:+uvWyeOfrZDD4adfFkZVAhSZK4JKJKwAK4JyasfTbaZK1eVZVWeiaHwHUHs6N1tu:rreOTZDD4aGISLiX4c/aMMij6N1tN0z
MD5:	F278C34141C82ACE965000D2392CC89E
SHA1:	9F4069496CA2906422BDA07CE0F3F712D8578664
SHA-256:	7075C85D7E17204597F13424FB0B1F707BB6BC184FD68666F393DBE41868CDF9
SHA-512:	12D8351CAC651793B878F54F4242F1C58F0DA05AF929343B7735339CEA85A99015186165EE4B866C638DE54B3A0E34E0BE84884924DE57674CAC511F9A132982
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import remove_start...class PressTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?presstv\.ir/[^/]+/(?P<y>\d+)/(?P<m>\d+)/(?P<d>\d+)/(?P<id>\d+)/(?P<display_id>[^/]+)?'.. _TEST = {. 'url': 'http://www.presstv.ir/Detail/2016/04/09/459911/Australian-sewerage-treatment-facility-/',. 'md5': '5d7e3195a447cb13e9267e931d8dd5a5',. 'info_dict': {. 'id': '459911',. 'display_id': 'Australian-sewerage-treatment-facility-',. 'ext': 'mp4',. 'title': 'Organic mattresses used to clean waste water',. 'upload_date': '20160409',. 'thumbnail': r're:^https?://.*\.jpg',. 'description': 'md5:20002e654bbafb6908395a5c0cfcd125'. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). display_id = mobj.group

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TLA49.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3389
Entropy (8bit):	4.56191882369334
Encrypted:	false
SSDEEP:	96:lOzPSdmpKCYegCK5xrcLNvMastAaXgmmXFpMwxtLOdzi3y8s1RhjBTI6Nj860Nx:0zPSVClMCLNAypTLOdzi3nsDhFTI6N4l
MD5:	6A356564DFC809A5B56B2A940ADF8BA3
SHA1:	8A6453A329F59F7732236D42E9614854526A1EBD
SHA-256:	3EA56805A4DC00367260C47BF63E23100AF85BF6C6D4B98F02AD3CA0FACBA414
SHA-512:	68BF8868B93ED1C23310E161B57F9A0202C37FDD6F2366506935704D27A7A6A2A45D51EEA193BB0550411F11348845279992FEBAC45E9F9D2C9F2E9CFDF71E2D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. parse_duration,. unified_strdate,.)...class HuffPostIE(InfoExtractor):. IE_DESC = 'Huffington Post'. _VALID_URL = r'''(?x). https?://(embed\.)?live\.huffingtonpost\.com/. (?:. r/segment/[^/]+/\|. HPLEmbedPlayer/\?segmentId=. ). (?P<id>[0-9a-f]+)'''.. _TEST = {. 'url': 'http://live.huffingtonpost.com/r/segment/legalese-it/52dd3e4b02a7602131000677',. 'md5': '55f5e8981c1c80a64706a44b74833de8',. 'info_dict': {. 'id': '52dd3e4b02a7602131000677',. 'ext': 'mp4',. 'title': 'Legalese It! with @MikeSacksHP',. 'description': 'This week on Legalese It, Mike talks to David Bosco about his new book on the ICC, "Rough Justice," he also discusses the Virginia AG\'s historic stance on gay marriage, the execution of Edgar Tamayo, the ICC\'s delay of K

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TN6Q0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2249
Entropy (8bit):	4.632909129109805
Encrypted:	false
SSDEEP:	48:+uqwE9N2zO380LZaOZXlBGe3vG7aIZBoABT3v2eSrMWb6NQ7LD:49N2zO38aZaOfBGee7hBTBTOeSrMWb6q
MD5:	798BC17908F817B18BA20AB24063540F
SHA1:	575B267312641E703F06A5EAC183941DA942284D
SHA-256:	3C436B7F2AF74F53E2A1981B6BC8A3A3140AF3B76E110C98A5744335559A3AAE
SHA-512:	7E5193856EA2CF5C6EB8FF6570F2B9F39E1E63D328CF057CE33FFE9F886348432373CAD777519E4185D2FD7861264D356C68367A5C03245DF0D0210401B7545E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse,.).from ..utils import (. unified_strdate,.)...class UrortIE(InfoExtractor):. IE_DESC = 'NRK P3 Ur.rt'. _VALID_URL = r'https?://(?:www\.)?urort\.p3\.no/#!/Band/(?P<id>[^/]+)$'.. _TEST = {. 'url': 'https://urort.p3.no/#!/Band/Gerilja',. 'md5': '5ed31a924be8a05e47812678a86e127b',. 'info_dict': {. 'id': '33124-24',. 'ext': 'mp3',. 'title': 'The Bomb',. 'thumbnail': r're:^https?://.+\.jpg',. 'uploader': 'Gerilja',. 'uploader_id': 'Gerilja',. 'upload_date': '20100323',. },. 'params': {. 'matchtitle': '^The Bomb$', # To test, we want just one video. }. }.. def _real_extract(self, url):. playlist_id = self._match_id(url).. fstr = compat_urllib_parse.quote("InternalBandUrl eq '%s'" % playlist_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TN8UU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1647
Entropy (8bit):	5.006256466074209
Encrypted:	false
SSDEEP:	48:+uKVoEydM1+yksRTtkXuadfFfVlhuB8eArOPF+veq0P:u+EcGKsRTtkXuab9le3I90P
MD5:	FB421A2E58097394C6434D2BFE9E2F2A
SHA1:	F3A401A5C89B2BD002F1CDED90D1253A333766EC
SHA-256:	CC980E60B7A04E7006453E1A15FFBD5F5908CCE33FF5ECCC6A84DBF1823BE16C
SHA-512:	CF5B5069CD982AAC553035F7FA6EACFF17185B1A65503E40086745C42ADA7E9B077E43E556D92B0992672C7637122E92C4C5A64065F4778B73F0522A76F6417F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import url_basename...class BehindKinkIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?behindkink\.com/(?P<year>[0-9]{4})/(?P<month>[0-9]{2})/(?P<day>[0-9]{2})/(?P<id>[^/#?_]+)'. _TEST = {. 'url': 'http://www.behindkink.com/2014/12/05/what-are-you-passionate-about-marley-blaze/',. 'md5': '507b57d8fdcd75a41a9a7bdb7989c762',. 'info_dict': {. 'id': '37127',. 'ext': 'mp4',. 'title': 'What are you passionate about . Marley Blaze',. 'description': 'md5:aee8e9611b4ff70186f752975d9b94b4',. 'upload_date': '20141205',. 'thumbnail': 'http://www.behindkink.com/wp-content/uploads/2014/12/blaze-1.jpg',. 'age_limit': 18,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). display_id = mobj.group('id').. webpage = self._

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TO0Q8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	4.85016276369869
Encrypted:	false
SSDEEP:	48:PuTR3bECRuA1dZ6bfO2Nz4Oh5BqyFdrBwEAxqQ/TMfo57NTlCEdNJnon:oVhuA1dZ6Jz4Oh5BqyTjAVqKNw8A
MD5:	FC1FADAE9C5ADD5259F42AFA799DFC5B
SHA1:	BF04294CACE7561374D7EC8151F18169D1EB4898
SHA-256:	CDB8625355B6321B11144059C006AC2BAED4A83C6BF2DCAEBD348BA861EAD777
SHA-512:	C101D92D3A6A9C90C86FCE2DBF15EA71C8828007CA6AB18FCBA0DE884D78206A120413C63159FF5340CCED364D920C9ECFCD1D0E7C004876517B89BACF9783BE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .fox import FOXIE.from ..utils import (. smuggle_url,. url_basename,.)...class NationalGeographicVideoIE(InfoExtractor):. IE_NAME = 'natgeo:video'. _VALID_URL = r'https?://video\.nationalgeographic\.com/.*?'.. _TESTS = [. {. 'url': 'http://video.nationalgeographic.com/video/news/150210-news-crab-mating-vin?source=featuredvideo',. 'md5': '730855d559abbad6b42c2be1fa584917',. 'info_dict': {. 'id': '0000014b-70a1-dd8c-af7f-f7b559330001',. 'ext': 'mp4',. 'title': 'Mating Crabs Busted by Sharks',. 'description': 'md5:16f25aeffdeba55aaa8ec37e093ad8b3',. 'timestamp': 1423523799,. 'upload_date': '20150209',. 'uploader': 'NAGS',. },. 'add_ie': ['ThePlatform'],. },. {. 'url': 'http://video.nationalgeographic.com/wi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TRKCO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	4.757003376707331
Encrypted:	false
SSDEEP:	48:PuJQdzV4cSCVagEZXRxNcQYnzuviECSHBe3XmEZ5/L:YQdzV4cSCVagEPcBKaEc32Ez/L
MD5:	A2EED26E1C7512DB3A5B7E532D1E3951
SHA1:	D9A5E70709514E66B3C9289D83E8B77C2E4D8AF2
SHA-256:	0D8D65AA6B0AFCE4F307FCF80376CE56E9C01E894D6BC7D8C0E18C325C1C4422
SHA-512:	89149553654E0D3228E31799DF075867AA9F3CEABBC50766B7A7BB06112EC3C6BC9FCF2685AAF086714274EF2F32B5C64005A08B2A7AD9C2AD127D706FAC2111
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import int_or_none...class HypemIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?hypem\.com/track/(?P<id>[0-9a-z]{5})'. _TEST = {. 'url': 'http://hypem.com/track/1v6ga/BODYWORK+-+TAME',. 'md5': 'b9cc91b5af8995e9f0c1cee04c575828',. 'info_dict': {. 'id': '1v6ga',. 'ext': 'mp3',. 'title': 'Tame',. 'uploader': 'BODYWORK',. 'timestamp': 1371810457,. 'upload_date': '20130621',. }. }.. def _real_extract(self, url):. track_id = self._match_id(url).. response = self._download_webpage(url, track_id).. track = self._parse_json(self._html_search_regex(. r'(?s)<script\s+type="application/json"\s+id="displayList-data">(.+?)</script>',. response, 'tracks'), track_id)['tracks'][0].. track_id = track['id']. title = track['song'].. final_url = s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-TSR7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6855
Entropy (8bit):	4.433103167772955
Encrypted:	false
SSDEEP:	192:PefQY5zvUOOMj7zu+8r2ajJi6U/BdV3b354bra6Fvh+TIv6Ng:wQY5zvUOOMj7zu+mPjJi3dVL35Yra6lD
MD5:	48FE2B597C0F5B23BC22AF5A5C3FFDFB
SHA1:	FBA8324E2900EB10EF13127A3C577C5E3A534E70
SHA-256:	02F319818BF19D9149335EB293523BAA073770EF7435F5BA1C82E7F7D75BB905
SHA-512:	6972C35E97E41B302E45D73FD7FCDB9E8724F1D53C859E7153F0C74E3EE5446E929A19558BB14431256677F3BF1569FD036A9B3525ACF77A88A26D3AC4F354F6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. determine_ext,. int_or_none,. parse_duration,. parse_iso8601,. xpath_text,.)...class MDRIE(InfoExtractor):. IE_DESC = 'MDR.DE and KiKA'. _VALID_URL = r'https?://(?:www\.)?(?:mdr\|kika)\.de/(?:.*)/[a-z-]+-?(?P<id>\d+)(?:_.+?)?\.html'.. _TESTS = [{. # MDR regularly deletes its videos. 'url': 'http://www.mdr.de/fakt/video189002.html',. 'only_matching': True,. }, {. # audio. 'url': 'http://www.mdr.de/kultur/audio1312272_zc-15948bad_zs-86171fdd.html',. 'md5': '64c4ee50f0a791deb9479cd7bbe9d2fa',. 'info_dict': {. 'id': '1312272',. 'ext': 'mp3',. 'title': 'Feuilleton vom 30. Oktober 2015',. 'duration': 250,. 'uploader': 'MITTELDEUTSCHER RUNDFUNK',. },. 'skip': '404 not found',. }, {. 'url': 'ht

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-U2M7A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (384)
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	4.915769508918261
Encrypted:	false
SSDEEP:	48:+uVYaaeYuRxpbHA90+bHYM6R6rD1PNjXjlkFX/m2p0gzj64eXUqv+Mf:JaeYu5bHWFHWR6rJNqtLagqt2Mf
MD5:	CA3533FAC0BCFF9E9E8FA8DAA58D08F1
SHA1:	0423000BAFAD5AA5A5118DCE23E476380616FDA0
SHA-256:	9B894D7257EA1C16E5FA71DFDFEE0737558DCB13DA4CDC7C3410186C8B12217A
SHA-512:	C60C8B3EB80B66963F56203C66A0BEABDB68C8900F9C7489986BEEE41D1CB949AC4718B3A0D6739A04C1A2F4D88B90E05B5123B8E01FEB807F789BCFC843FAC8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .jwplatform import JWPlatformIE..from ..utils import (. unified_strdate,.)...class NormalbootsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?normalboots\.com/video/(?P<id>[0-9a-z-]*)/?$'. _TEST = {. 'url': 'http://normalboots.com/video/home-alone-games-jontron/',. 'info_dict': {. 'id': 'home-alone-games-jontron',. 'ext': 'mp4',. 'title': 'Home Alone Games - JonTron - NormalBoots',. 'description': 'Jon is late for Christmas. Typical. Thanks to: Paul Ritchey for Co-Writing/Filming: http://www.youtube.com/user/ContinueShow Michael Azzi for Christmas Intro Animation: http://michafrar.tumblr.com/ Jerrod Waters for Christmas Intro Music: http://www.youtube.com/user/xXJerryTerryXx Casey Ormond for .Tense Battle Theme.:\xa0http://www.youtube.com/Kiamet/',. 'uploader': 'JonTron',. 'upload_date': '20140

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-U2VLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11343
Entropy (8bit):	4.681751372273376
Encrypted:	false
SSDEEP:	192:BHC9pGwEoy3E//yavl1ABe0cvRYRYOOrKuorvsST17i3/6N+9WRqiUaNVlOF5F6N:gfG15kOO/orsSTgP6NrlOF5F6fobR1I
MD5:	F9798D3F040CA8E39952EC3F961C306C
SHA1:	E713CDE0AEB5F966632078AB6622882969B5FA3A
SHA-256:	16A44F3B950CDF104A3F97F341C3C2B597158E1306F473B734821A79107498AC
SHA-512:	DB84D742186589B574F2C157CE5D5B6F50448E7635A08BBAAC86EC833489D4A2AC70961FE9936943878892E56719B91FF66EC08DBF48C801C74E5A5C2EE4A415
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_chr,. compat_ord,. compat_str,. compat_urllib_parse_unquote,. compat_zip.).from ..utils import (. int_or_none,. parse_iso8601,. strip_or_none,. try_get,.)...class MixcloudBaseIE(InfoExtractor):. def _call_api(self, object_type, object_fields, display_id, username, slug=None):. lookup_key = object_type + 'Lookup'. return self._download_json(. 'https://www.mixcloud.com/graphql', display_id, query={. 'query': '''{. %s(lookup: {username: "%s"%s}) {. %s. }.}''' % (lookup_key, username, ', slug: "%s"' % slug if slug else '', object_fields). })['data'][lookup_key]...class MixcloudIE(MixcloudBaseIE):. _VALID_URL = r'https?://(?:(?:www\|beta\|m)\.)?mixcloud\.com/([^/]+)/(?!stream\|uploads\|favorites\|listens\|playlists)([^/]+)'. IE_NAME = 'mixcloud'.. _T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-U4NVL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	4.700467364092993
Encrypted:	false
SSDEEP:	96:VfF0NAQxXjiBn12hfGIXvpp3UjEhVbefFO1wLlLDBTJMat/896NiT:hmJmn2GIj3UcMO1C7TJQ96NiT
MD5:	262268A12DF095C23119AC600C886F7A
SHA1:	530F9DA92411BE8A1C7CB90205B55A64C3AD1240
SHA-256:	26B779F8C0927D7769CCAD1871E3794F53C5075229B8D0DF57EB9669B0B6790A
SHA-512:	2E76478ED054D4D62BC8856A1FF1708AD90906DEB47A18988FF41F618663287E4CC910B28C0778F4523099F51D61B280C3A7FA2C347A87FB482833D6793CA693
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. js_to_json,. parse_filesize,. str_to_int,.)...class PornComIE(InfoExtractor):. _VALID_URL = r'https?://(?:[a-zA-Z]+\.)?porn\.com/videos/(?:(?P<display_id>[^/]+)-)?(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.porn.com/videos/teen-grabs-a-dildo-and-fucks-her-pussy-live-on-1hottie-i-rec-2603339',. 'md5': '3f30ce76267533cd12ba999263156de7',. 'info_dict': {. 'id': '2603339',. 'display_id': 'teen-grabs-a-dildo-and-fucks-her-pussy-live-on-1hottie-i-rec',. 'ext': 'mp4',. 'title': 'Teen grabs a dildo and fucks her pussy live on 1hottie, I rec',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 551,. 'view_count': int,. 'age_limit': 18,. 'categories': list,. 'tags': list,. },. }

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-U5DAM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	4.660811505958183
Encrypted:	false
SSDEEP:	48:+uovxlSfPCyDF8XuR12iXlgtfjXi8O1BdXZ7PBWECrqrlqcBTg0oKfQ//DSU0DtU:mlMPjDF8XuqSsfuFLCSl/BTgvKoTytKD
MD5:	4F4407D623EA56CA22D46A3ADAA2F696
SHA1:	BC584D045F2B645DCD21BB0A4427DCC9687BE07E
SHA-256:	6A3D3CC16D0AF299841276E6DF6028698FFA7EEBB316A1E14CA0E39EE8DB7CAE
SHA-512:	183DC42FFB50EDFCE35B19E67BFD2024140F59730403A451B134B7F77CAD62CA09751B7CF5E487080FD42126E513129B6FB828E92AA6330C129817BE72B36949
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. parse_iso8601,.)...class MnetIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mnet\.(?:com\|interest\.me)/tv/vod/(?:.?\bclip_id=)?(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.mnet.com/tv/vod/171008',. 'info_dict': {. 'id': '171008',. 'title': 'SS_...@....',. 'description': 'md5:b9efa592c3918b615ba69fe9f8a05c55',. 'duration': 88,. 'upload_date': '20151231',. 'timestamp': 1451564040,. 'age_limit': 0,. 'thumbnails': 'mincount:5',. 'thumbnail': r're:^https?://.\.jpg$',. 'ext': 'flv',. },. 'params': {. # rtmp download. 'skip_download': True,. },. }, {. 'url': 'http://mnet.interest.me/tv/vod/172790',. 'only_matching': True,. },

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-U6LB5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3803
Entropy (8bit):	4.632981079829008
Encrypted:	false
SSDEEP:	96:ffSDOv3nlqfaq096PCdl1NhBTh6Nu26SDOah0Jd6NhBT8/Mt766Ng:fKDOv3nlYaq0QCdl1NvTh6NznDOah0Jb
MD5:	AB5A610217574652CBD40985BEB54472
SHA1:	70A0E37D7024FC31353826427797CCD6616DF716
SHA-256:	453B2F2AD38DA2A6FC93F3226C2811A274D4F9CF51227E30F572ADD73B18F5A4
SHA-512:	EAA96B2DB4766ABA92B99D7C487DACBD5748E3823F079992C50F94498CF62502F45AEFB9C5FFA29AD28608A6A1787FB0EC7D416A3D24B05951FD0C4EF1BD014C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. urlencode_postdata,.)...class HungamaIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:www\.)?hungama\.com/. (?:. (?:video\|movie)/[^/]+/\|. tv-show/(?:[^/]+/){2}\d+/episode/[^/]+/. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://www.hungama.com/video/krishna-chants/39349649/',. 'md5': 'a845a6d1ebd08d80c1035126d49bd6a0',. 'info_dict': {. 'id': '2931166',. 'ext': 'mp4',. 'title': 'Lucky Ali - Kitni Haseen Zindagi',. 'track': 'Kitni Haseen Zindagi',. 'artist': 'Lucky Ali',. 'album': 'Aks',. 'release_year': 2000,. }. }, {. 'url': 'https://www.hungama.c

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-U8QOR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3870
Entropy (8bit):	4.716980391385505
Encrypted:	false
SSDEEP:	96:l922+B8XTwq2tBgBLGIAsg12KCdKig0aFpct7WBTNt/8J6Ng:zf++2TYLGIlwBFpYyTwJ6Ng
MD5:	7AB85872CC89354C8594D0A72D517312
SHA1:	88D153C3B190B9F0A974320745218BDA9DA99E64
SHA-256:	73A407B101430B870C63FF81139B3501A7E5E373FBBA6E5C8828D02B8E7988CA
SHA-512:	D5969853CCE6F785F4484803FBF28D1D0AEB0AFEC6FCC52A6B6C109E9E902EDD5DF7557B070B3E58BD11459391BF1EFC25BCAEA71109372B3D0B2AA18AC04688
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_duration,. parse_iso8601,. xpath_with_ns,. xpath_text,. int_or_none,.)...class ZapiksIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?zapiks\.(?:fr\|com)/(?:(?:[a-z]{2}/)?(?P<display_id>.+?)\.html\|index\.php\?.\bmedia_id=(?P<id>\d+))'. _TESTS = [. {. 'url': 'http://www.zapiks.fr/ep2s3-bon-appetit-eh-be-viva.html',. 'md5': 'aeb3c473b2d564b2d46d664d28d5f050',. 'info_dict': {. 'id': '80798',. 'ext': 'mp4',. 'title': 'EP2S3 - Bon App.tit - Eh b. viva les pyr.n.es con!',. 'description': 'md5:7054d6f6f620c6519be1fe710d4da847',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 528,. 'timestamp': 1359044972,. 'upload_date': '20130124',. 'view_count': int,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UCL61.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (1345)
Category:	dropped
Size (bytes):	7911
Entropy (8bit):	5.2386856775982915
Encrypted:	false
SSDEEP:	192:zv67GpeKDvLYfrT59apcX+S6SisvxbLepoTFHOqcMTsv9/VnAh6N5QGCjvbJ:xpLDvLYTT59apcX+S6Sisvxb6poTtOqX
MD5:	C2699542EDE2F125C035643F4E942286
SHA1:	CD070084BBCA5D3FF69627E77E77277B8CA82F64
SHA-256:	FB6D4A6E311FE2A768816BCF02434FF7F95144AE46DD0C64789C25BDB4D5AF9D
SHA-512:	28B407A4AC0C320F0F6483A4725DA91B3AC4FF5329593439922D9EF4C977D249B4252F5DDF82F010496238CB6CE466BB22420E6F8ABB183F95734ECFC502E840
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_str,. compat_urllib_parse_urlparse,.).from ..utils import (. urljoin,. int_or_none,. parse_codecs,. try_get,.)...def _raw_id(src_url):. return compat_urllib_parse_urlparse(src_url).path.split('/')[-1]...class SeznamZpravyIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?seznamzpravy\.cz/iframe/player\?.*\bsrc='. _TESTS = [{. 'url': 'https://www.seznamzpravy.cz/iframe/player?duration=241&serviceSlug=zpravy&src=https%3A%2F%2Fv39-a.sdn.szn.cz%2Fv_39%2Fvmd%2F5999c902ea707c67d8e267a9%3Ffl%3Dmdk%2C432f65a0%7C&itemType=video&autoPlay=false&title=Sv%C4%9Bt%20bez%20obalu%3A%20%C4%8Ce%C5%A1t%C3%AD%20voj%C3%A1ci%20na%20mis%C3%ADch%20(kr%C3%A1tk%C3%A1%20verze)&series=Sv%C4%9Bt%20bez%20obalu&serviceName=Seznam%20Zpr%C3%A1vy&poster=%2F%2Fd39-a.sdn.szn.cz%2Fd_39%2Fc_img_F_I%2FR5puJ.jpeg%3Ffl%3Dcro%2C0%2C0%2C1920

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UEAC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15137
Entropy (8bit):	4.448155084125879
Encrypted:	false
SSDEEP:	384:ZuQtQtxdEdp1LIQQP66CZdorVTmPTPNHMMOvT26NZ:0UR6CZBZHMMOvT28Z
MD5:	A2243AA3D8991E2F5D4A536478B16BFD
SHA1:	10A9F8FAE0199F21549C69DCA1F2EBE97516AEA0
SHA-256:	589487075A7FE7293D2E3AAABDDBCCB1158531239FB73473BFD1D6138EC656B7
SHA-512:	9D252C36A60B5FD32132A9F725A2ADDE4D93F2C6F0FD457D76673600321E0637CD8615FF0E83DD4C37585EFCFD9EF24A7D6B678BB216E63094A26DFC40B4F1F7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import base64..from .common import InfoExtractor.from ..compat import (. compat_urlparse,. compat_parse_qs,.).from ..utils import (. clean_html,. ExtractorError,. int_or_none,. unsmuggle_url,. smuggle_url,.)...class KalturaIE(InfoExtractor):. _VALID_URL = r'''(?x). (?:. kaltura:(?P<partner_id>\d+):(?P<id>[0-9a-z_]+)\|. https?://. (:?(?:www\|cdnapi(?:sec)?)\.)?kaltura\.com(?::\d+)?/. (?:. (?:. # flash player. index\.php/(?:kwidget\|extwidget/preview)\|. # html5 player. html5/html5lib/[^/]+/mwEmbedFrame\.php. ). )(?:/(?P<path>[^?]+))?(?:\?(?P<query>.*))?. ). '''. _SERVICE_URL

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UFSBU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2533
Entropy (8bit):	4.6523538521565415
Encrypted:	false
SSDEEP:	48:PueRytyg7y9SVCfnyQD64xX4M3nyGbfi0VLw4XwfjXjlk9B1huXGamYqLLIwBCG/:pgKSmn6GXLjr5Lw4XwfqJDamYUyG66BF
MD5:	900DC3277F1B3F935CAFA6FA0CC604BA
SHA1:	0CDA1CED6BC17796FB0A2764B6D605711A618CAC
SHA-256:	5CD8B93F31B5E29BA38A3F59B47A05B12085A64324DC26FB39E3B12868E31D09
SHA-512:	AD22903D0C721F8C5E399F4B563319953DE08E623FEBFF3763BC4D9F8783DCC87D9A17016E94BFB29620B69DBFA07C1E2C1A70191598268E5205516436706D0D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. url_or_none,.)...class CliphunterIE(InfoExtractor):. IE_NAME = 'cliphunter'.. _VALID_URL = r'''(?x)https?://(?:www\.)?cliphunter\.com/w/. (?P<id>[0-9]+)/. (?P<seo>.+?)(?:$\|[#\?]). '''. _TESTS = [{. 'url': 'http://www.cliphunter.com/w/1012420/Fun_Jynx_Maze_solo',. 'md5': 'b7c9bbd4eb3a226ab91093714dcaa480',. 'info_dict': {. 'id': '1012420',. 'ext': 'flv',. 'title': 'Fun Jynx Maze solo',. 'thumbnail': r're:^https?://.*\.jpg$',. 'age_limit': 18,. },. 'skip': 'Video gone',. }, {. 'url': 'http://www.cliphunter.com/w/2019449/ShesNew__My_booty_girlfriend_Victoria_Paradices_pussy_filled_with_jizz',. 'md5': '55a723c67bfc6da6b0cfa00d55da8a27',. 'info_dict': {. 'id': '2019449',. 'ext': 'mp4',. 'title': 'ShesNew

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UHFGR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2276
Entropy (8bit):	4.802941320936468
Encrypted:	false
SSDEEP:	48:+uuzWfz3xaeAv4IQIs5dvIrdXY8XblAbtfVXnUgqob+:iELxaeAv4IQIs5dvIrxYA5Axfhy
MD5:	779A7543D22FDB21FBFEA220DF78EAC8
SHA1:	71F519F8B6420FFCE142F9A94A3FE47D1349A5D8
SHA-256:	F407001087926FD4104CE81F442865E499A54B9D5472F2D5D82CF1EFFD0B3FFF
SHA-512:	2D35E215C2BA7D6ACED3EC47CA75D27B72D251405240BDBA2A0A619A933931E8B92D522FB72EF85B414FD8A575D062F1537CD3C2DF80577280112BFA23945218
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import orderedSet...class CTVNewsIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?ctvnews\.ca/(?:video\?(?:clip\|playlist\|bin)Id=\|.*?)(?P<id>[0-9.]+)'. _TESTS = [{. 'url': 'http://www.ctvnews.ca/video?clipId=901995',. 'md5': '9b8624ba66351a23e0b6e1391971f9af',. 'info_dict': {. 'id': '901995',. 'ext': 'flv',. 'title': 'Extended: \'That person cannot be me\' Johnson says',. 'description': 'md5:958dd3b4f5bbbf0ed4d045c790d89285',. 'timestamp': 1467286284,. 'upload_date': '20160630',. }. }, {. 'url': 'http://www.ctvnews.ca/video?playlistId=1.2966224',. 'info_dict':. {. 'id': '1.2966224',. },. 'playlist_mincount': 19,. }, {. 'url': 'http://www.ctvnews.ca/video?binId=1.2876780',. 'info_dict':. {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UHMOE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3021
Entropy (8bit):	4.945444103908502
Encrypted:	false
SSDEEP:	48:+uQnSfMJgdacn2/EvHVHd0+N23dXXcXSptfOfFI7kmv4MfrhmsBm:MMMGdzn2svHV90+o3xQSXfomfzh7Bm
MD5:	90B56C97505F676CE1E7B4B1717D85BA
SHA1:	3FD175E6BDAC55478B7680DAABC55D49E472C77E
SHA-256:	4C0325DB6CA1BE8F91A648E3C3D4AB2AC949519637EEA76DB9CE16EDD9D7A730
SHA-512:	54E9561A83A8537094EFF9A112992BC56C4EA76CADDE8372E41F54A2B4A71EF6622E5BE8847E5B8412A89191847086D6B40D854D4D648D072B972F0C506AD8C1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,. int_or_none,.)...class PokemonIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pokemon\.com/[a-z]{2}(?:.*?play=(?P<id>[a-z0-9]{32})\|/(?:[^/]+/)+(?P<display_id>[^/?#&]+))'. _TESTS = [{. 'url': 'https://www.pokemon.com/us/pokemon-episodes/20_30-the-ol-raise-and-switch/',. 'md5': '2fe8eaec69768b25ef898cda9c43062e',. 'info_dict': {. 'id': 'afe22e30f01c41f49d4f1d9eab5cd9a4',. 'ext': 'mp4',. 'title': 'The Ol. Raise and Switch!',. 'description': 'md5:7db77f7107f98ba88401d3adc80ff7af',. 'timestamp': 1511824728,. 'upload_date': '20171127',. },. 'add_id': ['LimelightMedia'],. }, {. # no data-video-title. 'url': 'https://www.pokemon.com/us/pokemon-episodes/pokemon-movies/pokemon-the-rise-of-darkrai-2008',. 'info

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UJEFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8725
Entropy (8bit):	4.385432804710717
Encrypted:	false
SSDEEP:	192:95A68lHj9qdBXJuAt1OW3KYEIyTIgPiQblSGORmu6NGV6ChEzpoTkNE:95ArHj9qdBN1OW6syTIgKglTY56NGU4t
MD5:	E06B45F1E991706DEC789809B51C21E5
SHA1:	A9C806B47803EA95300AF37ADC1011E5C0034AA8
SHA-256:	428A6485882371A11ECF676610B0F80C1CD715D0C48233DA75ECB147B068855C
SHA-512:	483FF80D573B63C64BCD080ED34772D3E5B10B6045B3CE02EF5B941D02BB0F841AFD30372E0D2746FA5F625A50AE65C46A5A43D29E4BA8A6F4FDDD57890C4DFE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. parse_resolution,. str_or_none,. try_get,. unified_timestamp,. url_or_none,. urljoin,.)...class PuhuTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?puhutv\.com/(?P<id>[^/?#&]+)-izle'. IE_NAME = 'puhutv'. _TESTS = [{. # film. 'url': 'https://puhutv.com/sut-kardesler-izle',. 'md5': 'fbd8f2d8e7681f8bcd51b592475a6ae7',. 'info_dict': {. 'id': '5085',. 'display_id': 'sut-kardesler',. 'ext': 'mp4',. 'title': 'S.t Karde.ler',. 'description': 'md5:405fd024df916ca16731114eb18e511a',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 4832.44,. 'creator': 'Arzu Film',. 'timestamp': 1469778212,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-ULF7G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2796
Entropy (8bit):	4.732221441004273
Encrypted:	false
SSDEEP:	48:+ufn5fbeTVciGkfjXjlkrLjc3Bir/viaL9enQLfBj/azEgwWBCrZeBocTaPZ1qtE:rnBIVcZkfqv7vi49JrgwVrZ3cTeZ1qtE
MD5:	0B1E34C5292688C6D889FBDC82B6612F
SHA1:	E28F1405221200B1BBEDD6AEE92916C416A7B1E3
SHA-256:	F974F6474E3A4AF9128AAF0F5139B0310140247AB2208B6F3CB41F7FE9783CAC
SHA-512:	A1DD8075CBA6551AF87AE61EAF1C679A3B046D5B490F51A8D79AF4FEE5B4F96A6BB400264CCB29EBA4B352C71526F787C3ED9B7F9C5276BABB85361894876ABE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. NO_DEFAULT,. sanitized_Request,. urlencode_postdata,.)...class VodlockerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?vodlocker\.(?:com\|city)/(?:embed-)?(?P<id>[0-9a-zA-Z]+)(?:\..?)?'.. _TESTS = [{. 'url': 'http://vodlocker.com/e8wvyzz4sl42',. 'md5': 'ce0c2d18fa0735f1bd91b69b0e54aacf',. 'info_dict': {. 'id': 'e8wvyzz4sl42',. 'ext': 'mp4',. 'title': 'Germany vs Brazil',. 'thumbnail': r're:http://.\.jpg',. },. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. if any(p in webpage for p in (. '>THIS FILE WAS DELETED<',. '>File Not Found<',. 'The file you were looking for could not be found, sorry for any inconvenience.<',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UQ0LO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	4.950783015979502
Encrypted:	false
SSDEEP:	24:zi8lzvGXLtGPfwC/G8JH4l/CbAxHNPb5PwL/ulk8UfVXhgLFlbJl8RIRDcQM:+u6XLtsf/G8QCbuNPFKuUfVXhgLFZJlU
MD5:	D5531675B0FE2A8A42EE1CCD3DC0A463
SHA1:	743E97C655505C04D08F1B60585295BE14CFA7C4
SHA-256:	7C9129AC6CCF0EC13793CB66878961E54B02DC39A449A0DA3396BF0B35DAD4B3
SHA-512:	7BC7AF647EF35CFB2CBE548A41D0DE47333996F713B6BA2487DADE50438076AECA898867EC5F84D3E54C6CD40604DE33C75D567A9A2276543092E2990A806F2D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .ooyala import OoyalaIE.from ..utils import unescapeHTML...class NintendoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nintendo\.com/games/detail/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://www.nintendo.com/games/detail/yEiAzhU2eQI1KZ7wOHhngFoAHc1FpHwj',. 'info_dict': {. 'id': 'MzMmticjp0VPzO3CCj4rmFOuohEuEWoW',. 'ext': 'flv',. 'title': 'Duck Hunt Wii U VC NES - Trailer',. 'duration': 60.326,. },. 'params': {. 'skip_download': True,. },. 'add_ie': ['Ooyala'],. }, {. 'url': 'http://www.nintendo.com/games/detail/tokyo-mirage-sessions-fe-wii-u',. 'info_dict': {. 'id': 'tokyo-mirage-sessions-fe-wii-u',. 'title': 'Tokyo Mirage Sessions .FE',. },. 'playlist_count': 3,. }].. def _real_extract(self, url):. pag

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UQARC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3414
Entropy (8bit):	4.465043318838093
Encrypted:	false
SSDEEP:	96:8mmo6nfFgJaSic++iDkX+dm+haZzn4geV3ujWkrFfBTSNNwF6Ng:DmjaaPc+Fu+dm+haZzn4n+nrFpT96Ng
MD5:	AF2E0E3C3503A8992A29DE9987E19876
SHA1:	57CFAEB1F604CBF34D95460B7390CC5919C6C778
SHA-256:	8DFB8FD5418FF2CFA79E72C9913A254EC5CC90B690D3A83835AEB3D3F6BF153D
SHA-512:	8BF4F540F74542EDD68F793C95D7B610C266B157DB99999FE8A73DFA0116FF423A59D1F460A6355B550AF8BDA08D5D412106E167E804FDE18CECA5F842F60B1A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_filesize,. parse_iso8601,.)...class UMGDeIE(InfoExtractor):. IE_NAME = 'umg:de'. IE_DESC = 'Universal Music Deutschland'. _VALID_URL = r'https?://(?:www\.)?universal-music\.de/[^/]+/videos/[^/?#]+-(?P<id>\d+)'. _TEST = {. 'url': 'https://www.universal-music.de/sido/videos/jedes-wort-ist-gold-wert-457803',. 'md5': 'ebd90f48c80dcc82f77251eb1902634f',. 'info_dict': {. 'id': '457803',. 'ext': 'mp4',. 'title': 'Jedes Wort ist Gold wert',. 'timestamp': 1513591800,. 'upload_date': '20171218',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). video_data = self._download_json(. 'https://api.universal-music.de/graphql',. video_id, query={. 'query': '''{. universalMusic(channel:16) {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-US4QP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2248
Entropy (8bit):	4.618322615402058
Encrypted:	false
SSDEEP:	48:+uoJofz1Xjd92bD6X/ztvgLtfjXXBAtW18LLDMyDfQ9OPMTmq8DfBTWDqxRqBcvA:MJKz1Xjd9mD6X/ztvghfq016gyfPa8jK
MD5:	EF69311409B61FB6033E54EF24843A0B
SHA1:	F52ECEDFA313DFD78B5F5B2800905F64407251D5
SHA-256:	015DC480704BA27465496A9BCC6EB4408029C1E155B81DBF7CAAC982817F5F55
SHA-512:	0E1EB5EC085F95E17E721E46105F705989664CC160130EA17A45D9D31CDF4ED705E1227109543179AE45CC5031E0937B65DDF8A32A6B2090752919619E329F75
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class RockstarGamesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rockstargames\.com/videos(?:/video/\|#?/?\?.\bvideo=)(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.rockstargames.com/videos/video/11544/',. 'md5': '03b5caa6e357a4bd50e3143fc03e5733',. 'info_dict': {. 'id': '11544',. 'ext': 'mp4',. 'title': 'Further Adventures in Finance and Felony Trailer',. 'description': 'md5:6d31f55f30cb101b5476c4a379e324a3',. 'thumbnail': r're:^https?://.\.jpg$',. 'timestamp': 1464876000,. 'upload_date': '20160602',. }. }, {. 'url': 'http://www.rockstargames.com/videos#/?video=48',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. video = self._download

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-USC47.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5807
Entropy (8bit):	5.118962046961111
Encrypted:	false
SSDEEP:	96:4U4oDUTIXjGr5S7i/fXjdy9ZMNGXglPxRcXjlkCGF7Wj5YIR0fOf0X9pPyUv8QcE:4ULDs11S788ZkGXgBGhAC2AMUk99v8QF
MD5:	0718A47B2801CA82AA66F6F09C147289
SHA1:	69B3BA25629D27458DE7A57379A19D2C04789E04
SHA-256:	A86C9A85719CCF64398B8F6E33ABF558C76518B730BCC8C1D357D2C16A01F807
SHA-512:	220C28D827AEC4FE7F6F93E81D3F3B0B08DE3C5DDD25C5D9C3079FFBF6E124416317C29672AADCB03171822B2441459479C51CF8EF1272BA4D687CB7BC28A008
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. get_element_by_attribute,. parse_iso8601,. remove_end,.)...class XuiteIE(InfoExtractor):. IE_DESC = '...Xuite..'. _REGEX_BASE64 = r'(?:[A-Za-z0-9+/]{4})(?:[A-Za-z0-9+/]{2}==\|[A-Za-z0-9+/]{3}=)?'. _VALID_URL = r'https?://vlog\.xuite\.net/(?:play\|embed)/(?P<id>%s)' % _REGEX_BASE64. _TESTS = [{. # Audio. 'url': 'http://vlog.xuite.net/play/RGkzc1ZULTM4NjA5MTQuZmx2',. 'md5': 'e79284c87b371424885448d11f6398c8',. 'info_dict': {. 'id': '3860914',. 'ext': 'mp3',. 'title': '.....-...',. 'description': '.....-...',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 247.246,. 'timestamp': 1314932940,. 'upload_date': '20110902',. 'uploader': '..',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-USEK8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2496
Entropy (8bit):	4.499701140188031
Encrypted:	false
SSDEEP:	48:PuZcfxChRSHNctCNnRQrjX+fN8feXLOyCEsBB9Zl+f1DScHBTB6KcNlpQ8cS6Ng:WuuCctCNnROOfqfsrS9ZlwccHBTgNly+
MD5:	B631AE0DA8B27626A9B4A9E8A54DC9B4
SHA1:	EC9DD7544A4F3D33B1D6C07D876D8502A5165F25
SHA-256:	56E2F62A8EA731200DEFED480535972B87A9FEE1D7F2A9E94400EA1B32978067
SHA-512:	3AA859499CAC3100553E7E23BEC0E45619204B0F8AA45DB29F0FA8565D5A39B53CF38E4FD045F1AB04E9ECA2F27AC1DD638878B1036C4CB2C340C388DCFD69DA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse_urlparse,.).from ..utils import (. float_or_none,. unified_timestamp,.)...class ClypIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?clyp\.it/(?P<id>[a-z0-9]+)'. _TESTS = [{. 'url': 'https://clyp.it/ojz2wfah',. 'md5': '1d4961036c41247ecfdcc439c0cddcbb',. 'info_dict': {. 'id': 'ojz2wfah',. 'ext': 'mp3',. 'title': 'Krisson80 - bits wip wip',. 'description': '#Krisson80BitsWipWip #chiptune\n#wip',. 'duration': 263.21,. 'timestamp': 1443515251,. 'upload_date': '20150929',. },. }, {. 'url': 'https://clyp.it/b04p1odi?token=b0078e077e15835845c528a44417719d',. 'info_dict': {. 'id': 'b04p1odi',. 'ext': 'mp3',. 'title': 'GJ! (Reward Edit)',. 'description': 'Metal Resistance (

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-UVMBQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1976
Entropy (8bit):	4.941241267677065
Encrypted:	false
SSDEEP:	48:+uCtx4fu4F/FEnvHdVSmKCgvpJvtfjXtYCFwXeQGs0ra3jXjBTr26Ns1Q:UxavF9YvHdwfCgvpJ1fBLceQG7CjBTrt
MD5:	E2B1966B18955D5850BB525990157245
SHA1:	9011CACC549E7875040D92FCA32699AF441662CC
SHA-256:	1931FE9CF7C699525DB49CD7454BBAB7A77738449E01EDA3A405C7685C3FA492
SHA-512:	914D061642CC7CB9C55C025F9B88F0BEE42F9AB82F789826F3AD08A5C8B2950521BDFF03EB7DAF03F355897BD46A4AACD42BC3DB50CD1B5A445AE7597BB3C3E5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. qualities,.)...class ClubicIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?clubic\.com/video/(?:[^/]+/)video.-(?P<id>[0-9]+)\.html'.. _TESTS = [{. 'url': 'http://www.clubic.com/video/clubic-week/video-clubic-week-2-0-le-fbi-se-lance-dans-la-photo-d-identite-448474.html',. 'md5': '1592b694ba586036efac1776b0b43cd3',. 'info_dict': {. 'id': '448474',. 'ext': 'mp4',. 'title': 'Clubic Week 2.0 : le FBI se lance dans la photo d\u0092identit.',. 'description': 're:Gueule de bois chez Nokia. Le constructeur a indiqu. cette.',. 'thumbnail': r're:^http://img\.clubic\.com/.\.jpg$',. }. }, {. 'url': 'http://www.clubic.com/video/video-clubic-week-2-0-apple-iphone-6s-et-plus-mais-surtout-le-pencil-469792.html',. 'only_matching': True,. }].. def _re

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-V1M67.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1581
Entropy (8bit):	4.723860897619375
Encrypted:	false
SSDEEP:	48:+uuXLbdqaS3jXhkzuXHiJyAgqGB/+kkDABAvs6Ng:6XLbdqaS3asiQ3dx+kQABAvs6Ng
MD5:	686E254CD7C68CCAA6373400EA18BA40
SHA1:	0BDE89504D50C96D56F7C7045295543E53238644
SHA-256:	F7767D9255B3C8981F209B8345C33080DB35DA4C703B640D131AC85C6DE72B70
SHA-512:	4F1722FEF7EB277FD7A717ECF7447BFDB6FC21C879AF6DA04D14879C9D82102CCE944F9A509F878D0C05388B225CA5F97076B9B1454E2ADC8483A5A4149B2FAC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. float_or_none,. try_get,.)...class AliExpressLiveIE(InfoExtractor):. _VALID_URL = r'https?://live\.aliexpress\.com/live/(?P<id>\d+)'. _TEST = {. 'url': 'https://live.aliexpress.com/live/2800002704436634',. 'md5': 'e729e25d47c5e557f2630eaf99b740a5',. 'info_dict': {. 'id': '2800002704436634',. 'ext': 'mp4',. 'title': 'CASIMA7.22',. 'thumbnail': r're:http://.\.jpg',. 'uploader': 'CASIMA Official Store',. 'timestamp': 1500717600,. 'upload_date': '20170722',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. data = self._parse_json(. self._search_regex(. r'(?s)runParams\s=\s({.+?})\s;?\s*var',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-V2HR2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	4.833648017759881
Encrypted:	false
SSDEEP:	48:+u2DEQE3EvLv2Ekge+DXQFIpqGFpU/LxPdbB7n0BOGCznNhp5JJpChpsv:CgQEN+DXZdDU/1Pdt0BJwN3HfC3sv
MD5:	88EAB85DB418E1921A0B8C1D71561390
SHA1:	8E4E752CA5F77585BF5B6CA7715A6000EB045ECA
SHA-256:	B4C773022240C2D75BE9514B81146A6BFE2621F7B9F9850D7802E6C9247C3384
SHA-512:	014AC247260BD9710B6FEE83C9EBEC165B99BF6D30D04C8E6A1BB16CA6501A8608F97ACF805AAEF96A722D1672D58F529C6C1B99C29125563FEE4F8FD30CE047
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class OnceIE(InfoExtractor):. _VALID_URL = r'https?://.+?\.unicornmedia\.com/now/(?:ads/vmap/)?[^/]+/[^/]+/(?P<domain_id>[^/]+)/(?P<application_id>[^/]+)/(?:[^/]+/)?(?P<media_item_id>[^/]+)/content\.(?:once\|m3u8\|mp4)'. ADAPTIVE_URL_TEMPLATE = 'http://once.unicornmedia.com/now/master/playlist/%s/%s/%s/content.m3u8'. PROGRESSIVE_URL_TEMPLATE = 'http://once.unicornmedia.com/now/media/progressive/%s/%s/%s/%s/content.mp4'.. def _extract_once_formats(self, url, http_formats_preference=None):. domain_id, application_id, media_item_id = re.match(. OnceIE._VALID_URL, url).groups(). formats = self._extract_m3u8_formats(. self.ADAPTIVE_URL_TEMPLATE % (. domain_id, application_id, media_item_id),. media_item_id, 'mp4', m3u8_id='hls', fatal=False). progressive_formats = []. for adaptive_format in formats:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-V93LF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4962
Entropy (8bit):	4.617802174458065
Encrypted:	false
SSDEEP:	96:NU7GOoa7YLZNCH8gyaaJNZm2mJNm8BP+OZZkfJa8daL65Nlx6wpkEaL1BTgs8x6u:NURz7kd/sNSiWOZsJa8ULypyLLTYx6Ng
MD5:	54A6535CB6E378D68D915B442334EB84
SHA1:	684C3C39A5F31F231DDCF23564D0809CF2400DA3
SHA-256:	2E8E64B592D9D0C9DF32D97F74E4CF8FD526C863957C7662C7B44B3F2232828D
SHA-512:	D2321D5D40C0DF5FF164263299A4692D410123C4F52531E05B764351C018EAF8286F2D1A723EAA3072448D2DBA97B91775E49921CB6C76BAF78E8952312BB301
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. qualities,. remove_end,. try_get,. unified_timestamp,. url_basename,.)...class AllocineIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?allocine\.fr/(?:article\|video\|film)/(?:fichearticle_gen_carticle=\|player_gen_cmedia=\|fichefilm_gen_cfilm=\|video-)(?P<id>[0-9]+)(?:\.html)?'.. _TESTS = [{. 'url': 'http://www.allocine.fr/article/fichearticle_gen_carticle=18635087.html',. 'md5': '0c9fcf59a841f65635fa300ac43d8269',. 'info_dict': {. 'id': '19546517',. 'display_id': '18635087',. 'ext': 'mp4',. 'title': 'Ast.rix - Le Domaine des Dieux Teaser VF',. 'description': 'md5:4a754271d9c6f16c72629a8a993ee884',. 'thumbnail': r're:http://.*\.jpg',. 'duration': 39,. 'timestamp': 1404273600,. 'upload

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-V9RPF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3286
Entropy (8bit):	4.839359449664393
Encrypted:	false
SSDEEP:	96:xUHSkOavoacZi2F7IPxn9airCIBugzkYKUiRo6alTm+a+qBTK6Npa:xGSV06A/59aifRgVR+lTm+a++TK6Npa
MD5:	D156F72DA060CC617D4736BA4309F1C4
SHA1:	AB1F7E8DEFAB26B78EEB0BD81E2E2A0BA2769069
SHA-256:	C57544607C8DD97691B5CF4172A805098AF7B4CBB2DEAF8EDCD68EEB8FC052A7
SHA-512:	C887CAB792D8295B71C72F7FF80B24945776D09EB6A7C9CFC4912449CB1C758BF489EA9986088786CC574EB37ACBBF9AD6BC25EDE476422992CB7489803FAA3D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. extract_attributes,. get_element_by_class,. urlencode_postdata,.)...class NJPWWorldIE(InfoExtractor):. _VALID_URL = r'https?://njpwworld\.com/p/(?P<id>[a-z0-9_]+)'. IE_DESC = '...........'. _NETRC_MACHINE = 'njpwworld'.. _TEST = {. 'url': 'http://njpwworld.com/p/s_series_00155_1_9/',. 'info_dict': {. 'id': 's_series_00155_1_9',. 'ext': 'mp4',. 'title': '.9.............vs..........',. 'tags': list,. },. 'params': {. 'skip_download': True, # AES-encrypted m3u8. },. 'skip': 'Requires login',. }.. _LOGIN_URL = 'https://front.njpwworld.com/auth/login'.. def _real_initialize(self):. self._login().. def _login(self):. user

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VD54C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12514
Entropy (8bit):	4.58887834771152
Encrypted:	false
SSDEEP:	384:d2hi4nO32JauGz8IkU2XgAGIOe48Tm6N/HtWTNfW6vtYwe6NkTvndI:2cuD+AGIOe48Tm8/HtWTNVvS8g/O
MD5:	D8E07E7A08EC532FFCA9E0D829534EB6
SHA1:	863A82902781D4394D4376332B9AD98A2A7CF7A9
SHA-256:	6B092775D59796C281EF5517ED6921F5C28C0A1EAE6D1B1C160ACAA7A43BBB43
SHA-512:	533889E6AC066773C8793EE0C4C5A0907C15B010F8144D84F8413E966DE8094B4AC7DB742A208AEEF006472C3B86145B02F2E3DD009C67B4EDEAB7BBB321C6BC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. clean_html,. determine_ext,. dict_get,. ExtractorError,. int_or_none,. parse_duration,. try_get,. unified_strdate,. url_or_none,.)...class XHamsterIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:.+?\.)?xhamster\.(?:com\|one)/. (?:. movies/(?P<id>\d+)/(?P<display_id>[^/])\.html\|. videos/(?P<display_id_2>[^/])-(?P<id_2>\d+). ). '''.. _TESTS = [{. 'url': 'http://xhamster.com/movies/1509445/femaleagent_shy_beauty_takes_the_bait.html',. 'md5': '8281348b8d3c53d39fffb377d24eac4e',. 'info_dict': {. 'id': '1509445',. 'display_id': 'femaleagent_shy_beauty_takes_the_bait',. 'ext': 'mp4',. 'titl

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VGEAK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6812
Entropy (8bit):	4.947549632719902
Encrypted:	false
SSDEEP:	192:209/EfQHERlp6Cy1dzuZQ38w9/iS1f8ugf/YOOVl9lu6H5:nd4Rw9/iS1+/YOahus5
MD5:	77159B51FB6B059C1ADB31D82B2BC88B
SHA1:	F4CF0F7388F1B1AD1BBD69882C75C42D327932FA
SHA-256:	CDF32474C91B9E4037FEE024438208BB81DEA1381D0BC6AEEB9831273944F385
SHA-512:	78F133458D1F8DB4973AB596743B8C2BB37D506BC74CEB8C5381B611EB3A3DE52618DC92A56512ED237BCD44C5CFFDC5BFBAF533634981ABA3BC7503FE32128D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote.from ..utils import int_or_none...class XiamiBaseIE(InfoExtractor):. _API_BASE_URL = 'https://emumo.xiami.com/song/playlist/cat/json/id'.. def _download_webpage_handle(self, args, kwargs):. webpage = super(XiamiBaseIE, self)._download_webpage_handle(args, **kwargs). if '>Xiami is currently not available in your country.<' in webpage:. self.raise_geo_restricted('Xiami is currently not available in your country'). return webpage.. def _extract_track(self, track, track_id=None):. track_name = track.get('songName') or track.get('name') or track['subName']. artist = track.get('artist') or track.get('artist_name') or track.get('singers'). title = '%s - %s' % (artist, track_name) if artist else track_name. track_url = self._decrypt(track['location']).. subtitles = {}. l

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VHN0M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2438
Entropy (8bit):	4.636007481881004
Encrypted:	false
SSDEEP:	48:+u4AFQ9vDyFJqrajXjlROxZnTayhRxnBG8KBXZ4tABOI4Akn0WWZmBTNlPw8F46u:EAIbUJqraHgdTay/xnBG3rOITW1BTNlQ
MD5:	F3B8638222F9DA191F394A7FD2CE89EC
SHA1:	0F54C3C08BFFC09766DE9CE4381512A64C19F26C
SHA-256:	4438440F891FE69745B701697FEE6ADC27368AFF16D9EBE0B5F8C797B5BCFF25
SHA-512:	C8F6D1A6C636F98511F04F28091A58489DA339B6546AA565ADFC293D06C16EEC909311177401AC469FEE11FC636C4D554A99F50576F77D8B055CF2D830671514
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. js_to_json,. int_or_none,. unescapeHTML,.)...class ReutersIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?reuters\.com/.?\?.?videoId=(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.reuters.com/video/2016/05/20/san-francisco-police-chief-resigns?videoId=368575562',. 'md5': '8015113643a0b12838f160b0b81cc2ee',. 'info_dict': {. 'id': '368575562',. 'ext': 'mp4',. 'title': 'San Francisco police chief resigns',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. 'http://www.reuters.com/assets/iframe/yovideo?videoId=%s' % video_id, video_id). video_data = js_to_json(self._search_regex(. r'(?s)Reuters\.yovideo\.drawPlayer$({.*?})$;',. webpage, 'video data')).. def get_j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VO46K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1632
Entropy (8bit):	5.08963567959958
Encrypted:	false
SSDEEP:	48:+uVkeVKZf+OxK3ZuKttIN2aBXctfjXjlkoqBOkw+usv:Cf+OxK3sQtIoiSfqotAv
MD5:	D413AD832659A6F0C579DEC521D4AE59
SHA1:	5C62EADDDC0D626BC69F1101C38D0E65CD4E9800
SHA-256:	75B94969880DD508E3F675E40DDF9142E4E8B7ABD8CB046C848623BBC2A3A8CA
SHA-512:	4AC65F08C7B7E4D5256B2BF9E19653709C35C11E60020DA2D02F2B94B825B4DC59D5547F0DC0B524E73007C0C4AC2D315126A0B034A78967915957AA79850A73
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .jwplatform import JWPlatformIE...class BusinessInsiderIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?businessinsider\.(?:com\|nl)/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://uk.businessinsider.com/how-much-radiation-youre-exposed-to-in-everyday-life-2016-6',. 'md5': 'ca237a53a8eb20b6dc5bd60564d4ab3e',. 'info_dict': {. 'id': 'hZRllCfw',. 'ext': 'mp4',. 'title': "Here's how much radiation you're exposed to in everyday life",. 'description': 'md5:9a0d6e2c279948aadaa5e84d6d9b99bd',. 'upload_date': '20170709',. 'timestamp': 1499606400,. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'https://www.businessinsider.nl/5-scientifically-proven-things-make-you-less-attractive-2017-7/',. 'only_matching': True,. }, {. 'url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VOUEJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	5.03556703485529
Encrypted:	false
SSDEEP:	48:+udIYlfy18qSvyu3tfeXhFvXa3pXDXFYhgEK18cQ8c3M:RIay18qSvyu9fmi5X+eEK1818kM
MD5:	E7A22789AB028781CCBFFE9B97766B92
SHA1:	C918D36D1E060506A0047C039941B6F8F44DBA1F
SHA-256:	1A32317A4C02EBEE9EE6E7A1AD3D85F5BAA622952BE34E1512878D3184D67824
SHA-512:	431D891D9F29215FE3B12121998333469DAD85A073E4B85126DE7C4C3B994733C94D2B127E91925B830FECA58FCC148BD487A6C978CF354CADD81CBA643D4A35
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. remove_start,.)...class RozhlasIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?prehravac\.rozhlas\.cz/audio/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://prehravac.rozhlas.cz/audio/3421320',. 'md5': '504c902dbc9e9a1fd50326eccf02a7e2',. 'info_dict': {. 'id': '3421320',. 'ext': 'mp3',. 'title': 'Echo Pavla Klus.ka (30.06.2015 21:00)',. 'description': 'Osmdes.tiny Terryho Rileyho jsou skv.lou p..le.itost. prolet.t se elektronick.mi i akustick.mi d.ly zakladatatele minimalismu, kter. je aktivn. u. p.es pades.t let'. }. }, {. 'url': 'http://prehravac.rozhlas.cz/audio/3421320/embed',. 'only_matching': True,. }].. def _real_extract(self, url):. audio_id = self._match_id(url).. webpage = self._download_webpage(. 'http

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VQ9S2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	918
Entropy (8bit):	4.943366590054517
Encrypted:	false
SSDEEP:	24:1R8lFvDEGamwVpv/Vdl1m2RnnUdhUMO0eIXjlgtprXsAxv8:PuqMeVpm2RnevjjXjlkprXfv8
MD5:	D48617555F0903847059C7FC0FAD4685
SHA1:	6338D589DA18F5771E67E8E9975961CFF8BF22B3
SHA-256:	AF02DCED7373ED1BD1A45B8F267815960EC9C41518D2E7ABD54D7C3268C2EEE4
SHA-512:	E4CFFDAF2F3F9DC4798180A8D11CE0823E60D3F67229631A972E53105C1CFCBF37ABB4CA53C4A4C27BFFA8914956A44E70788CD6CE7D6446490E8173C24206DD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class MyVidsterIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?myvidster\.com/video/(?P<id>\d+)/'.. _TEST = {. 'url': 'http://www.myvidster.com/video/32059805/Hot_chemistry_with_raw_love_making',. 'md5': '95296d0231c1363222c3441af62dc4ca',. 'info_dict': {. 'id': '3685814',. 'title': 'md5:7d8427d6d02c4fbcef50fe269980c749',. 'upload_date': '20141027',. 'uploader': 'utkualp',. 'ext': 'mp4',. 'age_limit': 18,. },. 'add_ie': ['XHamster'],. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. return self.url_result(self._html_search_regex(. r'rel="videolink" href="(?P<real_url>.*)">',. webpage, 'real video url')).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VSOSA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8975
Entropy (8bit):	5.303030497374518
Encrypted:	false
SSDEEP:	192:KGBnnw6U/7GiceVVLIbuufVydEPvWJtskPvNJFNG42dtXfm5GF+IlZaF5:9BnnnicePIbuufVydEHWJtskHNJFNG4B
MD5:	160F897F74865A40A10C16364FE2907D
SHA1:	8D30CADD48EC80E51A129D81591C35A43A7C70FC
SHA-256:	D2EF1B5880E3125D3CA621D00978D3B43BCE220E074653971A6A4F9F55247628
SHA-512:	497C6F2EAC52AAEA4AF930E9EA394C85ABEEEEA6A293F5AA998F70E26A727A380C70EBF944330D7601A9D780B445ED9EF488EF85BF4E581C3052AC577F0C4A8A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. clean_html,. get_element_by_class,. int_or_none,. parse_iso8601,. remove_start,. unified_timestamp,.)...class NextMediaIE(InfoExtractor):. IE_DESC = '....'. _VALID_URL = r'https?://hk\.apple\.nextmedia\.com/[^/]+/[^/]+/(?P<date>\d+)/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://hk.apple.nextmedia.com/realtime/news/20141108/53109199',. 'md5': 'dff9fad7009311c421176d1ac90bfe4f',. 'info_dict': {. 'id': '53109199',. 'ext': 'mp4',. 'title': '......50........ ..........',. 'thumbnail': r're:^https?://.*\.jpg$',. 'description': 'md5:28222b9912b6665a21011b034c70fcc7',. 'timestamp': 1415456273,. 'upload_date': '20141108',. }. }].. _URL_PATTERN = r'\{ url: \'(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VTQ1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2741
Entropy (8bit):	4.346964836199364
Encrypted:	false
SSDEEP:	48:PuB8hwf+GkhEBmX/LPkD0IXfwfFYBAnL6MzTr7tT8tGQ0vRBAnLJVia48g:phS+GkhEBmX/Dk4IXfqnL6M3NTOGQ0vf
MD5:	E3082825B98AE849BF24402DA6BA2979
SHA1:	ED4B52F762E54F0CDC95B23278C162756F860431
SHA-256:	96DBABBEFEE6A700EE31496A313ADCEE05A33E1193EF0AD519F5A93782ABE79F
SHA-512:	B5AEBBCE115CF1A361FE8A0E4BAC8061B9BBF5F1347CCF402A415BC05A288737C33870FD3ACD1C54BE16D09C13744E8E95D7AE062F135F28A73C0CEE539C1122
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. unified_strdate,.)...class KhanAcademyIE(InfoExtractor):. _VALID_URL = r'^https?://(?:(?:www\|api)\.)?khanacademy\.org/(?P<key>[^/]+)/(?:[^/]+/){,2}(?P<id>[^?#/]+)(?:$\|[?#])'. IE_NAME = 'KhanAcademy'.. _TESTS = [{. 'url': 'http://www.khanacademy.org/video/one-time-pad',. 'md5': '7b391cce85e758fb94f763ddc1bbb979',. 'info_dict': {. 'id': 'one-time-pad',. 'ext': 'webm',. 'title': 'The one-time pad',. 'description': 'The perfect cipher',. 'duration': 176,. 'uploader': 'Brit Cruise',. 'uploader_id': 'khanacademy',. 'upload_date': '20120411',. },. 'add_ie': ['Youtube'],. }, {. 'url': 'https://www.khanacademy.org/math/applied-math/cryptography',. 'info_dict': {. 'id': 'cryptography',. 'title': 'Journey into cryptogr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\is-VTVLI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	4.335887159154758
Encrypted:	false
SSDEEP:	24:zi8lFv/LOtlidtoHwhyChKTKhN3hU6Wmry6gfhXNTlKHl5RL/8c26Kwq:+u1yli7CmKTKhNxUCrtmrTQnt/8c26Nq
MD5:	74716AE85A0B3622B6DEC237CFF7698C
SHA1:	72C53AEB47EB5ECBB4EE7E855469D9130FB206C3
SHA-256:	CF66D880917A3D27BDE41AFE0417DFB38C9C2D4CBE2F97B75334E035D7BA2092
SHA-512:	0ECD5583F54E45B28416938D85C2541066DF9DE8AF48E575BDF6690DC4E97B3072FED03D2F009A1E1555F9F19120367C56D1591A4205A47DE6894F0C6F092A6B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor..from ..utils import (. float_or_none,. xpath_text.)...class NuevoBaseIE(InfoExtractor):. def _extract_nuevo(self, config_url, video_id, headers={}):. config = self._download_xml(. config_url, video_id, transform_source=lambda s: s.strip(),. headers=headers).. title = xpath_text(config, './title', 'title', fatal=True).strip(). video_id = xpath_text(config, './mediaid', default=video_id). thumbnail = xpath_text(config, ['./image', './thumb']). duration = float_or_none(xpath_text(config, './duration')).. formats = []. for element_name, format_id in (('file', 'sd'), ('filehd', 'hd')):. video_url = xpath_text(config, element_name). if video_url:. formats.append({. 'url': video_url,. 'format_id': format_id,. }). self._check_for

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\itv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13075
Entropy (8bit):	4.400549566429501
Encrypted:	false
SSDEEP:	384:tkDItJzo27aKLEK88DXCLpi1/O3fNTh6NZeBGY0w:t+27DEK8kspiNO3fNTh8ZekY0w
MD5:	088A05BD30F2A362AB7392AB8C33E366
SHA1:	A0412432AB80D9EFEC093AD9F1DBD8515F1A1B28
SHA-256:	2DDE3733365B4C73321513CEB848C62F6F7D5AD6D4436A5D19276FDDEB4D14E3
SHA-512:	887F8A7CA3506B8C7BA68781C2B9DE93667C70A3F7F1B3C6B747793E9AD4726A456D419265A2F47D74D92B0E2BC95B89A95FD5933ABF448864CC4A9B08FCAF51
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import uuid.import xml.etree.ElementTree as etree.import json.import re..from .common import InfoExtractor.from .brightcove import BrightcoveNewIE.from ..compat import (. compat_str,. compat_etree_register_namespace,.).from ..utils import (. determine_ext,. ExtractorError,. extract_attributes,. int_or_none,. merge_dicts,. parse_duration,. smuggle_url,. url_or_none,. xpath_with_ns,. xpath_element,. xpath_text,.)...class ITVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?itv\.com/hub/[^/]+/(?P<id>[0-9a-zA-Z]+)'. _GEO_COUNTRIES = ['GB']. _TESTS = [{. 'url': 'http://www.itv.com/hub/mr-bean-animated-series/2a2936a0053',. 'info_dict': {. 'id': '2a2936a0053',. 'ext': 'flv',. 'title': 'Home Movie',. },. 'params': {. # rtmp download. 'skip_download': True,. },. }, {. # unavailable via da

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ivi.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	4.787341845875019
Encrypted:	false
SSDEEP:	192:5dTUiW1ToMXT3py0yEkH7+wCORTzw1H0eV6NPaYWToTlRwAA:zZW18ETw0Z2+wCORTzwtV6Nwscb
MD5:	FFD1B4057C80F60155AB65476726DA3F
SHA1:	C0C7A82350E54B5012DF1E8ADCE6407A628A1DAB
SHA-256:	08300035E19E3D0ACD41F3E56A9888D559C99C6702142E051CA3786204D936C4
SHA-512:	D23A1FDB040E28D50C3DB42E58FAAEC263EF1B98F9947AF41B81731E173BE48B6A5CE056EE5768CFDB6E4EFF57475E02B3C76F58117926F2F95B3312549E7797
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. qualities,.)...class IviIE(InfoExtractor):. IE_DESC = 'ivi.ru'. IE_NAME = 'ivi'. _VALID_URL = r'https?://(?:www\.)?ivi\.(?:ru\|tv)/(?:watch/(?:[^/]+/)?\|video/player\?.?videoId=)(?P<id>\d+)'. _GEO_BYPASS = False. _GEO_COUNTRIES = ['RU'].. _TESTS = [. # Single movie. {. 'url': 'http://www.ivi.ru/watch/53141',. 'md5': '6ff5be2254e796ed346251d117196cf4',. 'info_dict': {. 'id': '53141',. 'ext': 'mp4',. 'title': '.... .......... ...... .........',. 'description': 'md5:b924063ea1677c8fe343d8a72ac2195f',. 'duration': 5498,. 'thumbnail': r're:^https?://.\.jpg$',. },. 'skip': 'Only works from Russia',. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ivideon.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3254
Entropy (8bit):	5.0142242638149
Encrypted:	false
SSDEEP:	48:+ugRf6n0j7DXNqvr9Xpt27dfFty1KAMBoPpdRWsuhSoZtkji7aPdWeEx7dBTVdwQ:0Z6n07TsvrRX27VIRW37UdWfVdBTb6Ng
MD5:	0B1AA5371A7A9A3D0DA2181446821239
SHA1:	108A88C43B0ECE44C3AE21D504C0D7026B857C4A
SHA-256:	C4EF884B5403C92B0C0814ADDE72D52891CC6E4FA3A816E404B56634B77A64A4
SHA-512:	5DB77A60DE58E0E3ECFDF805FC899AB439F85A5BF721AC2B56B4B70F46D93C3DE29A5D3349CC0D96EB16AEFF89BA8C43158B14C8238CEAEF7D0F192BFDBB4F91
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_urlparse,.).from ..utils import qualities...class IvideonIE(InfoExtractor):. IE_NAME = 'ivideon'. IE_DESC = 'Ivideon TV'. _VALID_URL = r'https?://(?:www\.)?ivideon\.com/tv/(?:[^/]+/)*camera/(?P<id>\d+-[\da-f]+)/(?P<camera_id>\d+)'. _TESTS = [{. 'url': 'https://www.ivideon.com/tv/camera/100-916ca13b5c4ad9f564266424a026386d/0/',. 'info_dict': {. 'id': '100-916ca13b5c4ad9f564266424a026386d',. 'ext': 'flv',. 'title': 're:^..... [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': '........ .............. - ...... ........ ......... .... ..... ....',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'https

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\iwara.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3380
Entropy (8bit):	4.748002678495213
Encrypted:	false
SSDEEP:	96:xUVGAanscu3b6gpKNvD6al9lDtf2VRr6OpWTZ3PuOp+BTY6Ng:xUVMOb6cOvDTNN2VRrJITRmOpKTY6Ng
MD5:	0081D01ECEE93B46B39AE54A8DE4AD22
SHA1:	89214D1EB76898E6745B91B100F88F0CA7D1AD30
SHA-256:	EDE0BC0ED41091C48FC0CEAA4298396FE3F7A528E1FB4F418AD2A36FC2983F51
SHA-512:	7FD1FACED2A7A6FAB4B6C5C84AB3FC47DE12097D4405C1C77220A4545CD0C144D25D456F53E17A964DE9A9FDCC1093A6FE55BF066A86175E3C4DA54B0B3035B3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urllib_parse_urlparse.from ..utils import (. int_or_none,. mimetype2ext,. remove_end,. url_or_none,.)...class IwaraIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.\|ecchi\.)?iwara\.tv/videos/(?P<id>[a-zA-Z0-9]+)'. _TESTS = [{. 'url': 'http://iwara.tv/videos/amVwUl1EHpAD9RD',. # md5 is unstable. 'info_dict': {. 'id': 'amVwUl1EHpAD9RD',. 'ext': 'mp4',. 'title': '.MMD R-18........ carry_me_off',. 'age_limit': 18,. },. }, {. 'url': 'http://ecchi.iwara.tv/videos/Vb4yf2yZspkzkBO',. 'md5': '7e5f1f359cd51a027ba4a7b7710a50f0',. 'info_dict': {. 'id': '0B1LvuHnL-sRFNXB1WHNqbGw4SXc',. 'ext': 'mp4',. 'title': '[3D Hentai] Kyonyu . Genkai . Emaki Shinobi Girls.mp4',. 'age_limit': 18,. },. 'a

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\izlesene.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4152
Entropy (8bit):	4.627310513812594
Encrypted:	false
SSDEEP:	96:POEoLOz4I03tgRdpMDa5yjujGt1nHzoZc1d9BTu7bTC0e5KTJ1tB8hwP6Ng:2kz4jtgRp5+j1nHKsVTqf4hwP6Ng
MD5:	A7D86388DF37A5B8401F16601BBF85D5
SHA1:	B6C8356C0D24CAF19807E22E3F9CEF03FD94C4E1
SHA-256:	643F83A30F0A8AE662D21BDF37257DCE93C9BAF2210EC46D2A2EE9C34BE1F576
SHA-512:	28451949BA61FBAED19D25C7553E1FB70E8DA2CFF56B7695317CC2CBEB0E625332C126D523E93876895214029EEEF1BBC42A6476B86B8C033FD7E9FF8F3E569E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urllib_parse_unquote,.).from ..utils import (. determine_ext,. float_or_none,. get_element_by_id,. int_or_none,. parse_iso8601,. str_to_int,.)...class IzleseneIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://(?:(?:www\|m)\.)?izlesene\.com/. (?:video\|embedplayer)/(?:[^/]+/)?(?P<id>[0-9]+). '''. _TESTS = [. {. 'url': 'http://www.izlesene.com/video/sevincten-cildirtan-dogum-gunu-hediyesi/7599694',. 'md5': '4384f9f0ea65086734b881085ee05ac2',. 'info_dict': {. 'id': '7599694',. 'ext': 'mp4',. 'title': 'Sevin.ten ..ld.rtan Do.um G.n. Hediyesi',. 'description': 'md5:253753e2655dde93f59f74b572454f6d',. 'thumbnail': r're:^https?://.*\.jpg',. 'uploader_id': 'pelikzzle',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\jamendo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5126
Entropy (8bit):	4.603755418410511
Encrypted:	false
SSDEEP:	96:eAZGxoCEDA6+sU/nH9n1Kmv92MfzEGRXUK9LYBTeUoYK5etz8V6NiAL4kmryf3PT:7B+F/9ndv926zEGRXUK9LYT0hhV6NI0z
MD5:	5A9E79E31BCD3565D1F4D7327A6A8782
SHA1:	4DEA32A7DFD272383446CD357FE070353A42C492
SHA-256:	D89655F76EE2FBE2E8D710EEE1831C93519C5D68E5E3B1E2BE2292F2B13F0810
SHA-512:	C31862A06BD0662DB58CEBE3219143DAF2EC31B40D41AC4AC446F8365D59564DD1F9728342EAA50A9E9C2D1990A8572A0B23AEE9146D6D06109C0922035D90AC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from ..compat import compat_urlparse.from .common import InfoExtractor.from ..utils import parse_duration...class JamendoBaseIE(InfoExtractor):. def _extract_meta(self, webpage, fatal=True):. title = self._og_search_title(. webpage, default=None) or self._search_regex(. r'<title>([^<]+)', webpage,. 'title', default=None). if title:. title = self._search_regex(. r'(.+?)\s\\|\sJamendo Music', title, 'title', default=None). if not title:. title = self._html_search_meta(. 'name', webpage, 'title', fatal=fatal). mobj = re.search(r'(.+) - (.+)', title or ''). artist, second = mobj.groups() if mobj else [None] * 2. return title, artist, second...class JamendoIE(JamendoBaseIE):. _VALID_URL = r'''(?x). https?://. (?:. licensing\

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\jeuxvideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2041
Entropy (8bit):	4.8490288475206675
Encrypted:	false
SSDEEP:	48:wuM4akfoT+XgdV7XywZpBf10gtfdfFbNxr41XUZNB8ByaW2pg6Nrqw:hoT0q1XyuBf1Vfplf6N2w
MD5:	E97BF3D449F568C608A8B3BCF0C8A6C2
SHA1:	3494830720C0A3288B8461B5DA057FB83F6BE6F1
SHA-256:	1BC71450318E18F544A6C9289FFDDD850FAAF5C1FA192FF8EB1A320A9072BA8A
SHA-512:	66DD3C2025CAE6B139BF07B1E2F34DD5211663E22F203F1AE0C6D7002DC9C7AFD722C19148AEA46CA85286DCF3ACE55F0C5B52F4CF379F5899031146AF778049
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import re..from .common import InfoExtractor...class JeuxVideoIE(InfoExtractor):. _VALID_URL = r'https?://.?\.jeuxvideo\.com/./(.*?)\.htm'.. _TESTS = [{. 'url': 'http://www.jeuxvideo.com/reportages-videos-jeux/0004/00046170/tearaway-playstation-vita-gc-2013-tearaway-nous-presente-ses-papiers-d-identite-00115182.htm',. 'md5': '046e491afb32a8aaac1f44dd4ddd54ee',. 'info_dict': {. 'id': '114765',. 'ext': 'mp4',. 'title': 'Tearaway : GC 2013 : Tearaway nous pr.sente ses papiers d\'identit.',. 'description': 'Lorsque les d.veloppeurs de LittleBigPlanet proposent un nouveau titre, on ne peut que s\'attendre . un r.sultat original et fort attrayant.',. },. }, {. 'url': 'http://www.jeuxvideo.com/videos/chroniques/434220/l-histoire-du-jeu-video-la-saturn.htm',. 'only_matching': True,. }].. def _real_extract(self, url):. mobj

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\joj.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3748
Entropy (8bit):	4.545680666793904
Encrypted:	false
SSDEEP:	96:5pClTvnXy2wfZE082R6qQxj8bu0Wn2ZY/BTufrKRtu8C6NM:SRqQhdMu0Wn2ZYJT3C6NM
MD5:	48684129DB579159AAEE80BF8123F164
SHA1:	9D425B24346B79964ECD029CF1DCC27B83C1D6A2
SHA-256:	AE5289F326627144F6BE4BA4F688602D332495BCBF88246297D9BCBBC4AD5D53
SHA-512:	CFFCBCDE00AA7ED69535AA861B4F13D6F273FCC8547DE322B51496738700E38CD79F3FEE2577C35ED10347D2CD31ED4415557AC7B6C7074F9C0B6BF20F220067
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals....import re....from .common import InfoExtractor..from ..compat import compat_str..from ..utils import (.. int_or_none,.. js_to_json,.. try_get,..)......class JojIE(InfoExtractor):.. _VALID_URL = r'''(?x).. (?:.. joj:\|.. https?://media\.joj\.sk/embed/.. ).. (?P<id>[^/?#^]+).. '''.. _TESTS = [{.. 'url': 'https://media.joj.sk/embed/a388ec4c-6019-4a4a-9312-b1bee194e932',.. 'info_dict': {.. 'id': 'a388ec4c-6019-4a4a-9312-b1bee194e932',.. 'ext': 'mp4',.. 'title': 'NOV. B.VANIE',.. 'thumbnail': r're:^https?://.*\.jpg$',.. 'duration': 3118,.. }.. }, {.. 'url': 'https://media.joj.sk/embed/9i1cxv',.. 'only_matching': True,.. }, {.. 'url': 'joj:a388ec4c-6019-4a4a-9312-b1bee194e932',.. 'only_matchin

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\jove.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	4.7829221925987895
Encrypted:	false
SSDEEP:	96:1Ofb9A93twWxNs5sD0ugGSN5ltNHBZNUmrvu5djtVm:YfBgtp45IhgLltLL9
MD5:	E469B4096A8C71677870167584AD7755
SHA1:	685FF7EE52A33945DBC2F65B6D6D59F596F70215
SHA-256:	830EE1FB1220842D4F1BB122A74E6D7D1E5C97981B25B166686304A5FEC6FFDB
SHA-512:	43E95B47F3FCB1108FD481A9B94B946B3EFE78B651876BA3048300BAF4997A34F20AD02F001157BE80343B6E272869474FFAFF6BEF28D2FB2E255B9AF64097A4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. unified_strdate.)...class JoveIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?jove\.com/video/(?P<id>[0-9]+)'. _CHAPTERS_URL = 'http://www.jove.com/video-chapters?videoid={video_id:}'. _TESTS = [. {. 'url': 'http://www.jove.com/video/2744/electrode-positioning-montage-transcranial-direct-current',. 'md5': '93723888d82dbd6ba8b3d7d0cd65dd2b',. 'info_dict': {. 'id': '2744',. 'ext': 'mp4',. 'title': 'Electrode Positioning and Montage in Transcranial Direct Current Stimulation',. 'description': 'md5:015dd4509649c0908bc27f049e0262c6',. 'thumbnail': r're:^https?://.*\.png$',. 'upload_date': '20110523',. }. },. {. 'url': 'http://www.jove.com/video/51796/culturing-caenorhabditis-elegans-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\jpopsukitv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2585
Entropy (8bit):	4.873390696541669
Encrypted:	false
SSDEEP:	48:+uveAQgBs7/z+u5UZ1utiajXhk7qvCVzVCeVJXGb6BXGD1XzjuS5+qXU8qXbOmYr:KAQgBc/zUutiaaOvdHb6wxXZ5+b8QOmC
MD5:	AE715DD8CEE986E288885DD716E97835
SHA1:	6DF0F7A121E011BBC88AE484A16B25659B11DEF2
SHA-256:	0845502F7A108C614ADFED4808269307D5E7B397AED62EC361354450A8DB4A67
SHA-512:	44A9D94F85ECBA0B7BF41AF88EFCD104C9E51A90F331A424D02CB5716731F5A6A57F5E827406CAF1387F552A79C452FCD0753478DC765B8622C08D4ED35E8508
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_strdate,.)...class JpopsukiIE(InfoExtractor):. IE_NAME = 'jpopsuki.tv'. _VALID_URL = r'https?://(?:www\.)?jpopsuki\.tv/(?:category/)?video/[^/]+/(?P<id>\S+)'.. _TEST = {. 'url': 'http://www.jpopsuki.tv/video/ayumi-hamasaki---evolution/00be659d23b0b40508169cdee4545771',. 'md5': '88018c0c1a9b1387940e90ec9e7e198e',. 'info_dict': {. 'id': '00be659d23b0b40508169cdee4545771',. 'ext': 'mp4',. 'title': 'ayumi hamasaki - evolution',. 'description': 'Release date: 2001.01.31\r\n..... - evolution',. 'thumbnail': 'http://www.jpopsuki.tv/cache/89722c74d2a2ebe58bcac65321c115b2.jpg',. 'uploader': 'plama_chan',. 'uploader_id': '404',. 'upload_date': '20121101'. }. }.. def _real_extract(self, url):. video_id = self._m

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\jwplatform.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1512
Entropy (8bit):	5.100847868720758
Encrypted:	false
SSDEEP:	24:zi8lzvQK33J3yCfwRu7AC/+lnHSEV20ZtHPdxMotBKctVL1JlKcyRVVbneIXjfE5:+uMK33ByCfEY8yEV2Yvdxht8c3/ocyBe
MD5:	9E6BFF8C0F1EC133D569B4C352F2B54E
SHA1:	33243F6DE7579380520883051E15F2938AFACAD3
SHA-256:	10310D86CC5D43C4A2CE552F4F57A8EC19716C65921B3E2D5AE84D48A51F5B92
SHA-512:	39053BA9679C2E3640606AC8D5647910F8BD75947794BC98C6AAE528428C88756E2AC5626E5D7AB3CF689B7C5CC3677A2C5BCA5B206A6D7D28FDB459AC9D3C6F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class JWPlatformIE(InfoExtractor):. _VALID_URL = r'(?:https?://(?:content\.jwplatform\|cdn\.jwplayer)\.com/(?:(?:feed\|player\|thumb\|preview\|video)s\|jw6\|v2/media)/\|jwplatform:)(?P<id>[a-zA-Z0-9]{8})'. _TESTS = [{. 'url': 'http://content.jwplatform.com/players/nPripu9l-ALJ3XQCI.js',. 'md5': 'fa8899fa601eb7c83a64e9d568bdf325',. 'info_dict': {. 'id': 'nPripu9l',. 'ext': 'mov',. 'title': 'Big Buck Bunny Trailer',. 'description': 'Big Buck Bunny is a short animated film by the Blender Institute. It is made using free and open source software.',. 'upload_date': '20081127',. 'timestamp': 1227796140,. }. }, {. 'url': 'https://cdn.jwplayer.com/players/nPripu9l-ALJ3XQCI.js',. 'only_matching': True,. }].. @staticmethod. def _extract_url(webpage):. urls = JWPlatformIE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kakao.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5295
Entropy (8bit):	4.7207887081698345
Encrypted:	false
SSDEEP:	96:k41nHgElNt3vzelUVfhtA01wRwLWRV1wLjoNzAw5QxNZSBTxJ483T/LNnRq6Ng:k41nHHN5vyGVhtA01IwewHoGwOnYTbNu
MD5:	63C175A5B904AA9C28CBD551DA8DD473
SHA1:	7141DB3A1EC7B5DBD3ECC917A2ED735452BAF629
SHA-256:	0A16F76C3B5B6486F98DE70299FF0F6BB6C7B323E9C7BBC25E84740B7305C3CC
SHA-512:	828E64180F4A8E41CFD33562DF69FA73E500AB5D5CE711D1940167065AD2DE69D350BD6E25588F6C7135D4104725B476B790B40749748C2920D75EE372EDF1FE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. unified_timestamp,. update_url_query,.)...class KakaoIE(InfoExtractor):. _VALID_URL = r'https?://tv\.kakao\.com/channel/(?P<channel>\d+)/cliplink/(?P<id>\d+)'. _API_BASE = 'http://tv.kakao.com/api/v1/ft/cliplinks'.. _TESTS = [{. 'url': 'http://tv.kakao.com/channel/2671005/cliplink/301965083',. 'md5': '702b2fbdeb51ad82f5c904e8c0766340',. 'info_dict': {. 'id': '301965083',. 'ext': 'mp4',. 'title': '...46 ..... .3................GP... ........',. 'uploader_id': 2671005,. 'uploader': '.....',. 'timestamp': 1488160199,. 'upload_date': '20170227',. }. }, {. 'url': 'http://tv.kakao.com/channel/2653210/cliplink/300103180',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kaltura.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15137
Entropy (8bit):	4.448155084125879
Encrypted:	false
SSDEEP:	384:ZuQtQtxdEdp1LIQQP66CZdorVTmPTPNHMMOvT26NZ:0UR6CZBZHMMOvT28Z
MD5:	A2243AA3D8991E2F5D4A536478B16BFD
SHA1:	10A9F8FAE0199F21549C69DCA1F2EBE97516AEA0
SHA-256:	589487075A7FE7293D2E3AAABDDBCCB1158531239FB73473BFD1D6138EC656B7
SHA-512:	9D252C36A60B5FD32132A9F725A2ADDE4D93F2C6F0FD457D76673600321E0637CD8615FF0E83DD4C37585EFCFD9EF24A7D6B678BB216E63094A26DFC40B4F1F7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import base64..from .common import InfoExtractor.from ..compat import (. compat_urlparse,. compat_parse_qs,.).from ..utils import (. clean_html,. ExtractorError,. int_or_none,. unsmuggle_url,. smuggle_url,.)...class KalturaIE(InfoExtractor):. _VALID_URL = r'''(?x). (?:. kaltura:(?P<partner_id>\d+):(?P<id>[0-9a-z_]+)\|. https?://. (:?(?:www\|cdnapi(?:sec)?)\.)?kaltura\.com(?::\d+)?/. (?:. (?:. # flash player. index\.php/(?:kwidget\|extwidget/preview)\|. # html5 player. html5/html5lib/[^/]+/mwEmbedFrame\.php. ). )(?:/(?P<path>[^?]+))?(?:\?(?P<query>.*))?. ). '''. _SERVICE_URL

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kanalplay.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3283
Entropy (8bit):	4.761530884034328
Encrypted:	false
SSDEEP:	96:/hfQyFLfzFFKup2vd2SKkkm0y8z8EHAuzZPwxC5o7AT0FBT6Rvt/8V6No:/hfBFDzFGvd2UVGz8EHAuzOM50bTgqVj
MD5:	4CA5D442050298B47778F22D5082CB72
SHA1:	A612069AD92E87C42AC262B83D66AEE5E23BB5FE
SHA-256:	4E5D8A6524199DF492F6F46A2BA8106F67AFA51E92C6E257977D1006038D650C
SHA-512:	EEBE771233115DE7FFB7AE062A8AE987921E842C8B591ECFF9EEFED3C3E90A61AD5CB3D579BD68EDDFFF683617BF065C054439371B4C105378788657012C4A5D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. srt_subtitles_timecode,.)...class KanalPlayIE(InfoExtractor):. IE_DESC = 'Kanal 5/9/11 Play'. _VALID_URL = r'https?://(?:www\.)?kanal(?P<channel_id>5\|9\|11)play\.se/(?:#!/)?(?:play/)?program/\d+/video/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.kanal5play.se/#!/play/program/3060212363/video/3270012277',. 'info_dict': {. 'id': '3270012277',. 'ext': 'flv',. 'title': 'Saknar b.de dusch och avlopp',. 'description': 'md5:6023a95832a06059832ae93bc3c7efb7',. 'duration': 2636.36,. },. 'params': {. # rtmp download. 'skip_download': True,. }. }, {. 'url': 'http://www.kanal9play.se/#!/play/program/335032/video/246042',. 'only_matching': True,. }, {. 'url': 'http://www.kanal11play.se/#!

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kankan.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	4.992110595966
Encrypted:	false
SSDEEP:	48:Pu61CjM5o/Vw0vh5jXjlkdBMgfF2f6Z9o5B+szIBoWzvBo0z1Borz+CbLi:CjP/VJqwZA9oWszszFz4z+CPi
MD5:	FC15EEFA339582E5E4514C4660512810
SHA1:	147EAFBCDB47571B8EC157075995BCB513A53EFA
SHA-256:	9130303BE01466D7944A13DAAF0444C340723FF99EB3DA300E9689CC66F0D538
SHA-512:	24EB8C02856C87415F2B38E6DBAE45AE94C8180D14B43063BA84A46DB05C5CC87D73ACB0E4A0338DB3B83CD8584CA901A0E21322AEE3EAF4EC66AEC292AF5FD5
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import hashlib..from .common import InfoExtractor.._md5 = lambda s: hashlib.md5(s.encode('utf-8')).hexdigest()...class KankanIE(InfoExtractor):. _VALID_URL = r'https?://(?:.*?\.)?kankan\.com/.+?/(?P<id>\d+)\.shtml'.. _TEST = {. 'url': 'http://yinyue.kankan.com/vod/48/48863.shtml',. 'md5': '29aca1e47ae68fc28804aca89f29507e',. 'info_dict': {. 'id': '48863',. 'ext': 'flv',. 'title': 'Ready To Go',. },. 'skip': 'Only available from China',. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._search_regex(r'(?:G_TITLE=\|G_MOVIE_TITLE = )[\'"](.+?)[\'"]', webpage, 'video title'). surls = re.search(r'surls:\[\'.+?\'\]\|lurl:\'.+?\.flv\'', webpage).group(0). gcids = re.findall(r'http://.+?/.+?/(.+?)/', surls). gcid = gcids[-1].. info_url = '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\karaoketv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2340
Entropy (8bit):	4.888603053372565
Encrypted:	false
SSDEEP:	48:+uDZ1hoKVvcR1qajXhk5BDZBgJSBDg9KYFhsFuXnFXXuXwNidaCvCzT+x6Ng:fZ1GKV02aalBQv9DuQFD6jvC86Ng
MD5:	8F9FD3899CC84D45000BD2E91BFF1A3A
SHA1:	52102C97C73E506F4FB5758D1D42FE0291776807
SHA-256:	25319B817EF95DC357CC097629887930CD4821E38C9F3F3693E9C68B616C2A33
SHA-512:	E19EF6A723543EF571A9FAEDE896CB8E0BEC9B856F496B6E12786EDC13D862B205F2837F06A39D9354F293E583DF90340527616D9F5192DB57081B491E31432C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class KaraoketvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?karaoketv\.co\.il/[^/]+/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.karaoketv.co.il/%D7%A9%D7%99%D7%A8%D7%99_%D7%A7%D7%A8%D7%99%D7%95%D7%A7%D7%99/58356/%D7%90%D7%99%D7%96%D7%95%D7%9F',. 'info_dict': {. 'id': '58356',. 'ext': 'flv',. 'title': '...... .. .....',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). api_page_url = self._search_regex(. r'<iframe[^>]+src=(["\'])(?P<url>https?://www\.karaoke\.co\.il/api_play\.php\?.+?)\1',. webpage, 'API play URL', group='url').. api_page = self._download_webpage(api_page_url, video_id). vid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\karrierevideos.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	4.67415478693249
Encrypted:	false
SSDEEP:	96:5GxjXXUsn2PUPPV0n2VfauSrv13VSN8hJxGZvRftN8B:CHgPUPPBVaPdNEUB
MD5:	7A5DAD524033DF11658FB53746F42F0D
SHA1:	91E7B30ED5974E64C3D474C17C52B99E3DCF0ED4
SHA-256:	E389EF9282E9F8E9D52E1F8795CD86A33CFEDE601D870BA9E6F97626835D1744
SHA-512:	4D4CB17A1E29CA693C8665F4A05078FCD2279B1BFFC1A540B00D536AE6B34122DA155207ACDA8E4DBECDF65908A292A1FF6A5B19B38A1477F7D0A8C5895A5949
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. fix_xml_ampersands,. float_or_none,. xpath_with_ns,. xpath_text,.)...class KarriereVideosIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?karrierevideos\.at(?:/[^/]+)+/(?P<id>[^/]+)'. _TESTS = [{. 'url': 'http://www.karrierevideos.at/berufsvideos/mittlere-hoehere-schulen/altenpflegerin',. 'info_dict': {. 'id': '32c91',. 'ext': 'flv',. 'title': 'AltenpflegerIn',. 'description': 'md5:dbadd1259fde2159a9b28667cb664ae2',. 'thumbnail': r're:^http://.*\.png',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }, {. # broken ampersands. 'url': 'http://www.karrierevideos.at/orientierung/vaeterkarenz-und-neue-chancen-fuer-muetter-baby-was-nun',. 'info_dict': {. 'id': '5

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\keek.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	4.770451618846276
Encrypted:	false
SSDEEP:	24:zi8lFvxGqvpip/UdlnkeIXhgtMDimRdlDDCmDDg1Aq1Jw:+ujvuUAjXhky/zJvg131e
MD5:	375B4EDBE6854E49F75DC3D8CD28C168
SHA1:	26494B34B3B390382C70C795C6B31F2CBFE127DF
SHA-256:	9805D1106DED2E98727AC6677DBB59FF54B5059B8CAB6C3107503D70FE9E1DC0
SHA-512:	D7FE2B9FB73E89F1B6519B3F250D20B88412B154A44B8A7D69B0C1D54039CFF814ED88F41BB23B036F26931B0A91EA667A0C455B2AD814FA26DF62589900560D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class KeekIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?keek\.com/keek/(?P<id>\w+)'. IE_NAME = 'keek'. _TEST = {. 'url': 'https://www.keek.com/keek/NODfbab',. 'md5': '9b0636f8c0f7614afa4ea5e4c6e57e83',. 'info_dict': {. 'id': 'NODfbab',. 'ext': 'mp4',. 'title': 'md5:35d42050a3ece241d5ddd7fdcc6fd896',. 'uploader': 'ytdl',. 'uploader_id': 'eGT5bab',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. return {. 'id': video_id,. 'url': self._og_search_video_url(webpage),. 'ext': 'mp4',. 'title': self._og_search_description(webpage).strip(),. 'thumbnail': self._og_search_thumbnail(webpage),. 'uploader': self._search_regex(. r'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\keezmovies.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4716
Entropy (8bit):	4.512419492433387
Encrypted:	false
SSDEEP:	96:wOBf07cH6o7Skv6amkeoxTHKkNTPPNl7Mit77OBT19t/8h6NYmBBw:F+7cao71vMToxvNTDpaTqh6NYmBi
MD5:	6BF06B0233C6D261DACBE768CF910537
SHA1:	40E6A323F5DC938BC925022ABD259F83EFC46D17
SHA-256:	0DE9764C62EA47AA6396F3267AB6E4EDBCDCC360A9BAB3C4FDB1485096B9FBD4
SHA-512:	7717C97A3B1212E5F08C62EA6F1AC3ADC2642E92B00FE4AC4E42501E5FAD0CB6E1E787EFF75552717F6963662E78768B1E325A1309597F6E4C1E5CCA9EB0EF12
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..aes import aes_decrypt_text.from ..compat import compat_urllib_parse_unquote.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. str_to_int,. strip_or_none,. url_or_none,.)...class KeezMoviesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?keezmovies\.com/video/(?:(?P<display_id>[^/]+)-)?(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.keezmovies.com/video/arab-wife-want-it-so-bad-i-see-she-thirsty-and-has-tiny-money-18070681',. 'md5': '2ac69cdb882055f71d82db4311732a1a',. 'info_dict': {. 'id': '18070681',. 'display_id': 'arab-wife-want-it-so-bad-i-see-she-thirsty-and-has-tiny-money',. 'ext': 'mp4',. 'title': 'Arab wife want it so bad I see she thirsty and has tiny money.',. 'thumbnail': None,. 'view_count': int,. 'age_limit': 18,. }. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ketnet.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3490
Entropy (8bit):	4.604896251649444
Encrypted:	false
SSDEEP:	96:a5p0O/Xgp7ogZ8yXjCcKDqFhfae4b6yOb+0MibFGBTUx36Ng:eGxp7FZqv+Fpaes6yOb+0MibFiTUl6Ng
MD5:	ED0F59401F0BCB6132B8631377967D2F
SHA1:	7188471D1215743E654B3A00B3FF4CEC42BFCBE6
SHA-256:	DFA3E4CA41BF8961D660BFDF30C57038D26CB9B4099E8046A00373BC1C013A02
SHA-512:	7F2A21DAA771B7D1C0C2804E63BA5A99D7B2F38D09A7DC1B2A70E0655102C703B795E1321C6AA492200D3E3BBA08CE8A23E992CAED9728A4199F4A04C80CF50A
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .canvas import CanvasIE.from .common import InfoExtractor...class KetnetIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ketnet\.be/(?:[^/]+/)(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.ketnet.be/kijken/zomerse-filmpjes',. 'md5': '6bdeb65998930251bbd1c510750edba9',. 'info_dict': {. 'id': 'zomerse-filmpjes',. 'ext': 'mp4',. 'title': 'Gluur mee op de filmset en op Pennenzakkenrock',. 'description': 'Gluur mee met Ghost Rockers op de filmset',. 'thumbnail': r're:^https?://.\.jpg$',. }. }, {. # mzid in playerConfig instead of sources. 'url': 'https://www.ketnet.be/kijken/nachtwacht/de-greystook',. 'md5': '90139b746a0a9bd7bb631283f6e2a64e',. 'info_dict': {. 'id': 'md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'display_id': 'md-ast-4ac54990-ce66-4d00-a8ca-9eac86f4c475',. 'ext': 'f

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\khanacademy.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2741
Entropy (8bit):	4.346964836199364
Encrypted:	false
SSDEEP:	48:PuB8hwf+GkhEBmX/LPkD0IXfwfFYBAnL6MzTr7tT8tGQ0vRBAnLJVia48g:phS+GkhEBmX/Dk4IXfqnL6M3NTOGQ0vf
MD5:	E3082825B98AE849BF24402DA6BA2979
SHA1:	ED4B52F762E54F0CDC95B23278C162756F860431
SHA-256:	96DBABBEFEE6A700EE31496A313ADCEE05A33E1193EF0AD519F5A93782ABE79F
SHA-512:	B5AEBBCE115CF1A361FE8A0E4BAC8061B9BBF5F1347CCF402A415BC05A288737C33870FD3ACD1C54BE16D09C13744E8E95D7AE062F135F28A73C0CEE539C1122
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. unified_strdate,.)...class KhanAcademyIE(InfoExtractor):. _VALID_URL = r'^https?://(?:(?:www\|api)\.)?khanacademy\.org/(?P<key>[^/]+)/(?:[^/]+/){,2}(?P<id>[^?#/]+)(?:$\|[?#])'. IE_NAME = 'KhanAcademy'.. _TESTS = [{. 'url': 'http://www.khanacademy.org/video/one-time-pad',. 'md5': '7b391cce85e758fb94f763ddc1bbb979',. 'info_dict': {. 'id': 'one-time-pad',. 'ext': 'webm',. 'title': 'The one-time pad',. 'description': 'The perfect cipher',. 'duration': 176,. 'uploader': 'Brit Cruise',. 'uploader_id': 'khanacademy',. 'upload_date': '20120411',. },. 'add_ie': ['Youtube'],. }, {. 'url': 'https://www.khanacademy.org/math/applied-math/cryptography',. 'info_dict': {. 'id': 'cryptography',. 'title': 'Journey into cryptogr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kickstarter.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2708
Entropy (8bit):	4.712333967038507
Encrypted:	false
SSDEEP:	48:+u4FQA4okcflnEkd/GQ2NluKXlhGSHMXsleEKyddRfjXjlkdXcI5fBxFu6oZzceL:ElPv6kd/GQ2xXFHMXsDKydzfqii/LIcq
MD5:	7C330FB0E091BC19D473E1CEE3DF69E8
SHA1:	0E93754633F16F049D939B17449871384027B6BB
SHA-256:	15BCACF9C9675AB9F12525B299172742604FBD2DFAF4CE453353EAEF8849AF35
SHA-512:	C9A44E1F4CB1B33ECBBF6D62BE4E1707BDB0B25F05703C6DF755C25587316BE700238B9F035216D113061B4326E07CDE1FEB5EFFE765CE49EB6B4D19E22CB439
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import smuggle_url...class KickStarterIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?kickstarter\.com/projects/(?P<id>[^/])/.'. _TESTS = [{. 'url': 'https://www.kickstarter.com/projects/1404461844/intersection-the-story-of-josh-grant/description',. 'md5': 'c81addca81327ffa66c642b5d8b08cab',. 'info_dict': {. 'id': '1404461844',. 'ext': 'mp4',. 'title': 'Intersection: The Story of Josh Grant by Kyle Cowling',. 'description': (. 'A unique motocross documentary that examines the '. 'life and mind of one of sports most elite athletes: Josh Grant.'. ),. },. }, {. 'note': 'Embedded video (not using the native kickstarter video service)',. 'url': 'https://www.kickstarter.com/projects/597507018/pebble-e-paper-watch-for-iphone-and-android/posts/659178

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kinopoisk.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2227
Entropy (8bit):	4.791767740971187
Encrypted:	false
SSDEEP:	48:+uupqAfg8aI/HX4s3X+8tfjXh4GruXH77WSqGR+kkYhBTMlbqNlSAt/8cxA6Ng:9ig8aI/HX4Y+yfyGUeSdR+k7hBTMlbqS
MD5:	63374E0B36650701439B2BB8814B7D55
SHA1:	9F51ADA60A7731F36F9E1E709A96F2DC60973868
SHA-256:	9BA1916311CDD7D060ED146706ED03714CC01E0234466F037EB526207D2CA84B
SHA-512:	92B5657D2E38D000A4C8F29E63A74B2F02FA5F5A473CEBEAFA24D00B0CE0A1590E02E94846481853F0546909F3F6E347AC60BF4D743A3D8F53D99A0458FB970D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. dict_get,. int_or_none,.)...class KinoPoiskIE(InfoExtractor):. _GEO_COUNTRIES = ['RU']. _VALID_URL = r'https?://(?:www\.)?kinopoisk\.ru/film/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.kinopoisk.ru/film/81041/watch/',. 'md5': '4f71c80baea10dfa54a837a46111d326',. 'info_dict': {. 'id': '81041',. 'ext': 'mp4',. 'title': '..... ....... . ....... ....',. 'description': 'md5:43787e673d68b805d0aa1df5a5aea701',. 'thumbnail': r're:^https?://.*',. 'duration': 4533,. 'age_limit': 12,. },. 'params': {. 'format': 'bestvideo',. },. }, {. 'url': 'https://www.kinopoisk.ru/film/81041',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\konserthusetplay.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4505
Entropy (8bit):	4.550856667863298
Encrypted:	false
SSDEEP:	96:YOB8oRveKGRJfaoBQQ2l7O13FYfyy4s8b4egQ5BTUGHjV2mt/8V6No:tuoRWBxayE7O13FYay4sCtgQXT1jQV62
MD5:	5D84CC29AFAD2875BCE9AAC54CD84EDC
SHA1:	42179F3EE82A40E468D9C207814E1A44D857A9CA
SHA-256:	624491BB0522BE1A10E27B8E3E49462D731E11A3EC852BA5719B0FC429150A10
SHA-512:	841B5C3CF874296FB3448584CE55D6AEA535970240F5BC63AC88A70888EC466145E39077393696E48AE12C32ED6DA039DD0AA7DDB6C2BF783103A51B1A09A3D5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. url_or_none,.)...class KonserthusetPlayIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:konserthusetplay\|rspoplay)\.se/\?.\bm=(?P<id>[^&]+)'. _TESTS = [{. 'url': 'http://www.konserthusetplay.se/?m=CKDDnlCY-dhWAAqiMERd-A',. 'md5': 'e3fd47bf44e864bd23c08e487abe1967',. 'info_dict': {. 'id': 'CKDDnlCY-dhWAAqiMERd-A',. 'ext': 'mp4',. 'title': 'Orkesterns instrument: Valthornen',. 'description': 'md5:f10e1f0030202020396a4d712d2fa827',. 'thumbnail': 're:^https?://.$',. 'duration': 398.76,. },. }, {. 'url': 'http://rspoplay.se/?m=elWuEH34SMKvaO4wO_cHBw',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kontrtube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2732
Entropy (8bit):	5.104747519661235
Encrypted:	false
SSDEEP:	48:+u2MNur9B+OBu3IyFADZj1jBk/olXadfFkZVmrBQJleBFJ0XnHCKOBDKxFgB1grq:nMrD+O03jFy3lJlXaGXl0SHHgKDAmNj2
MD5:	F1D7D1EF1E68CE0A61F7AEA10FD462E2
SHA1:	2A1E08360CA7D437FA1CA12A88C928140FF7DAF1
SHA-256:	D75AB4D4ABC557F64A2681240695D97F2CA211A3F94EAEDD488CB6E20FE9DB38
SHA-512:	B1A917FF09B1477C44BAFD3390D09EF361585256F3B66AB6D565D881BB32CA8D308C299F6D705A7FF4C92626659600A4B73D66EB1F7B602234F3660A553D37AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,.)...class KontrTubeIE(InfoExtractor):. IE_NAME = 'kontrtube'. IE_DESC = 'KontrTube.ru - ..... .....'. _VALID_URL = r'https?://(?:www\.)?kontrtube\.ru/videos/(?P<id>\d+)/(?P<display_id>[^/]+)/'.. _TEST = {. 'url': 'http://www.kontrtube.ru/videos/2678/nad-olimpiyskoy-derevney-v-sochi-podnyat-rossiyskiy-flag/',. 'md5': '975a991a4926c9a85f383a736a2e6b80',. 'info_dict': {. 'id': '2678',. 'display_id': 'nad-olimpiyskoy-derevney-v-sochi-podnyat-rossiyskiy-flag',. 'ext': 'mp4',. 'title': '... ........... ........ . .... ...... .......... ....',. 'description': 'md5:80edc4c613d5887ae8ccf1d59432be41',. 'thumbnail': 'http://www.kontrtube.ru/contents/videos_screenshots/2000/2678/preview

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\krasview.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1957
Entropy (8bit):	4.930576872793063
Encrypted:	false
SSDEEP:	48:+umQb7FUIQfAk47HERajXhke9P5VzVgL/NlQTUjTZ5AAt/8cLTi:19UIQ4vTERaaIGbNl9B5Ht/8F
MD5:	2AFD08EBC7D566281571FCFC2F66D13E
SHA1:	C1B2F5104F315E4F221DFE37E7D1A5AA37F16474
SHA-256:	EC48BAFF430E61D323D597D56DF5292080FA26BA7747A99A2449BB7C3B9CE15F
SHA-512:	94916797027A2AEE0F844D7D45C0E18DEE4470F91B030DF8DBDCB5458424E310D7382788B9D97F57618FD74B861517A0C37A8188962CA23F5067E9F3109C4A22
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import (. int_or_none,. js_to_json,.)...class KrasViewIE(InfoExtractor):. IE_DESC = '.......'. _VALID_URL = r'https?://krasview\.ru/(?:video\|embed)/(?P<id>\d+)'.. _TEST = {. 'url': 'http://krasview.ru/video/512228',. 'md5': '3b91003cf85fc5db277870c8ebd98eae',. 'info_dict': {. 'id': '512228',. 'ext': 'mp4',. 'title': '...., ..., ......',. 'description': '..... . ...... ......, . .....-.......... .......... .......',. 'duration': 27,. 'thumbnail': r're:^https?://.*\.jpg',. },. 'params': {. 'skip_download': 'Not accessible from Travis CI server',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ku6.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	992
Entropy (8bit):	4.969679676025222
Encrypted:	false
SSDEEP:	24:1R8lFvBwIp3DedVDW/cdVdlzLaeIXjlgtdXAWuIp3QrAx3kClO:PuPbp3DedVycdV3LajXjlkdXAWpp3BxI
MD5:	58E754205D5AD62F7CBF1085EA8FC645
SHA1:	14374F07A3E752F1BEC58F847CC3DC11737E1B3A
SHA-256:	CAA0502AFCF9BD2D415A1D3BB74DE6569241D327605F6D2309C4A8D5BF582D9A
SHA-512:	BB5280E71A546E76C9E3072AA8D50B924A435C8E7AE26EBD854CC7EF525D494A388653D881E30D8A1E824F6FCBA0AD2B8EC8E93B5D2470E1B152AB53FADF3AEE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class Ku6IE(InfoExtractor):. _VALID_URL = r'https?://v\.ku6\.com/show/(?P<id>[a-zA-Z0-9\-\_]+)(?:\.)html'. _TEST = {. 'url': 'http://v.ku6.com/show/JG-8yS14xzBr4bCn1pu0xw...html',. 'md5': '01203549b9efbb45f4b87d55bdea1ed1',. 'info_dict': {. 'id': 'JG-8yS14xzBr4bCn1pu0xw',. 'ext': 'f4v',. 'title': 'techniques test',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._html_search_regex(. r'<h1 title=.>(.*?)</h1>', webpage, 'title'). dataUrl = 'http://v.ku6.com/fetchVideo4Player/%s.html' % video_id. jsonData = self._download_json(dataUrl, video_id). downloadUrl = jsonData['data']['f'].. return {. 'id': video_id,. 'title': title,. 'url': downloadUrl. }.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kusi.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	4.861720594489512
Encrypted:	false
SSDEEP:	96:/94ccn6fKVzIXWEfwiIYkyPoKub9qMgdbBTP8V6N1ti:/ucnQywEkyPFEEtdNTUV6NW
MD5:	10625D0FE8EA4D9E1BB801AF86F2C31D
SHA1:	2630D4E4F74040266DFC39EA09E1464F5B1FAB6F
SHA-256:	2F040A729A0019E411EC88771E52DDAF5D5B8A3288F681AD50850C241CF65393
SHA-512:	77BD7130863D828EAD32A3250A6E83B23D9C14745A0E515636CACDE1CE2A619F7DA806B289D1B03828026156CE4910F0B7C93F4039B0213FD3C97D95A0DD26F8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random.import re..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote_plus.from ..utils import (. int_or_none,. float_or_none,. timeconvert,. update_url_query,. xpath_text,.)...class KUSIIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?kusi\.com/(?P<path>story/.+\|video\?clipId=(?P<clipId>\d+))'. _TESTS = [{. 'url': 'http://www.kusi.com/story/32849881/turko-files-refused-to-help-it-aint-right',. 'md5': '4e76ce8e53660ce9697d06c0ba6fc47d',. 'info_dict': {. 'id': '12689020',. 'ext': 'mp4',. 'title': "Turko Files: Refused to Help, It Ain't Right!",. 'duration': 223.586,. 'upload_date': '20160826',. 'timestamp': 1472233118,. 'thumbnail': r're:^https?://.*\.jpg$'. },. }, {. 'url': 'http://kusi.com/video?clipId=12203019',. 'only_matching': True,. }]..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\kuwo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	12536
Entropy (8bit):	4.945925182182424
Encrypted:	false
SSDEEP:	384:HfconmgKrZndTS2AGRTu6NVD/9sY7M0xyA5fJGn9AvtGIgTx6Ng:EoBKr62AGRTu8H9B/GIgTx8g
MD5:	436E711A91172866AAB150C1C20D2E47
SHA1:	9F01DD5E9277CE9C5957AC27CC573E1D2EFAECEE
SHA-256:	E550DD96F8A590746060F4CD9522C762279BB116E407700DEECABE1D4AB33055
SHA-512:	82B53D7CD49FC6AFABEAA96BA8543AD57BD21D936B56016631F9777B96DD13FDF6528223F987D5B12F6D829D995A9DEE6B44C5BF8F9EF6D949D87ED51EDE891F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. get_element_by_id,. clean_html,. ExtractorError,. InAdvancePagedList,. remove_start,.)...class KuwoBaseIE(InfoExtractor):. _FORMATS = [. {'format': 'ape', 'ext': 'ape', 'preference': 100},. {'format': 'mp3-320', 'ext': 'mp3', 'br': '320kmp3', 'abr': 320, 'preference': 80},. {'format': 'mp3-192', 'ext': 'mp3', 'br': '192kmp3', 'abr': 192, 'preference': 70},. {'format': 'mp3-128', 'ext': 'mp3', 'br': '128kmp3', 'abr': 128, 'preference': 60},. {'format': 'wma', 'ext': 'wma', 'preference': 20},. {'format': 'aac', 'ext': 'aac', 'abr': 48, 'preference': 10}. ].. def _get_formats(self, song_id, tolerate_ip_deny=False):. formats = []. for file_format in self._FORMATS:. query = {. 'format': file_format['ext'],. 'br':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\la7.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2279
Entropy (8bit):	4.899855277647735
Encrypted:	false
SSDEEP:	48:+u8ZQPyPX7/RtkwFzFApWtfjXhktuX3mY35K+9N8m:gOPyPL/RtkwFzFAp0faymYw+9Cm
MD5:	E167D62809B38BA7AB2232836C84D0B2
SHA1:	9482D63D2D618E0DC66E410667267967FD81E82E
SHA-256:	D145458C70EC7AC4A666D6D056FBA44E298959A21CACA217133447D4A2E5FFC4
SHA-512:	4DAE777F79581B209140C5BEC0F5B464512BAC210BEC7551D2A22E3A5096B2E280EE041CFBAC9D2617AE1A815B2B7449D332B6743B56A19FCDE3D42510432DE7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. js_to_json,. smuggle_url,.)...class LA7IE(InfoExtractor):. IE_NAME = 'la7.it'. _VALID_URL = r'''(?x)(https?://)?(?:. (?:www\.)?la7\.it/([^/]+)/(?:rivedila7\|video)/\|. tg\.la7\.it/repliche-tgla7\?id=. )(?P<id>.+)'''.. _TESTS = [{. # 'src' is a plain URL. 'url': 'http://www.la7.it/crozza/video/inccool8-02-10-2015-163722',. 'md5': '8b613ffc0c4bf9b9e377169fc19c214c',. 'info_dict': {. 'id': 'inccool8-02-10-2015-163722',. 'ext': 'mp4',. 'title': 'Inc.Cool8',. 'description': 'Benvenuti nell\'incredibile mondo della INC. COOL. 8. dove .INC.. sta per .Incorporated. .COOL. sta per .fashion. ed Eight sta per il gesto atletico',. 'thumbnail': 're:^https?://.*',. 'uploader_id': 'kdla7pillole@iltrovatore.it',. 'timestamp': 1443814869,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\laola1tv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9454
Entropy (8bit):	4.6613182077658655
Encrypted:	false
SSDEEP:	192:XGhSDI0VFImeMTsvqsI8ohcgIszZ3cNi6NOAIJs2sSizP/zjJZ38y6NLsvKoPsJP:2hS80VFImeMTsCsXohlzZ3cA6NO626zk
MD5:	45DB0C2E53BFA014A221B26A2837DE12
SHA1:	A9A25CDDCA71855ABBAE9CC4FDDD020DE67E6FE7
SHA-256:	FA3292788F0781DC31AD5CDFF41F7CBC0ADC722DBDC5CDC43A7928814BC3AAAB
SHA-512:	09CD480BCF91021D61FA349F716D9F57110A4298B3745A38E65C870919636D3F0C25F4E79E927C956AC150005304285A4BB3638C8B03BABDFCC8F2286540C4FC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. unified_strdate,. urlencode_postdata,. xpath_element,. xpath_text,. update_url_query,. js_to_json,.)...class Laola1TvEmbedIE(InfoExtractor):. IE_NAME = 'laola1tv:embed'. _VALID_URL = r'https?://(?:www\.)?laola1\.tv/titanplayer\.php\?.*?\bvideoid=(?P<id>\d+)'. _TESTS = [{. # flashvars.premium = "false";. 'url': 'https://www.laola1.tv/titanplayer.php?videoid=708065&type=V&lang=en&portal=int&customer=1024',. 'info_dict': {. 'id': '708065',. 'ext': 'mp4',. 'title': 'MA Long CHN - FAN Zhendong CHN',. 'uploader': 'ITTF - International Table Tennis Federation',. 'upload_date': '20161211',. },. }].. def _extract_token_url(self, stream_access_url, video_id, data):. return self._download_json(. self._proto_rel

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lci.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	953
Entropy (8bit):	5.065618082899809
Encrypted:	false
SSDEEP:	24:zi8lFv9G1X1uwNszMMcL9K/Edla0HbEaeIXjlgtlB4RA2:+uvaFuVXcgEXEajXjlklBcA2
MD5:	12059C87F0C979E236EDB7D53C9DEE37
SHA1:	087715FF0E260D789AE9CA38C787541F9FE59BEC
SHA-256:	606A86B866287FB2FEF8A7192CF111FB43EFB5947475286D9154783192CDFEC6
SHA-512:	75FA74C0FBC8BD34391093C31086A8D68B0CDD42DAA59FE796887FEAD54BFBD62857A1FFFECCC51DCE6678465C3EA66328E2BD04DA02905E6FF1DBECFD2FE161
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class LCIIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lci\.fr/[^/]+/[\w-]+-(?P<id>\d+)\.html'. _TEST = {. 'url': 'http://www.lci.fr/international/etats-unis-a-j-62-hillary-clinton-reste-sans-voix-2001679.html',. 'md5': '2fdb2538b884d4d695f9bd2bde137e6c',. 'info_dict': {. 'id': '13244802',. 'ext': 'mp4',. 'title': 'Hillary Clinton et sa quinte de toux, en plein meeting',. 'description': 'md5:a4363e3a960860132f8124b62f4a01c9',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). wat_id = self._search_regex(. (r'data-watid=[\'"](\d+)', r'idwat["\']?\s:\s["\']?(\d+)'),. webpage, 'wat id'). return self.url_result('wat:' + wat_id, 'Wat', wat_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lcp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2953
Entropy (8bit):	4.849685740384726
Encrypted:	false
SSDEEP:	48:+uZcETfrFMEL+sVdN8BcV13R/vMEL2UVWNccgwvUOXxR2ItfJoXhh1BDPAkiRAkO:VcE7jL+sfqBExfL2U8WcgUUOXx8ufJaj
MD5:	DC4A6508E1005F5ED01800F914FBF95D
SHA1:	E44CE259E9DB74AFCA0114A1268BD0742FB55B21
SHA-256:	C3DFE40FE861BD81D336D999032E376D7CC419009269EB028A86D8A65349C7DD
SHA-512:	90D3E685CF4032D75FE6FEFAE7213EF41CEDCAEE58BA845595071E23E2BF0CF5EEAA876565BB02DEF2198CB9945B261C2D042E9686A7137E834C5D97B6BA962B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .arkena import ArkenaIE...class LcpPlayIE(ArkenaIE):. _VALID_URL = r'https?://play\.lcp\.fr/embed/(?P<id>[^/]+)/(?P<account_id>[^/]+)/[^/]+/[^/]+'. _TESTS = [{. 'url': 'http://play.lcp.fr/embed/327336/131064/darkmatter/0',. 'md5': 'b8bd9298542929c06c1c15788b1f277a',. 'info_dict': {. 'id': '327336',. 'ext': 'mp4',. 'title': '327336',. 'timestamp': 1456391602,. 'upload_date': '20160225',. },. 'params': {. 'skip_download': True,. },. }]...class LcpIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lcp\.fr/(?:[^/]+/)*(?P<id>[^/]+)'.. _TESTS = [{. # arkena embed. 'url': 'http://www.lcp.fr/la-politique-en-video/schwartzenberg-prg-preconise-francois-hollande-de-participer-une-primaire',. 'md5': 'b8bd9298542929c06c1c15788b1f277a',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\learnr.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.927334957531084
Encrypted:	false
SSDEEP:	24:zi8lFvp/GCswYBuWO7/mddlGDOvHbF0eIXjlgtWFOzRXC:+u7DsPBUzmdyybyjXjlk/NXC
MD5:	77ADFEB3318EF77C8D250BF9E956B13B
SHA1:	AF412B2136EDDA2C3C5B04DD44446B8F470C906D
SHA-256:	01A43939070F8034A445F6FAAC670F8A7D1BCA63126BE09D6D9920D917A129BE
SHA-512:	354C817615774299D15AC37BBA245A8257325F04945454466737F93F80560F5CCB55F4E39554A841ED77829DD361AE8D42CB78798D4543F4DAA5113F0396FD36
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class LearnrIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?learnr\.pro/view/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.learnr.pro/view/video/51624-web-development-tutorial-for-beginners-1-how-to-build-webpages-with-html-css-javascript',. 'md5': '3719fdf0a68397f49899e82c308a89de',. 'info_dict': {. 'id': '51624',. 'ext': 'mp4',. 'title': 'Web Development Tutorial for Beginners (#1) - How to build webpages with HTML, CSS, Javascript',. 'description': 'md5:b36dbfa92350176cdf12b4d388485503',. 'uploader': 'LearnCode.academy',. 'uploader_id': 'learncodeacademy',. 'upload_date': '20131021',. },. 'add_ie': ['Youtube'],. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. return {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lecture2go.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2402
Entropy (8bit):	4.651653401750048
Encrypted:	false
SSDEEP:	48:+uvWOQWbCX4N1arnkYarD1qajXjlkdXWQlZeFaPidy/hLOd9VLVBTzNXqQPgrK/c:KO724OTkYargaqEQlZ3Pidy/hLOd9JVe
MD5:	D7085E755EAF9332D827EA2D1EC94452
SHA1:	8FB3AAF432A8D5570147F3B5BC43503495503C04
SHA-256:	FD877E2738F4C632DF3E7146D8CB75AFACEAC0709FCBBB602E2DD6F39B53872B
SHA-512:	CFBEC455DFCEE85429824472FB22B925518EBB95D87E3C0F3274686FE6A821113F398490A6D8F629DA8DFD7E2A229728A5F2518DC043F84B27FEA1561E44418B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. determine_protocol,. parse_duration,. int_or_none,.)...class Lecture2GoIE(InfoExtractor):. _VALID_URL = r'https?://lecture2go\.uni-hamburg\.de/veranstaltungen/-/v/(?P<id>\d+)'. _TEST = {. 'url': 'https://lecture2go.uni-hamburg.de/veranstaltungen/-/v/17473',. 'md5': 'ac02b570883020d208d405d5a3fd2f7f',. 'info_dict': {. 'id': '17473',. 'ext': 'mp4',. 'title': '2 - Endliche Automaten und regul.re Sprachen',. 'creator': 'Frank Heitmann',. 'duration': 5220,. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._html_search_regex(r'<em[^>]+class="title">(.+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lecturio.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8481
Entropy (8bit):	4.57472913122836
Encrypted:	false
SSDEEP:	192:tYBwL3dH64vSd3T1TrjRnyTH6N85JT66d3TuKVzHJaUq0:tL3dH64vSd31jtyTH6N85l66BzwUq0
MD5:	8756AAF85E5D2052E2FB971960A8F794
SHA1:	91F0540E31BAE7164B15690AAAE74C0DF435E857
SHA-256:	2A81BD1585E1941568ED6F6AC93D72A9759E14C820A093590B3ADA57A5C933D3
SHA-512:	BE2F294218CAAB6574D52A76E0C3060532EC8712624AF8A7920B57637AD3549759F4D9055BBD883A35F408927EE2C271F667CE10DE5F58B5828D24355A03161B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. clean_html,. determine_ext,. ExtractorError,. float_or_none,. int_or_none,. str_or_none,. url_or_none,. urlencode_postdata,. urljoin,.)...class LecturioBaseIE(InfoExtractor):. _API_BASE_URL = 'https://app.lecturio.com/api/en/latest/html5/'. _LOGIN_URL = 'https://app.lecturio.com/en/login'. _NETRC_MACHINE = 'lecturio'.. def _real_initialize(self):. self._login().. def _login(self):. username, password = self._get_login_info(). if username is None:. return.. # Sets some cookies. _, urlh = self._download_webpage_handle(. self._LOGIN_URL, None, 'Downloading login popup').. def is_logged(url_handle):. return self._LOGIN_URL not in compat_str(url_handle.geturl()).. # Already logged in. if is_logged(urlh):.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\leeco.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	13103
Entropy (8bit):	4.775203746866203
Encrypted:	false
SSDEEP:	384:QnsImQ9WlAI6maR/IEvYiyTW6N/J+ejqh50GNPSitH5GGBTH6Ng:HGIEvByTW81itH5GGBTH8g
MD5:	12DD9FF00FC72E3D6DF7F0174F0855C1
SHA1:	0310E7F0AE499F8EFC1909D3394B5476B64FC9BC
SHA-256:	8F0F8A3B654DB79DE8A6BFD0D7B114547386ACFC98E91D26AE9CD41E9CB8A42A
SHA-512:	02CC77051F6301ECD9081AF4A183B8C2E03B215671029C78D89A4E91D6A9323898DCE1FC7CA80DEA0473F789DE6510A8C96AE547DC143FC2FE1389178ACC8777
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import datetime.import hashlib.import re.import time..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_ord,. compat_str,. compat_urllib_parse_urlencode,.).from ..utils import (. determine_ext,. encode_data_uri,. ExtractorError,. int_or_none,. orderedSet,. parse_iso8601,. str_or_none,. url_basename,. urshift,.)...class LeIE(InfoExtractor):. IE_DESC = '...'. _VALID_URL = r'https?://(?:www\.le\.com/ptv/vplay\|(?:sports\.le\|(?:www\.)?lesports)\.com/(?:match\|video))/(?P<id>\d+)\.html'. _GEO_COUNTRIES = ['CN']. _URL_TEMPLATE = 'http://www.le.com/ptv/vplay/%s.html'.. _TESTS = [{. 'url': 'http://www.le.com/ptv/vplay/22005890.html',. 'md5': 'edadcfe5406976f42f9f266057ee5e40',. 'info_dict': {. 'id': '22005890',. 'ext': 'mp4',. 'title': '.87........... .......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lego.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6137
Entropy (8bit):	4.813158598166853
Encrypted:	false
SSDEEP:	96:5eOUPKNHvliOT4h7Z1OUrln2rld5evYv8F0UyS9fCQ9PuOB51CH0vbbeH+kNghNy:Y+hlif7PDMfl8Fm4GDHubeH+PhTL8/1T
MD5:	E647A39901430A52DFA9C08934CCB1F5
SHA1:	402AADDDB801E2B7E22B6602BE6A0D7D63091161
SHA-256:	232F34F9D3408A5BB61739DEEF34B22BAECAF2A0EF884C44955CE71B50FAE476
SHA-512:	9D2FF83C85C7845638F62A5DEF5F85B4B9A48566B75A6CD80FB2D7F757E69395DBD1055B0C9C9B0A5CC346171E010D3F0849DADB6C1A0E06388400CBB2DEC72B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. unescapeHTML,. parse_duration,. get_element_by_class,.)...class LEGOIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lego\.com/(?P<locale>[^/]+)/(?:[^/]+/)videos/(?:[^/]+/)[^/?#]+-(?P<id>[0-9a-f]+)'. _TESTS = [{. 'url': 'http://www.lego.com/en-us/videos/themes/club/blocumentary-kawaguchi-55492d823b1b4d5e985787fa8c2973b1',. 'md5': 'f34468f176cfd76488767fc162c405fa',. 'info_dict': {. 'id': '55492d823b1b4d5e985787fa8c2973b1',. 'ext': 'mp4',. 'title': 'Blocumentary Great Creations: Akiyuki Kawaguchi',. 'description': 'Blocumentary Great Creations: Akiyuki Kawaguchi',. },. }, {. # geo-restricted but the contentUrl contain a valid url. 'url': 'http://www.lego.com/nl-nl/videos/themes/nexoknights/episode-20-kingdom-of-heroes-13bdc

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lemonde.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2329
Entropy (8bit):	4.961547078501025
Encrypted:	false
SSDEEP:	48:PuzL+VufEUw/rFCyYn6LYsLU/JnN2iXMY5vTDtfJoXhhrfzIMyxn1Y:yLCoEUw/rF6cY3/Jnoi5HfJaTbr
MD5:	86F3D9D29C2EF4844C49F1ABDD5C7F6C
SHA1:	03053C0B6002D69AF68A7FFE2BC51B4F5F55619C
SHA-256:	594BABCE79CCCE79FD51ACE25511508D77085D480586C433E4E8EC063D2248A4
SHA-512:	31245A1D6C20CC908B5B73F5C10B12BFBB325EE275236AAD93B199F36987CCE2E7D8FF3690AD7C661404B1E7E4EC86253022A6539538B823EA998B1C416331D9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class LemondeIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?lemonde\.fr/(?:[^/]+/)(?P<id>[^/]+)\.html'. _TESTS = [{. 'url': 'http://www.lemonde.fr/police-justice/video/2016/01/19/comprendre-l-affaire-bygmalion-en-cinq-minutes_4849702_1653578.html',. 'md5': 'da120c8722d8632eec6ced937536cc98',. 'info_dict': {. 'id': 'lqm3kl',. 'ext': 'mp4',. 'title': "Comprendre l'affaire Bygmalion en 5 minutes",. 'thumbnail': r're:^https?://.\.jpg',. 'duration': 309,. 'upload_date': '20160119',. 'timestamp': 1453194778,. 'uploader_id': '3pmkp',. },. }, {. # standard iframe embed. 'url': 'http://www.lemonde.fr/les-decodeurs/article/2016/10/18/tout-comprendre-du-ceta-le-petit-cousin-du-traite-transatlantique_5015920_4355770.html',. 'info_dict': {. 'id': 'uzsxms',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lenta.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	4.8684164371388965
Encrypted:	false
SSDEEP:	48:+uL1ef0J1piOsXjYNCWdIodt1m4xXjXN8fJoXhh6B35+8e47:nqg1pTsXjY0iIodLm4xXjXqfJa+08e47
MD5:	114A6340C9DE19754693F53023E6A16F
SHA1:	55C075AF6EFA2C579ADDB1DBB67F1309025DCD8A
SHA-256:	3DEBECC2FA0004D4DDEA38B8E1AA293F69E1B87FBAB5DAD2FB3501D303078754
SHA-512:	1D6A24A3096F6651D34F2688435714E924E8185CC4DA9EF2C855C12CE28A2F4E922410B0BE7BEC5FADC0AD28E85CD5DF51200420A05FAED807FE4F5AB34C6501
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class LentaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lenta\.ru/[^/]+/\d+/\d+/\d+/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://lenta.ru/news/2018/03/22/savshenko_go/',. 'info_dict': {. 'id': '964400',. 'ext': 'mp4',. 'title': '....... ........ .........',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 61,. 'view_count': int,. },. 'params': {. 'skip_download': True,. },. }, {. # EaglePlatform iframe embed. 'url': 'http://lenta.ru/news/2015/03/06/navalny/',. 'info_dict': {. 'id': '227304',. 'ext': 'mp4',. 'title': '......... ..... .. .......',. 'description': 'md5:d97861ac9ae77377f3f20eaf9d04b4f5',. 'thumbnail': r're:^https?://.\.jpg$',

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\libraryofcongress.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5029
Entropy (8bit):	4.639614033736345
Encrypted:	false
SSDEEP:	96:IOC2Yo8wHCYLHScURlHCEukPxokFfqtw5tirE3Gx4VmREXhpBTaNl0K896No:9C/oRiYOcWH/ZPikFqNrE3Gx4VmqXRTX
MD5:	0CEC442BE0FB36037CB0443F75B4BFC2
SHA1:	692921A0F6F67C464A33F6E7B09EB28D6389A081
SHA-256:	6FBD54290C7B47D1AEDC65BDF58E7A1DED96A895AC390B69590459384AFE1DE1
SHA-512:	722A8659C9B8CAFD1FFF55E54614EE26E3BE798BDF0EDC21DD35F115B3CF46A8DE54ABD4D9303AFB6FFD5C57271EF04BDA893996EE135F1AF0EA95D637244A46
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor..from ..utils import (. determine_ext,. float_or_none,. int_or_none,. parse_filesize,.)...class LibraryOfCongressIE(InfoExtractor):. IE_NAME = 'loc'. IE_DESC = 'Library of Congress'. _VALID_URL = r'https?://(?:www\.)?loc\.gov/(?:item/\|today/cyberlc/feature_wdesc\.php\?.*\brec=)(?P<id>[0-9a-z_.]+)'. _TESTS = [{. # embedded via <div class="media-player". 'url': 'http://loc.gov/item/90716351/',. 'md5': '6ec0ae8f07f86731b1b2ff70f046210a',. 'info_dict': {. 'id': '90716351',. 'ext': 'mp4',. 'title': "Pa's trip to Mars",. 'duration': 0,. 'view_count': int,. },. }, {. # webcast embedded via mediaObjectId. 'url': 'https://www.loc.gov/today/cyberlc/feature_wdesc.php?rec=5578',. 'info_dict': {. 'id': '5578',. 'ext': 'mp4',. 'tit

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\libsyn.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3637
Entropy (8bit):	4.733473249972319
Encrypted:	false
SSDEEP:	96:cIJ6sxM6jyGBRo6uvq82/0hzVfNFcpj52bECHeSIJlf6GuVDEWNs6Ng:cIMAO8zGVNFY5GOlYG6Ng
MD5:	4D54A7B94F0CB2689416356BD06C5DE8
SHA1:	95578D4BEB7D8B35CE37B8704EC68C57D72F7E24
SHA-256:	3F0952A8750D731992FAD8FB3F778BB698AD5147636D24A7D7DDEB0F1C8A40F6
SHA-512:	6CE3082EFCA47233F75C096FCF8AFF87C1ADAC8B89356B27F42AC7483F2207D3906BA1CF2E3D5845AA80ADE6CECA9F725B3952E53677A1449ACEA68C18C9E929
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. get_element_by_class,. parse_duration,. strip_or_none,. unified_strdate,.)...class LibsynIE(InfoExtractor):. _VALID_URL = r'(?P<mainurl>https?://html5-player\.libsyn\.com/embed/episode/id/(?P<id>[0-9]+))'.. _TESTS = [{. 'url': 'http://html5-player.libsyn.com/embed/episode/id/6385796/',. 'md5': '2a55e75496c790cdeb058e7e6c087746',. 'info_dict': {. 'id': '6385796',. 'ext': 'mp3',. 'title': "Champion Minded - Developing a Growth Mindset",. # description fetched using another request:. # http://html5-player.libsyn.com/embed/getitemdetails?item_id=6385796. # 'description': 'In this episode, Allistair talks about the importance of developing a growth mindset, not only in sports, but in life too.',. 'upload_date': '20180320',. 'th

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lifenews.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9621
Entropy (8bit):	5.0767481447847
Encrypted:	false
SSDEEP:	192:GwUr0yjSbiD5jJnuj4ezJX2JEij1UjOa8j6YCW+R9hw1rxhr7ulfS4lahmzON+UX:8mbStuHgLZU78CW+R9hw1rxhr7ulX4hX
MD5:	2F215D43A0FA332B172A4059B9B262B9
SHA1:	C2AEB577B940C2B57163C36C58280E76219D2E3E
SHA-256:	5E3EAD3A916D61464AF491DDA1ADA026CFD9AFC65D9E71CA931061136713514D
SHA-512:	03DFDA01A6CF081DEDF5674383F45FB92AB00D68C59926E9325DAF62A794653B3B5CDB3421D2B5AE76519AAFA045CA047C86F03A4A5B510931878CF8F820BFAD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_iso8601,. remove_end,.)...class LifeNewsIE(InfoExtractor):. IE_NAME = 'life'. IE_DESC = 'Life.ru'. _VALID_URL = r'https?://life\.ru/t/[^/]+/(?P<id>\d+)'.. _TESTS = [{. # single video embedded via video/source. 'url': 'https://life.ru/t/......./98736',. 'md5': '77c95eaefaca216e32a76a343ad89d23',. 'info_dict': {. 'id': '98736',. 'ext': 'mp4',. 'title': '....... ..... .... ..... .......... ......',. 'description': 'md5:3b06b1b39b5e2bea548e403d99b8bf26',. 'timestamp': 1344154740,. 'upload_date': '20120805',. 'view_count': int,. }. }, {. # single video embedded via

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\limelight.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15696
Entropy (8bit):	4.499991049023078
Encrypted:	false
SSDEEP:	384:IoeRW2eiGPKqMpE6Hi8g5aEcLKOWqi8V+TLf6NMqEukpuKHsefuSQ7M7M4uCyl:IoeRW2eiGPKqMpE6Hi8iaEcLKOWqi8Vn
MD5:	D2FE053EE0ED9F30C30434919E186F75
SHA1:	8808EB28FF487D9628B14DC5DAB06A29D0736254
SHA-256:	77058658EC1312D3395CB4630BAF12F7E02E654D3DD16E698C3D456618040DB9
SHA-512:	8AB3F7B7A10C63B5F1F1364E575988FAAAB629086A37094C43DBFC7E6F4C2DAA8370F66B4CA5DE949CB667524D6906020D334762AAC6EB3B1B6699B36C83D254
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. smuggle_url,. try_get,. unsmuggle_url,. ExtractorError,.)...class LimelightBaseIE(InfoExtractor):. _PLAYLIST_SERVICE_URL = 'http://production-ps.lvp.llnw.net/r/PlaylistService/%s/%s/%s'. _API_URL = 'http://api.video.limelight.com/rest/organizations/%s/%s/%s/%s.json'.. @classmethod. def _extract_urls(cls, webpage, source_url):. lm = {. 'Media': 'media',. 'Channel': 'channel',. 'ChannelList': 'channel_list',. }.. def smuggle(url):. return smuggle_url(url, {'source_url': source_url}).. entries = []. for kind, video_id in re.findall(. r'LimelightPlayer\.doLoad(Media\|Channel\|ChannelList)\(["\'](?P<id>[a-z0-9]{32})',. webpage):. entries

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\line.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	4.705764513562361
Encrypted:	false
SSDEEP:	96:f5hUUf+mXjIhGf0Te6Ddlckwp18Wy8N8ybdVQ+BTu+j4Ys6ND8XEHQO9:RCRna0TDdlckwpyWy8LPTu+K6NYgB9
MD5:	B3B9585AF0B27E0F576A72BFBF5D3F22
SHA1:	3E7CFDC1A2E42D3CD2A2D9C0CBE379DA474EA364
SHA-256:	AA7C7E960D0218B7679C68F59325C9FFD815505EDD4AC217C2F690B519425FB4
SHA-512:	B4B82A415E175D36870D24F06B57930614C840F20FF2ACA01AE951643FAFE1F432859E942F597A5BB83914C8A5E7F7E5D7F93A175619230360228C0D15BF8516
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import js_to_json...class LineTVIE(InfoExtractor):. _VALID_URL = r'https?://tv\.line\.me/v/(?P<id>\d+)_[^/]+-(?P<segment>ep\d+-\d+)'.. _TESTS = [{. 'url': 'https://tv.line.me/v/793123_goodbye-mrblack-ep1-1/list/69246',. 'info_dict': {. 'id': '793123_ep1-1',. 'ext': 'mp4',. 'title': 'Goodbye Mr.Black \| EP.1-1',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 998.509,. 'view_count': int,. },. }, {. 'url': 'https://tv.line.me/v/2587507_%E6%B4%BE%E9%81%A3%E5%A5%B3%E9%86%ABx-ep1-02/list/185245',. 'only_matching': True,. }].. def _real_extract(self, url):. series_id, segment = re.match(self._VALID_URL, url).groups(). video_id = '%s_%s' % (series_id, segment).. webpage = self._download_webpage(url, video_id).. player_params = self._p

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\linkedin.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6753
Entropy (8bit):	4.623831830397464
Encrypted:	false
SSDEEP:	192:glX2gWBcQ27tAZ7yLVnLgROOeczTtH6NBLZmNUsxe:glGgWBcQ27k7inLgROOeczTtH6NB8Usw
MD5:	D0F2C8F69906CBC64734500DC8547881
SHA1:	BFF4840F504DB9E9DDF1FBE290F7CFD10F4FFFD3
SHA-256:	5A31F3F69C5E59703E215F76D32B377E233E08024043E6C6B52C4F43C8DD54F7
SHA-512:	21FD73B5D1F01C1DDF1FBCC8424E35A29C389A0C751F51EC85B703F82E49BB113ECD6FAEDE54AE853AF11242C6628A2E54DED010A1FC2800915729EDDD374402
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. urlencode_postdata,. urljoin,.)...class LinkedInLearningBaseIE(InfoExtractor):. _NETRC_MACHINE = 'linkedin'. _LOGIN_URL = 'https://www.linkedin.com/uas/login?trk=learning'.. def _call_api(self, course_slug, fields, video_slug=None, resolution=None):. query = {. 'courseSlug': course_slug,. 'fields': fields,. 'q': 'slugs',. }. sub = ''. if video_slug:. query.update({. 'videoSlug': video_slug,. 'resolution': '_%s' % resolution,. }). sub = ' %dp' % resolution. api_url = 'https://www.linkedin.com/learning-api/detailedCourses'. return self._download_json(. api_url, video_slug, 'Downloading%s JSON metadata' % sub, headers={. 'Csrf-Token':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\linuxacademy.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6559
Entropy (8bit):	4.677169757450537
Encrypted:	false
SSDEEP:	96:Bpjxn1Fun1zn67GQWxb4iFDaEYUQcKOVc3vRmnsJKxCWqKLm1Ac8HPn0SO:Bpjx14n1z67Gb9FWnrYnokb4lKO
MD5:	1B0A49986D4B3CCC73D21368FB39BF80
SHA1:	EA6BCB04EA2BF0979E96708CC1C17E79889D5A1C
SHA-256:	58B9BE0D6FA3288A1C406A87A526E880326608AF835381F579824E145E01265B
SHA-512:	8715E18F26543298F775C2BE3A5D5A87856F914936E41AF53478EE375DF2F38AA0814A4F1512DEAFD2C43E430D3E501E39A6910E22B7F91DF6828511CD698102
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import random.import re..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. orderedSet,. unescapeHTML,. urlencode_postdata,. urljoin,.)...class LinuxAcademyIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:www\.)?linuxacademy\.com/cp/. (?:. courses/lesson/course/(?P<chapter_id>\d+)/lesson/(?P<lesson_id>\d+)\|. modules/view/id/(?P<course_id>\d+). ). '''. _TESTS = [{. 'url': 'https://linuxacademy.com/cp/courses/lesson/course/1498/lesson/2/module/154',. 'info_dict': {. 'id': '1498-2',. 'ext': 'mp4',. 'title': "Introduction to the Practitioner's Brief",. },. 'params': {. 'skip

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\litv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6254
Entropy (8bit):	5.162109472431887
Encrypted:	false
SSDEEP:	192:gCpZOTC2Pf5x8Oio5BLdo3O3sydKck70A6NE:gCpZOTCYH8/ojm3EDdKc9A6NE
MD5:	76FA3BF7068AC99DE3AD58E89E0DC02B
SHA1:	801A4D31375F29DDBD5EF9ABA5075E13318F8EEB
SHA-256:	67DB6543C44B8B5BDA518325227504A339913670D2758F6CB0E108A451B6AB3B
SHA-512:	66233EB7EF46642801D7A586821CCA07AF71C91DAF658B0C8E9877241B8F7A9EFD13D00A46635439EF9E47B5DB46B4D8B81F1F769403CB5CF8CC61D1121D8310
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. smuggle_url,. unsmuggle_url,.)...class LiTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?litv\.tv/(?:vod\|promo)/[^/]+/(?:content\.do)?\?.*?\b(?:content_)?id=(?P<id>[^&]+)'.. _URL_TEMPLATE = 'https://www.litv.tv/vod/%s/content.do?id=%s'.. _TESTS = [{. 'url': 'https://www.litv.tv/vod/drama/content.do?brc_id=root&id=VOD00041610&isUHEnabled=true&autoPlay=1',. 'info_dict': {. 'id': 'VOD00041606',. 'title': '...',. },. 'playlist_count': 50,. }, {. 'url': 'https://www.litv.tv/vod/drama/content.do?brc_id=root&id=VOD00041610&isUHEnabled=true&autoPlay=1',. 'md5': '969e343d9244778cb29acec608e53640',. 'info_dict': {. 'id': 'VOD00041610',. 'ext': 'mp4',. 'title': '....1.',. 'thumbnai

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\livejournal.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	4.888857282900641
Encrypted:	false
SSDEEP:	24:zi8lFvngpjYRUjZon/65dll2VPdZ8aeIXjlgtewUdxreW7LK+/0Ffl5VZ2P4vvg:+uxgpjYa9w65pAPcajXjlkewUdwW7WuR
MD5:	F8078A31E44CB748DD5D3FA7D77D172D
SHA1:	5EAF6642C656F932C472E0FFBBFA4CCB52839773
SHA-256:	4F6779E3AE0D68C68EE9C57DCE9DE8DF401DAFBF6EB1995D6239A10B60D29FCA
SHA-512:	C6AACE0B8A90B0B0CE349D8F8B85EEBE94BB3375AE326416479B281F2EB7A6AC7C64E4C236BAA51674062E6B4E79F46623A51CA72A86AD5A60FB64F4287599FB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import int_or_none...class LiveJournalIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^.]+\.)?livejournal\.com/video/album/\d+.+?\bid=(?P<id>\d+)'. _TEST = {. 'url': 'https://andrei-bt.livejournal.com/video/album/407/?mode=view&id=51272',. 'md5': 'adaf018388572ced8a6f301ace49d4b2',. 'info_dict': {. 'id': '1263729',. 'ext': 'mp4',. 'title': '........... ...... ....',. 'upload_date': '20190624',. 'timestamp': 1561406715,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). record = self._parse_json(self._search_regex(. r'Site\.page\s=\s({.+?});', webpage,. 'page data'), video_id)['video']['record']. storage_id = compat_str(

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\liveleak.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8015
Entropy (8bit):	4.744861811142839
Encrypted:	false
SSDEEP:	192:1cJuv3gN48ASo75U7sfwV2OytFJPYHqRDuW4f8TlelApODgzwIaWw:1cJ23r8Q75UYfyytPYKRDuW4f8TleUOX
MD5:	3BFF28441E10439C3B42D39F57FCF930
SHA1:	CB78B632997E48DBA20B447CED88BD6BA620FDC3
SHA-256:	787E5C459FAA10AD3704A6D84FB13229E38AF57D1425C21F2507644D0037A93F
SHA-512:	BD59EF13B3C382C1A58ECF2142B3331DF25F7F018DD41C6CF5AE2BCD98E52238B51EDB4B645CB133F0C1E343BE1F8CCD6FF513601185596F42D24288FF9AB184
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class LiveLeakIE(InfoExtractor):. _VALID_URL = r'https?://(?:\w+\.)?liveleak\.com/view\?.?\b[it]=(?P<id>[\w_]+)'. _TESTS = [{. 'url': 'http://www.liveleak.com/view?i=757_1364311680',. 'md5': '0813c2430bea7a46bf13acf3406992f4',. 'info_dict': {. 'id': '757_1364311680',. 'ext': 'mp4',. 'description': 'extremely bad day for this guy..!',. 'uploader': 'ljfriel2',. 'title': 'Most unlucky car accident',. 'thumbnail': r're:^https?://.\.jpg$'. }. }, {. 'url': 'http://www.liveleak.com/view?i=f93_1390833151',. 'md5': 'd3f1367d14cc3c15bf24fbfbe04b9abf',. 'info_dict': {. 'id': 'f93_1390833151',. 'ext': 'mp4',. 'description': 'German Television Channel NDR does an exclusive interview with Edward Snowden.\r\nUploaded on LiveLe

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\livestream.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13696
Entropy (8bit):	4.608815241099591
Encrypted:	false
SSDEEP:	384:23sc+rGLl6o6hWplwfexBO1oizATq6N2meuOfyTY6NSMzgdgZLfoj4W98F8jypl6:IX6o6hWplwfexBO1oizATq82meuOfyTM
MD5:	5786308E207794D0552378BCC217A96F
SHA1:	F22B96BE5F6ABEA863FE82E922A167DCC86DBDB7
SHA-256:	2517E26B34324E2713E34D3596E1247FA2DD6ED9A72380A4A5DF974E99D7F40C
SHA-512:	E7C9943ED4E84A866090D5AE4A12616CF221615DF07ECBF3A20D7446C31344497C3D0A255C141A96F4BB4ABD79633FB29139ACEEC70476787F0E0B5C8D3E4BEC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. find_xpath_attr,. xpath_attr,. xpath_with_ns,. xpath_text,. orderedSet,. update_url_query,. int_or_none,. float_or_none,. parse_iso8601,. determine_ext,.)...class LivestreamIE(InfoExtractor):. IE_NAME = 'livestream'. _VALID_URL = r'https?://(?:new\.)?livestream\.com/(?:accounts/(?P<account_id>\d+)\|(?P<account_name>[^/]+))/(?:events/(?P<event_id>\d+)\|(?P<event_name>[^/]+))(?:/videos/(?P<id>\d+))?'. _TESTS = [{. 'url': 'http://new.livestream.com/CoheedandCambria/WebsterHall/videos/4719370',. 'md5': '53274c76ba7754fb0e8d072716f2292b',. 'info_dict': {. 'id': '4719370',. 'ext': 'mp4',. 'title': 'Live from Webster Hall NYC',. 'timestamp': 1350008072,. 'upload_date': '20121012',. 'dur

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lnkgo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3921
Entropy (8bit):	4.721578359197039
Encrypted:	false
SSDEEP:	96:VBlYaMlSjeX3vI/0jPGX3vIYJ9uDGFxGnLIMk8VuHkrVCmcSweBT+6N6ms0f:rl14TI8cIYJxaJCiwqT+6Nl
MD5:	337484CC328918F05FAABEC88927CEDE
SHA1:	E73BB1BA4CF827171EBEFAADF585493573D0DF64
SHA-256:	3FF9C5082756547AE7CD186D6576FFB1200908097A54C42DF7574F323B5FE6B0
SHA-512:	E96D47202D7051AB5DB958AF32D5CDF20F4C512AA5F64AB8636A40279512536D5D9A2DCC03251ACAE73E38EC62991255B5F784AF2ECB551B63FDB4099D0F0FFC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. unified_strdate,.)...class LnkGoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?lnkgo\.(?:alfa\.)?lt/visi-video/(?P<show>[^/]+)/ziurek-(?P<id>[A-Za-z0-9-]+)'. _TESTS = [{. 'url': 'http://lnkgo.alfa.lt/visi-video/yra-kaip-yra/ziurek-yra-kaip-yra-162',. 'info_dict': {. 'id': '46712',. 'ext': 'mp4',. 'title': 'Yra kaip yra',. 'upload_date': '20150107',. 'description': 'md5:d82a5e36b775b7048617f263a0e3475e',. 'age_limit': 7,. 'duration': 3019,. 'thumbnail': r're:^https?://.*\.jpg$'. },. 'params': {. 'skip_download': True, # HLS download. },. }, {. 'url': 'http://lnkgo.alfa.lt/visi-video/aktualai-pratesimas/ziurek-nerdas-taiso-kompiuteri-2',. 'info_dict': {. 'id': '47289',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\localnews8.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	4.881181446231953
Encrypted:	false
SSDEEP:	48:+u9rmj+W9JaeTq1jQiT0hU9CkRqadfFkZVmh3BPuB8Br:JKywJlTq1j3T0hGCkoaG6NLBr
MD5:	7FA2AAE06C814D83E80F7708774A988E
SHA1:	8ED8BD2CCAFE6B925BAD313538A81FD495A61518
SHA-256:	21A5514DB0FB1E339D161474C9EE2AAA389FBDB81BEC374AC283FC43C2EC7C4E
SHA-512:	6069BEED2EAB03E9FE6B0B7AAE779C3F1EF8F5104440BFE40F0FC72243E2D8DC68E4C357AEE6D61BC9FA48E83689C5057DFA871D909178EC2D3A5BD431CACC3F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class LocalNews8IE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?localnews8\.com/(?:[^/]+/)*(?P<display_id>[^/]+)/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.localnews8.com/news/rexburg-business-turns-carbon-fiber-scraps-into-wedding-rings/35183304',. 'md5': 'be4d48aea61aa2bde7be2ee47691ad20',. 'info_dict': {. 'id': '35183304',. 'display_id': 'rexburg-business-turns-carbon-fiber-scraps-into-wedding-rings',. 'ext': 'mp4',. 'title': 'Rexburg business turns carbon fiber scraps into wedding ring',. 'description': 'The process was first invented by Lamborghini and less than a dozen companies around the world use it.',. 'duration': 153,. 'timestamp': 1441844822,. 'upload_date': '20150910',. 'uploader_id': 'api',. }. }.. def _real_extract(self, u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lovehomeporn.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	4.799789549251717
Encrypted:	false
SSDEEP:	24:1R8leR8GWKzrwJKrcTucIt/BkEucCdlheXvIUGMgHNqadfFs1ZVJvJKzlGXRUM3:PueR8AXd5cI14cCoXvKM6NqadfFkZVJp
MD5:	FFBD6450CE7075493927A3C8E6C1556D
SHA1:	410184E03307326E0C9611AA9882DD9B42374F21
SHA-256:	3D97A0C09AEA0DED60937BF5F4AA3F3BD4AFAC89EEEE7EB75658FA77FFDBAF3E
SHA-512:	359416A3CE3C1AF0B24EED43ECBAFA63BE9ED5EC103E120F8F3582559F4C1F6255629DB13517BF841E167805C24304B5C6E08D55E6746DC107A93E522D02166D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .nuevo import NuevoBaseIE...class LoveHomePornIE(NuevoBaseIE):. _VALID_URL = r'https?://(?:www\.)?lovehomeporn\.com/video/(?P<id>\d+)(?:/(?P<display_id>[^/?#&]+))?'. _TEST = {. 'url': 'http://lovehomeporn.com/video/48483/stunning-busty-brunette-girlfriend-sucking-and-riding-a-big-dick#menu',. 'info_dict': {. 'id': '48483',. 'display_id': 'stunning-busty-brunette-girlfriend-sucking-and-riding-a-big-dick',. 'ext': 'mp4',. 'title': 'Stunning busty brunette girlfriend sucking and riding a big dick',. 'age_limit': 18,. 'duration': 238.47,. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). display_id = mobj.group('display_id').. info = self._extract_nuevo(. 'http://lovehomeporn.co

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lrt.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3234
Entropy (8bit):	4.663606901437011
Encrypted:	false
SSDEEP:	96:KOOUeBbcSute0EoBBTUIfq3x87/jQwLOW3APXBTeoKBNbpwlmn6N1t38Eo:HOUgK15B1q36gwLOW3ApTk96NoJ
MD5:	88591C7393234FF3338D60CBD5CC0D8D
SHA1:	86C944C98B7F132A5622B86738C6E04649FA84B0
SHA-256:	FFA46737C1860E72FB27E089B5C6E34831985C06825CF8DB71780296CBCD9B68
SHA-512:	7262AEF8D3EDDEB5B5BA18A0A4902DD8DAD9E96A75DD17E9C166E5924FEC10179B3665B353F16FF2420A9C87EEEB206A1BAE16298D147B5F8A64A2601EC104C7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. parse_duration,. remove_end,.)...class LRTIE(InfoExtractor):. IE_NAME = 'lrt.lt'. _VALID_URL = r'https?://(?:www\.)?lrt\.lt/mediateka/irasas/(?P<id>[0-9]+)'. _TESTS = [{. # m3u8 download. 'url': 'http://www.lrt.lt/mediateka/irasas/54391/',. 'md5': 'fe44cf7e4ab3198055f2c598fc175cb0',. 'info_dict': {. 'id': '54391',. 'ext': 'mp4',. 'title': 'Septynios Kauno dienos',. 'description': 'md5:24d84534c7dc76581e59f5689462411a',. 'duration': 1783,. 'view_count': int,. 'like_count': int,. },. }, {. # direct mp3 download. 'url': 'http://www.lrt.lt/mediateka/irasas/1013074524/',. 'md5': '389da8ca3cad0f51d12bed0c844f6a0a',. 'info_dict': {. 'id': '1013074524',. 'ext

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\lynda.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12703
Entropy (8bit):	4.607436134371312
Encrypted:	false
SSDEEP:	384:deDiWQSy8IU0D9qHw03QdBjehkaBdTFb6NVI4ftTQyTpN6N0yyio8qsmT0fl+mU:wmpSo9sAdBjehkaBdTFb8VI4ftTQyTp1
MD5:	7D1C9FFD162F1FC86713A7B09228EAB9
SHA1:	9AB1A036BB18F668E3540C523F6FE8A41A57B27F
SHA-256:	98DF06A804FCA66227D96E81678D906784F033D197F57CEB3EB98FABBFB473B6
SHA-512:	AA7EC600B59DA74FDB398E58935EF3F9C3081D27AA216D9E3A849E9A402E7FE28F406692167DF6C6C893A541FD605FB5BFD606EF8220CA701B263F5EC1A60A13
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. urlencode_postdata,.)...class LyndaBaseIE(InfoExtractor):. _SIGNIN_URL = 'https://www.lynda.com/signin/lynda'. _PASSWORD_URL = 'https://www.lynda.com/signin/password'. _USER_URL = 'https://www.lynda.com/signin/user'. _ACCOUNT_CREDENTIALS_HINT = 'Use --username and --password options to provide lynda.com account credentials.'. _NETRC_MACHINE = 'lynda'.. def _real_initialize(self):. self._login().. @staticmethod. def _check_error(json_string, key_or_keys):. keys = [key_or_keys] if isinstance(key_or_keys, compat_str) else key_or_keys. for key in keys:. error = json_string.get(key). if error:. raise ExtractorError('Unable to login: %s' % error, expected=True).. def _login_step(self, form_html, fallb

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\m6.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	896
Entropy (8bit):	5.145762931416938
Encrypted:	false
SSDEEP:	24:zi8lFv+G8Cew3t4+crgIgt/XxdlHE5f/T2gaeIXjrFE:+uArWturGXx45HT2gajXjrFE
MD5:	7422AF19C8029B85E07C5B7BDD7D26E1
SHA1:	318B133793BC517938A77E01F2CA12C89BB74777
SHA-256:	FFFF16CA0B80406351E48988458ECD2234DC649B5EFD2CD138FBE4AE792C4B9B
SHA-512:	3C66BE559F5F52D11F972E4DFC3334A5AD5F802081E82DFBC782A7A74E5DD78F5393C5F501DD1A8913FDF2539F5762F12B0140155F3F2B9D57F44C7397F9EFDA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class M6IE(InfoExtractor):. IE_NAME = 'm6'. _VALID_URL = r'https?://(?:www\.)?m6\.fr/[^/]+/videos/(?P<id>\d+)-[^\.]+\.html'.. _TEST = {. 'url': 'http://www.m6.fr/emission-les_reines_du_shopping/videos/11323908-emeline_est_la_reine_du_shopping_sur_le_theme_ma_fete_d_8217_anniversaire.html',. 'md5': '242994a87de2c316891428e0176bcb77',. 'info_dict': {. 'id': '11323908',. 'ext': 'mp4',. 'title': 'Emeline est la Reine du Shopping sur le th.me . Ma f.te d.anniversaire ! .',. 'description': 'md5:1212ae8fb4b7baa4dc3886c5676007c2',. 'duration': 100,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). return self.url_result('6play:%s' % video_id, 'SixPlay', video_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\macgamestore.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1280
Entropy (8bit):	4.755556836186609
Encrypted:	false
SSDEEP:	24:1R8lFvbinPZmwOJGjcAcwPEtA8kk/JlRaeIXjl+twl4zAhXRpuYkXnZv5UPlvi:Pu6cAcos5ajXjlCTWXWPXnrUU
MD5:	D66F125C0AA7DE3F67A76E55DF92F962
SHA1:	9FFC042B5A742BFCEF01AAA44ACDD44A336E1030
SHA-256:	237D350194EF99475BD71F401E14D8DA695587AAF37A620C0F445DFD6FAC876E
SHA-512:	0CA2E178426BB9F463660E5FCFEF58C8A633314EDBF65A43C1BB55EEAC1FD91E65F30C14A516628204976B9D6FDEF6BB0AEEF22122E000446F3143A480B8DB41
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import ExtractorError...class MacGameStoreIE(InfoExtractor):. IE_NAME = 'macgamestore'. IE_DESC = 'MacGameStore trailers'. _VALID_URL = r'https?://(?:www\.)?macgamestore\.com/mediaviewer\.php\?trailer=(?P<id>\d+)'.. _TEST = {. 'url': 'http://www.macgamestore.com/mediaviewer.php?trailer=2450',. 'md5': '8649b8ea684b6666b4c5be736ecddc61',. 'info_dict': {. 'id': '2450',. 'ext': 'm4v',. 'title': 'Crow',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. url, video_id, 'Downloading trailer page').. if '>Missing Media<' in webpage:. raise ExtractorError(. 'Trailer %s does not exist' % video_id, expected=True).. video_title = self._html_search_regex(. r'<title>MacGameStore: (.*?) Trailer</title>', web

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mailru.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11017
Entropy (8bit):	4.642263120050363
Encrypted:	false
SSDEEP:	192:eU1QXNjN6s2FPOS9J26I24bmuKsTv/96NqvqhVQonrzrv+rM0Y8uJEgVs:EXNjN6sqPOS9JI24bXKsTn96NOqhVQou
MD5:	0E29430BD4925ED028CFA5A9DE5F79BE
SHA1:	DB36E4077BDD46401A05654F0B04DC5C6C519FDA
SHA-256:	4CB3287443E01032C92BA4C708EC1BDB0D1DBD785E76FB8A2BB2D926970CB688
SHA-512:	FA7FA307DAD6820EBC8F20BB4DA2E521B007EAFBB04C5F4C2ED81BC4BBA391CBF1722D4CC0AD3B2A8691B35EACF4EBA041F00A8FDB20781125EF8389B3C6C5AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import json.import re..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote.from ..utils import (. int_or_none,. parse_duration,. remove_end,. try_get,.)...class MailRuIE(InfoExtractor):. IE_NAME = 'mailru'. IE_DESC = '.....@Mail.Ru'. _VALID_URL = r'''(?x). https?://. (?:(?:www\|m)\.)?my\.mail\.ru/. (?:. video/.*\#video=/?(?P<idv1>(?:[^/]+/){3}\d+)\|. (?:(?P<idv2prefix>(?:[^/]+/){2})video/(?P<idv2suffix>[^/]+/\d+))\.html\|. (?:video/embed\|\+/video/meta)/(?P<metaid>\d+). ). '''. _TESTS = [. {. 'url': 'http://my.mail.ru/video/top#video=/mail/sonypicturesrus/75/76',. 'md5': 'dea205f03120046894db4ebb6159879a',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\makertv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	5.034032934196812
Encrypted:	false
SSDEEP:	24:zi8lFv7B1T/vwifm2U/zjdlDFk7w8v+DnPZoWKaeIXjlgtoqB6W+vF8s5g:+u1XT/v8x/ChInUajXjlkoqB7+esa
MD5:	46E78B7F1393F4A2C7457A965AD96E2B
SHA1:	CC7186C13FC994B0D5E99543722F4A4ED260969A
SHA-256:	B4E3AB5D2D900B53C11EE78A7F69BE9C3108A9D7987ADC8DACA1BAE7E03A5E61
SHA-512:	F6881D1C73E28D203FDC2853D44DAA9B2EF7D47BC432792D2AF1267DA6D5E5E6B7D9D42482A8D411044C5018D9CABE7DB3D7B0EC302CE8EE99480B38DF50000E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class MakerTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.)?maker\.tv/(?:[^/]+/)*video\|makerplayer\.com/embed/maker)/(?P<id>[a-zA-Z0-9]{12})'. _TEST = {. 'url': 'http://www.maker.tv/video/Fh3QgymL9gsc',. 'md5': 'ca237a53a8eb20b6dc5bd60564d4ab3e',. 'info_dict': {. 'id': 'Fh3QgymL9gsc',. 'ext': 'mp4',. 'title': 'Maze Runner: The Scorch Trials Official Movie Review',. 'description': 'md5:11ff3362d7ef1d679fdb649f6413975a',. 'upload_date': '20150918',. 'timestamp': 1442549540,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). jwplatform_id = self._search_regex(r'jw_?id="([^"]+)"', webpage, 'jwplatform id').. return {. '_type': 'url_transparent',. 'id': video_id,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\malltv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2095
Entropy (8bit):	5.069034743714979
Encrypted:	false
SSDEEP:	48:+uiiZZfR+vLxakZvRktfJoXhgll+qBmup6tbS2kyuemjz8vI:Gi7KxakZvsfJ3wucVLAeBg
MD5:	B0D7A954BCBDE2B1883DC367FDFD8CA2
SHA1:	39685ADF150889CD4CED642D2C9009E86CFF391B
SHA-256:	C7537389BB0768DBE6DE0F6D988C61610245DD4455554580C3DB9F88C3980456
SHA-512:	5E8E69A603B9E9A544591C49BD3D8F0BCFF8D7D54E085A429F83F1FBDEDA54C3611E2F7DA75EC606EF0BABC8A843DFA9E6D9E6491572E0F75FCE82F0FB722FA2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import merge_dicts...class MallTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mall\.tv/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.mall.tv/18-miliard-pro-neziskovky-opravdu-jsou-sportovci-nebo-clovek-v-tisni-pijavice',. 'md5': '1c4a37f080e1f3023103a7b43458e518',. 'info_dict': {. 'id': 't0zzt0',. 'display_id': '18-miliard-pro-neziskovky-opravdu-jsou-sportovci-nebo-clovek-v-tisni-pijavice',. 'ext': 'mp4',. 'title': '18 miliard pro neziskovky. Opravdu jsou sportovci nebo .lov.k v t.sni pijavice?',. 'description': 'md5:25fc0ec42a72ba602b602c683fa29deb',. 'duration': 216,. 'timestamp': 1538870400,. 'upload_date': '20181007',. 'view_count': int,. }. }, {. 'url': 'https://www.mall.tv/kdo-to-plati/18-miliard-p

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mangomolo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	4.974790035731387
Encrypted:	false
SSDEEP:	48:+uHVpp+0R3pMXYxvqrCFhBTnh3HnN16N/SOn/46Sj8:TrbxvSGhBTnhXnN16N/dgj8
MD5:	64FA1182C10A7E62013FDEF3EC24F426
SHA1:	78591CBD945E670C73F4BBD8C894DB5BFBA6D76D
SHA-256:	ADACF63584AD5988206A61BC3D07D138FFC31596A68F145788905144A8F2D7C7
SHA-512:	254044C41D9ACF99C48B1FEBFE287F37D4650561A0E45EEC4C33385D87A314374A23838EA4367E08A77CB086B31F30972B96F092F51BEEA3F75759611CC035D2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_urllib_parse_unquote,.).from ..utils import int_or_none...class MangomoloBaseIE(InfoExtractor):. def _get_real_id(self, page_id):. return page_id.. def _real_extract(self, url):. page_id = self._get_real_id(self._match_id(url)). webpage = self._download_webpage(url, page_id). hidden_inputs = self._hidden_inputs(webpage). m3u8_entry_protocol = 'm3u8' if self._IS_LIVE else 'm3u8_native'.. format_url = self._html_search_regex(. [. r'file\s:\s"(https?://[^"]+?/playlist\.m3u8)',. r'<a[^>]+href="(rtsp://[^"]+)"'. ], webpage, 'format url'). formats = self._extract_wowza_formats(. format_url, page_id, m3u8_entry_protocol, ['smil']). self._sort_formats(formats).. return {. 'id': page_id,. 'title':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\manyvids.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3121
Entropy (8bit):	4.727577587786278
Encrypted:	false
SSDEEP:	96:YOEx7IeIjzjt5BIfaUm1GwVzNTt9v7d1396yXXU6Ng:t6eHx5Qa/B7d1396KE6Ng
MD5:	672267FAF262712C551554B088EDC915
SHA1:	7892DB8DDD7858D33C4D9A5B571E17C304422F12
SHA-256:	4855903D83AB286550E2CC3D94ABEFC945BE1CDB971B7D26514298ECABF8B2B9
SHA-512:	BF61E3FFE4D38488F7758A9CE7174924C289B591555501D0BF5A45DC28766A2737B24589DBC491FAC593B8C531069A064018A88E2490EE88793842E2C818E320
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. str_to_int,. urlencode_postdata,.)...class ManyVidsIE(InfoExtractor):. _VALID_URL = r'(?i)https?://(?:www\.)?manyvids\.com/video/(?P<id>\d+)'. _TESTS = [{. # preview video. 'url': 'https://www.manyvids.com/Video/133957/everthing-about-me/',. 'md5': '03f11bb21c52dd12a05be21a5c7dcc97',. 'info_dict': {. 'id': '133957',. 'ext': 'mp4',. 'title': 'everthing about me (Preview)',. 'view_count': int,. 'like_count': int,. },. }, {. # full video. 'url': 'https://www.manyvids.com/Video/935718/MY-FACE-REVEAL/',. 'md5': 'f3e8f7086409e9b470e2643edb96bdcc',. 'info_dict': {. 'id': '935718',. 'ext': 'mp4',. 'title': 'MY FACE REVEAL',. 'view_count': int,. 'like_count': int

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\markiza.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4522
Entropy (8bit):	4.943178669252323
Encrypted:	false
SSDEEP:	96:NV/DG7yLXjnDvHODQDwD4D79fLobF9dcDRO7mlXjboILDWjJemZhO/cX/UimUxB:373qE0EXdRD9qILDW9LTtUG
MD5:	16DFD2882AB8B9574B531814121241BD
SHA1:	2E343A5F6B55AC368010B99263590D3FA1CDABBF
SHA-256:	D92E300EF3B7F359C29C6E87F975839A0C6009396A3AADC796EE830F63A72731
SHA-512:	CD4BA3A5FD8F6FA0124D1EFEF4CC476CD2D83082D5E03C84CFC9847DB2DAD5C25441ED69B859EB64405CCFCEA62DD99B2CB27CC65040D3A3D64F4061311A3DAE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. orderedSet,. parse_duration,. try_get,.)...class MarkizaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?videoarchiv\.markiza\.sk/(?:video/(?:[^/]+/)\|embed/)(?P<id>\d+)(?:[_/]\|$)'. _TESTS = [{. 'url': 'http://videoarchiv.markiza.sk/video/oteckovia/84723_oteckovia-109',. 'md5': 'ada4e9fad038abeed971843aa028c7b0',. 'info_dict': {. 'id': '139078',. 'ext': 'mp4',. 'title': 'Oteckovia 109',. 'description': 'md5:d41d8cd98f00b204e9800998ecf8427e',. 'thumbnail': r're:^https?://.\.jpg$',. 'duration': 2760,. },. }, {. 'url': 'http://videoarchiv.markiza.sk/video/televizne-noviny/televizne-noviny/85430_televizne-noviny',. 'info_dict': {. 'id': '85430',. 'title': 'Telev.zne noviny',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\massengeschmacktv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2688
Entropy (8bit):	4.5637127282723675
Encrypted:	false
SSDEEP:	48:PuiWO872bab0qLNXhP/+beBQowE/FxzP06fJZoLOSYfmP780XDMSbBT+k6N1tc:iO87Sab0qLL+br0/7zPVJZoLOJfq78CT
MD5:	A81635F1138A8CFF8EBFBF1E50F1A6E1
SHA1:	23FA808E29E3492A578D8A1688AB2C74CE654161
SHA-256:	EA1D93F108838AEBF5CAEC23A7D6D39D4AC863AA54802F6BE94F145F47C005D3
SHA-512:	8FBB226C5B6923729DCABE474A6F0C4DC3BA63754E955ADF6BB170C8756847BD414491F02F269F28C45C1E60B8A771699AFD44A814E3971A0B2A723D4C629D7F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. int_or_none,. js_to_json,. mimetype2ext,. parse_filesize,.)...class MassengeschmackTVIE(InfoExtractor):. IE_NAME = 'massengeschmack.tv'. _VALID_URL = r'https?://(?:www\.)?massengeschmack\.tv/play/(?P<id>[^?&#]+)'.. _TEST = {. 'url': 'https://massengeschmack.tv/play/fktv202',. 'md5': 'a9e054db9c2b5a08f0a0527cc201e8d3',. 'info_dict': {. 'id': 'fktv202',. 'ext': 'mp4',. 'title': 'Fernsehkritik-TV - Folge 202',. },. }.. def _real_extract(self, url):. episode = self._match_id(url).. webpage = self._download_webpage(url, episode). title = clean_html(self._html_search_regex(. '<h3>([^<]+)</h3>', webpage, 'title')). thumbnail = self._search_regex(r'POSTER\s=\s"([^"]+)', webpage, 'thumbnail', fatal=False). sources = sel

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\matchtv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1811
Entropy (8bit):	4.663136901739167
Encrypted:	false
SSDEEP:	48:+uVddofZkL4XN2+ptffBdei0dHvExOB5q6jWBT01+6Ng:z0WLGo+XfTe1dHMxW53jWBT0Q6Ng
MD5:	17F32D325EEE655D1699FECE87B7D4EC
SHA1:	DA8146BD8E348F78DF41D9AA862B26925125E9A4
SHA-256:	52AC7512AA1DF3CCEFBAA32A2875091CC4BCFBD4CCF91E2085CE020CA63E2021
SHA-512:	F705442D6CD0FEB733BAFDAC4CA0835FA86A4E84FE4E5A91EC69C9A444613AF83348AD7A8D7EBC20E1D830F1B7D6BB301487A7132A3C4EB0C2AAC8478808C48B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random..from .common import InfoExtractor.from ..utils import xpath_text...class MatchTVIE(InfoExtractor):. _VALID_URL = r'https?://matchtv\.ru(?:/on-air\|/?#live-player)'. _TESTS = [{. 'url': 'http://matchtv.ru/#live-player',. 'info_dict': {. 'id': 'matchtv-live',. 'ext': 'flv',. 'title': r're:^.... .. - ...... .... \d{4}-\d{2}-\d{2} \d{2}:\d{2}$',. 'is_live': True,. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'http://matchtv.ru/on-air/',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = 'matchtv-live'. video_url = self._download_json(. 'http://player.matchtv.ntvplus.tv/player/smil', video_id,. query={. 'ts': '',. 'quality': 'SD',. 'contentId': '561d2c0df7159b37178b4567',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mdr.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6855
Entropy (8bit):	4.433103167772955
Encrypted:	false
SSDEEP:	192:PefQY5zvUOOMj7zu+8r2ajJi6U/BdV3b354bra6Fvh+TIv6Ng:wQY5zvUOOMj7zu+mPjJi3dVL35Yra6lD
MD5:	48FE2B597C0F5B23BC22AF5A5C3FFDFB
SHA1:	FBA8324E2900EB10EF13127A3C577C5E3A534E70
SHA-256:	02F319818BF19D9149335EB293523BAA073770EF7435F5BA1C82E7F7D75BB905
SHA-512:	6972C35E97E41B302E45D73FD7FCDB9E8724F1D53C859E7153F0C74E3EE5446E929A19558BB14431256677F3BF1569FD036A9B3525ACF77A88A26D3AC4F354F6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. determine_ext,. int_or_none,. parse_duration,. parse_iso8601,. xpath_text,.)...class MDRIE(InfoExtractor):. IE_DESC = 'MDR.DE and KiKA'. _VALID_URL = r'https?://(?:www\.)?(?:mdr\|kika)\.de/(?:.*)/[a-z-]+-?(?P<id>\d+)(?:_.+?)?\.html'.. _TESTS = [{. # MDR regularly deletes its videos. 'url': 'http://www.mdr.de/fakt/video189002.html',. 'only_matching': True,. }, {. # audio. 'url': 'http://www.mdr.de/kultur/audio1312272_zc-15948bad_zs-86171fdd.html',. 'md5': '64c4ee50f0a791deb9479cd7bbe9d2fa',. 'info_dict': {. 'id': '1312272',. 'ext': 'mp3',. 'title': 'Feuilleton vom 30. Oktober 2015',. 'duration': 250,. 'uploader': 'MITTELDEUTSCHER RUNDFUNK',. },. 'skip': '404 not found',. }, {. 'url': 'ht

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\medialaan.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9994
Entropy (8bit):	4.335530275625053
Encrypted:	false
SSDEEP:	192:12U0977FFC+NGvBB3J883py/ToiT29URxua6d7MiTf6N6QeXeA:1S9PFFC+NGvBB3Npio9URxua6d7JTf6S
MD5:	1DF2E5BC16576626EE438F615FFB5785
SHA1:	B747404B74538B24FE5E2035519B35CA791FA5DA
SHA-256:	98546A1743F8793DA109415AB60702CEB179512A2E9FBBAE3F85017353E20977
SHA-512:	989CFF5726AED9290A193E1860236D89C1EA7AA53C5259E61A0D16575081C1AA5E9AFFBB6D1C5594A2D9E912A702D2B80FFAFA82A3D89C787F55D11945E78C73
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .gigya import GigyaBaseIE..from ..compat import compat_str.from ..utils import (. int_or_none,. parse_duration,. try_get,. unified_timestamp,.)...class MedialaanIE(GigyaBaseIE):. _VALID_URL = r'''(?x). https?://. (?:www\.\|nieuws\.)?. (?:. (?P<site_id>vtm\|q2\|vtmkzoom)\.be/. (?:. video(?:/[^/]+/id/\|/?\?.?\baid=)\|. (?:[^/]+/). ). ). (?P<id>[^/?#&]+). '''. _NETRC_MACHINE = 'medialaan'. _APIKEY = '3_HZ0FtkMW_gOyKlqQzW5_0FHRC7Nd5XpXJZcDdXY4pk5eES2ZWmejRW5egwVm4ug-'. _SITE_TO_APP_ID = {. 'vtm': 'vtm_watch',. 'q2': 'q2',. 'vtmkzoom': 'vtmkzoom',. }. _TESTS = [{. # vod. 'url': 'http://vtm.be/video/volledi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mediaset.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6470
Entropy (8bit):	4.634291726519435
Encrypted:	false
SSDEEP:	192:9zWfdvCBl4Z3eUlXdyezdyieayaT56J67mKEg9Tjmaww6NT:9zWfdKBl4FeUlXdRzdVenaF6J6KKEg9e
MD5:	D0F9FDC1203D76DE068A651A0249D99D
SHA1:	FB6E74B5AD4F75852E05A04479DDF7A94C77A9D8
SHA-256:	EC13BCBD0E0F791C602792D2A397A306957E4447E7B64B978FB813BEFEC4F841
SHA-512:	615D4632655BFE1F279A896E2CE0E311CB1E0CECD2CA92844FB00FC124B9948D55C8202BC7A1458669300674BE8DDF5DA243776D52EAD9259AE8EF2298ACD161
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .theplatform import ThePlatformBaseIE.from ..compat import (. compat_parse_qs,. compat_str,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. update_url_query,.)...class MediasetIE(ThePlatformBaseIE):. _TP_TLD = 'eu'. _VALID_URL = r'''(?x). (?:. mediaset:\|. https?://. (?:(?:www\|static3)\.)?mediasetplay\.mediaset\.it/. (?:. (?:video\|on-demand)/(?:[^/]+/)+[^/]+_\|. player/index\.html\?.*?\bprogramGuid=. ). )(?P<id>[0-9A-Z]{16}). '''. _TESTS = [{. # full episode. 'url': 'https://www.mediasetplay.mediaset.it/video/hellogoodbye/quarta-puntata_FAFU000000661824',. 'md5': '9b75534d42c44ecef7bf1ffea

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mediasite.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	14684
Entropy (8bit):	4.771635436333247
Encrypted:	false
SSDEEP:	384:9BBt2PfrfS3TdtUs1rUW0vs1oB8n8w+TC6NgtPlf5SPK0Bp74:ToW0s1oB08w+TC8W0P74
MD5:	37FD2477FFD6A834604A65D3A3ED13CB
SHA1:	16646B198568FDB51266606D6673FED92BE1A941
SHA-256:	2CB76745025994131A59D26977603EE3CDF1CB0F15821A2EB516D59343EBDEEE
SHA-512:	CA7E9CC3987C183662D6FE626D965CC1335E38CC4C6DA13731DF7F6D2E0293904A8F3D1A045CC703F458674FF206169576DC5342194C48BF198E4C800CFBB4A1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. float_or_none,. mimetype2ext,. str_or_none,. try_get,. unescapeHTML,. unsmuggle_url,. url_or_none,. urljoin,.)..._ID_RE = r'(?:[0-9a-f]{32,34}\|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12,14})'...class MediasiteIE(InfoExtractor):. _VALID_URL = r'(?xi)https?://[^/]+/Mediasite/(?:Play\|Showcase/(?:default\|livebroadcast)/Presentation)/(?P<id>%s)(?P<query>\?[^#]+\|)' % _ID_RE. _TESTS = [. {. 'url': 'https://hitsmediaweb.h-its.org/mediasite/Play/2db6c271681e4f199af3c60d1f82869b1d',. 'info_dict': {. 'id': '2db6c271681e4f199af3c60d1f82869b1d',. 'ext': 'mp4',. 'title': 'Lecture: Tuesday, September 20, 2016 - Sir Andrew Wiles',. 'description': 'Sir A

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\medici.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2298
Entropy (8bit):	4.72583545428019
Encrypted:	false
SSDEEP:	48:+uzPVF6nNXBSqjXNERBb/jRjTg0GxUDyDlq64RSYyo7D4zoAtN0T6Ng:PT6nNXBSqJET/RFGxU+h3hYyo7ErtN0f
MD5:	3D29F24AC39A96616775D3E56EB422FC
SHA1:	8596DD92D216ED48BCF3A5930E99A9A93F013E21
SHA-256:	B68F1AA29A34AAD4F06C0DC8EB12C3AFA16890C7829B0C7AB84006525BDB6B31
SHA-512:	B015B2FD22AACC2FF8A9968B0DB35BB398B7E80AFF674AAB14A778500DCDFCEAC4459A487D4208D20A51FB1222758E8C744C7F94ABC42E21928B45E09D4B3135
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. unified_strdate,. update_url_query,. urlencode_postdata,.)...class MediciIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?medici\.tv/#!/(?P<id>[^?#&]+)'. _TEST = {. 'url': 'http://www.medici.tv/#!/daniel-harding-frans-helmerson-verbier-festival-music-camp',. 'md5': '004c21bb0a57248085b6ff3fec72719d',. 'info_dict': {. 'id': '3059',. 'ext': 'flv',. 'title': 'Daniel Harding conducts the Verbier Festival Music Camp \u2013 With Frans Helmerson',. 'description': 'md5:322a1e952bafb725174fd8c1a8212f58',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20170408',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. # Sets csrftoken cookie. self._download_webpage(url, video_id).. MEDICI_URL = 'http://www.medici

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\megaphone.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	4.883999796069656
Encrypted:	false
SSDEEP:	48:+ubl87eRxwwiqWpTjXjlkdVThVTUeVUBEBAOmVazfzkaH1mtryTL6Noe9bCF+:u7e7wgQTqoHPOWS4C1mtryTL6Noed
MD5:	E12F563EB31E58496B32E50E6AC4CD44
SHA1:	9CAD7B10F24F561F676D7A67673B4354D7996E2F
SHA-256:	4867257D8492CA2BDEC3AEDBBC2A40E7DAC9A34AAFA25D6C654216884523EB4C
SHA-512:	13F0AB0795B0F1023DB32F85E96B82B3992FA6242756A335CD8CE35BB29039578F3C058B88154EDC335AF1556815BF64EBCA2DC3C6554EDFCC60462D01C93D16
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import js_to_json...class MegaphoneIE(InfoExtractor):. IE_NAME = 'megaphone.fm'. IE_DESC = 'megaphone.fm embedded players'. _VALID_URL = r'https://player\.megaphone\.fm/(?P<id>[A-Z0-9]+)'. _TEST = {. 'url': 'https://player.megaphone.fm/GLT9749789991?"',. 'md5': '4816a0de523eb3e972dc0dda2c191f96',. 'info_dict': {. 'id': 'GLT9749789991',. 'ext': 'mp3',. 'title': '#97 What Kind Of Idiot Gets Phished?',. 'thumbnail': r're:^https://.\.png.$',. 'duration': 1776.26375,. 'author': 'Reply All',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._og_search_property('audio:title', webpage). author = self._og_search_property('audio:artist', webpage). thumb

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\meipai.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3709
Entropy (8bit):	4.906096810322014
Encrypted:	false
SSDEEP:	96:A1qFM5k3AM5BXjY2c2fRfWWXj9t9VfqplWwO1366WmRisWk9dKNl4ixs8eO6Ng:2qS56zLc2pjXVqThO136HgEeO6Ng
MD5:	4636D65856CB3294F3E784E34B0637DA
SHA1:	E2B6E02C44EDEA1412DB9771C427F12D7C2CA01C
SHA-256:	ED35EC4D93A41807233B637C08D18E48C45BC64A455AD57E69811F8432692A55
SHA-512:	037CA40A2EABD98D000E25EF227AB7C6CDFAEA4D50B4146F42DEB4F6C46068DDF1D6BD85E1F281A74A32465659ACA094CD8C8B086EF8E5BB53D8FB0CCC4B44F8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. unified_timestamp,.)...class MeipaiIE(InfoExtractor):. IE_DESC = '..'. _VALID_URL = r'https?://(?:www\.)?meipai\.com/media/(?P<id>[0-9]+)'. _TESTS = [{. # regular uploaded video. 'url': 'http://www.meipai.com/media/531697625',. 'md5': 'e3e9600f9e55a302daecc90825854b4f',. 'info_dict': {. 'id': '531697625',. 'ext': 'mp4',. 'title': '#..##..##...##....#',. 'description': '#..##..##...##....#',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 152,. 'timestamp': 1465492420,. 'upload_date': '20160609',. 'view_count': 35511,. 'creator': '..-TATA',. 'tags': ['..', '..', '...', '....'],. }. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\melonvod.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	4.690380981888605
Encrypted:	false
SSDEEP:	48:+u2N9b/nZd3HXndKG/I8ajXTBs0sABsGfVxqGBg2hBTPlJ7bYV9Fsn6tN0E8c26k:M7nZd3XndKG/I8aZpDdu2hBT3Kzs6tNa
MD5:	EDEFEC98EAFE85F3B289FAB42F4BCCD1
SHA1:	87085656078121B23D74572B17432CA000902D3C
SHA-256:	A8E4CE8F5DFA4C5AE6256A74B16BCE5918F8BDB10D575329C4C85C68A4DC3517
SHA-512:	B929EBB86A29384E248BC127DD10B674F7B8831A7F2881E7F2D793F144F0F056298C63616704362008D1A20E66540DF36E920FC0275135D4AECA26C16FE46EDB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. urljoin,.)...class MelonVODIE(InfoExtractor):. _VALID_URL = r'https?://vod\.melon\.com/video/detail2\.html?\?.?mvId=(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://vod.melon.com/video/detail2.htm?mvId=50158734',. 'info_dict': {. 'id': '50158734',. 'ext': 'mp4',. 'title': "Jessica 'Wonderland' MV Making Film",. 'thumbnail': r're:^https?://.\.jpg$',. 'artist': 'Jessica (...)',. 'upload_date': '20161212',. 'duration': 203,. },. 'params': {. 'skip_download': 'm3u8 download',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. play_info = self._download_json(. 'http://vod.melon.com/video/playerInfo.json', video_id,. note='Downloading player info JSON', query={'mvId': v

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\meta.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2623
Entropy (8bit):	4.618177012104108
Encrypted:	false
SSDEEP:	48:+unFfbgkHT5idlJAPXbXLUbBtfjXjlkLfBxhXrU/d9erpjUc/k3Tgllzh:ZfH9CJAPX8rfqLxwV9eNVcUllF
MD5:	A7F7996F776E30F002AC534C4E645FCD
SHA1:	BD9D2C6A53AD0C70CF22068C974B6C1BD3B0A42D
SHA-256:	FCC378AF6CB1ED4B18AC217AF091D5F8CA986022E870444B192BE2CD78716C68
SHA-512:	C97929BDD682224AEFDAC41430B4C09750983EFF1079442B4B0D8BE9CCC37A259981DB5645A571091B41A0F4F2200B646A718F90BB4E100412F8264660A22358
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .pladform import PladformIE.from ..utils import (. unescapeHTML,. int_or_none,. ExtractorError,.)...class METAIE(InfoExtractor):. _VALID_URL = r'https?://video\.meta\.ua/(?:iframe/)?(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://video.meta.ua/5502115.video',. 'md5': '71b6f3ee274bef16f1ab410f7f56b476',. 'info_dict': {. 'id': '5502115',. 'ext': 'mp4',. 'title': 'Sony Xperia Z camera test [HQ]',. 'description': 'Xperia Z shoots video in FullHD HDR.',. 'uploader_id': 'nomobile',. 'uploader': 'CH.ZA.TV',. 'upload_date': '20130211',. },. 'add_ie': ['Youtube'],. }, {. 'url': 'http://video.meta.ua/iframe/5502115',. 'only_matching': True,. }, {. # pladform embed. 'url': 'http://video.meta.ua/7121015.video',. 'only_matching': True,. }

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\metacafe.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11719
Entropy (8bit):	4.48191422826993
Encrypted:	false
SSDEEP:	192:IYvn8WSFDVgK9L/LAJo1PVNVnsIy/ynGVyRby6eP0LWej4pFN+EB4Du2dT86N4B:rf8PHgK9DLAJo1PVNVnsonVRby6eP0L4
MD5:	5981DDCF0EE83C4B81214D2BD7DB13C9
SHA1:	DEB79FB00BDE8CF3007486D598AF0EFF0CED1699
SHA-256:	845711926F002BF12B3150C706FE6EB46A864D759729E42F9228562ADAEA4544
SHA-512:	C4078B6D8DC5AA5143E27F6391A5DDEACB49832CC07E4B7A077D5B3EF7441ED2C9258DC0527B3B56D765B5716DFB5919E39E93A56E923326191A6B0AB7F187E1
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_parse,. compat_urllib_parse_unquote,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. get_element_by_attribute,. mimetype2ext,.)...class MetacafeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?metacafe\.com/watch/(?P<video_id>[^/]+)/(?P<display_id>[^/?#]+)'. _DISCLAIMER = 'http://www.metacafe.com/family_filter/'. _FILTER_POST = 'http://www.metacafe.com/f/index.php?inputType=filter&controllerGroup=user'. IE_NAME = 'metacafe'. _TESTS = [. # Youtube video. {. 'add_ie': ['Youtube'],. 'url': 'http://metacafe.com/watch/yt-_aUehQsCQtM/the_electric_company_short_i_pbs_kids_go/',. 'info_dict': {. 'id': '_aUehQsCQtM',. 'ext': 'mp4',. 'upload_date': '20090102',. 'title': 'T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\metacritic.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.625357670358476
Encrypted:	false
SSDEEP:	48:PuLWiDfxhbp2TEFJ3GxfCRvxjsVAfdfFkVkHlx98SllMGzmBTbX85T6NKQ5j:TirxhbQMJWxaRv5KAf/Fx98AaGzmBTQo
MD5:	40BED2673C5B2AB8BFDFEDB0654EE4E5
SHA1:	8C63430FE187C8C3B87F5FCE18BA74E60DFA8A1A
SHA-256:	042181DC05290F3806558A60359ABF925D52CB66EE3E56BEA67595BF0EB23986
SHA-512:	CFD8581DBE788B329E1AE03457B4BBF32A18A54DB1EBA8C490DA068FB5EA52EA384EE667418026A8D27571D9298B527D10244C9D80A76D025E517944A3FC7D13
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. fix_xml_ampersands,.)...class MetacriticIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?metacritic\.com/.+?/trailers/(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://www.metacritic.com/game/playstation-4/infamous-second-son/trailers/3698222',. 'info_dict': {. 'id': '3698222',. 'ext': 'mp4',. 'title': 'inFamous: Second Son - inSide Sucker Punch: Smoke & Mirrors',. 'description': 'Take a peak behind-the-scenes to see how Sucker Punch brings smoke into the universe of inFAMOUS Second Son on the PS4.',. 'duration': 221,. },. 'skip': 'Not providing trailers anymore',. }, {. 'url': 'http://www.metacritic.com/game/playstation-4/tales-from-the-borderlands-a-telltale-game-series/trailers/5740315',. 'info_dict': {. 'id': '5740315',. 'ext': 'mp4',. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mgoon.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	4.66385945172676
Encrypted:	false
SSDEEP:	48:+u1GehozEQd+Q72X3VDYQ8OQ1zXQ5LIMfRb8f/dfFk0UkoEjzzc3jYyVlEVoBT09:bhoz1ZCX3x/8OIzXQ5LIG66koEj08yVq
MD5:	8E68D6ECE390309E4FEAEEB9C30060A2
SHA1:	FF30CE88A46421DC14F49CD2DC0C8D75423AB91F
SHA-256:	C6BBCAC0964EF87C9EF5E0CA6B8154DEEF3C320F0995A62BFBA1391CA53E07A8
SHA-512:	BF2F0330D26B6F220874B2EBEEF8DE3CCD75B9E420401DF7D608B2F62E534E09EC4FB9B8D84A32CC3065B9967C26CEF38A6368C6EE33C107F9D1BDCE4E75BB66
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. qualities,. unified_strdate,.)...class MgoonIE(InfoExtractor):. _VALID_URL = r'''(?x)https?://(?:www\.)?. (?:(:?m\.)?mgoon\.com/(?:ch/(?:.+)/v\|play/view)\|. video\.mgoon\.com)/(?P<id>[0-9]+)'''. _API_URL = 'http://mpos.mgoon.com/player/video?id={0:}'. _TESTS = [. {. 'url': 'http://m.mgoon.com/ch/hi6618/v/5582148',. 'md5': 'dd46bb66ab35cf6d51cc812fd82da79d',. 'info_dict': {. 'id': '5582148',. 'uploader_id': 'hi6618',. 'duration': 240.419,. 'upload_date': '20131220',. 'ext': 'mp4',. 'title': 'md5:543aa4c27a4931d371c3f433e8cebebc',. 'thumbnail': r're:^https?://.*\.jpg$',. }. },. {. 'url': 'http://www.mgoon.com/play/view/5582148',. 'on

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mgtv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3375
Entropy (8bit):	4.666488474966102
Encrypted:	false
SSDEEP:	96:/2KF2zpYtXEKKfAOhzU54W9DuisRBT06N9BN1t:+KkpFK4AaUqW9DuJfT06Nd
MD5:	1D99DEEE421AD3923CDC89018CD4936F
SHA1:	F0CF0E0D43F5BC85F0A28D7F7400789204BC3FAB
SHA-256:	D0C3EF734D59AF78C5A3F161A11C8D07CA0F774B2AB92822D8919B8632CE69D6
SHA-512:	EB21989F4CADDDE7C07818454BE1B4922EB2288767B243A50ED6EBFB630AD2892AD4413972108DD61362A680B75C1307093C3FF8F1BACB3CB33B8A473AE80638
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import time.import uuid..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,.)...class MGTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mgtv\.com/(v\|b)/(?:[^/]+/)(?P<id>\d+)\.html'. IE_DESC = '..TV'. _GEO_COUNTRIES = ['CN'].. _TESTS = [{. 'url': 'http://www.mgtv.com/v/1/290525/f/3116640.html',. 'info_dict': {. 'id': '3116640',. 'ext': 'mp4',. 'title': '.... ...',. 'description': '............',. 'duration': 7461,. 'thumbnail': r're:^https?://.\.jpg$',. },. }, {. 'url': 'http://www.mgtv.com/b/301817/3826653.html',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). try:. api_dat

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\miaopai.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.365828798235554
Encrypted:	false
SSDEEP:	24:zi8lFvXDBG7wQdqz4B0/nzVdlHmzmgvVf+oDFvHeIXjl+tpZeX0oZeXkckcz6ylt:+uHOtSJj5g9LFvjXjlCHeXbZeXRf6SXB
MD5:	FA5E82CDAF0F66FB6C0102986C726616
SHA1:	499521BD23917E9B1A43CE8551ED8A7F8825CED1
SHA-256:	0DA08AE87A55C0A0A3490B24287564D351944D9DA576007E2243A06067D0F000
SHA-512:	AAC0D63C0ECB10809B3018140F6B8A12798D7D1BEE085527D6393330E6EE7410C7AE071539DAB177656AB53DB3C18964710CDAF40CFD27C98E9C5AB15F9513EB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class MiaoPaiIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?miaopai\.com/show/(?P<id>[-A-Za-z0-9~_]+)'. _TEST = {. 'url': 'http://www.miaopai.com/show/n~0hO7sfV1nBEw4Y29-Hqg__.htm',. 'md5': '095ed3f1cd96b821add957bdc29f845b',. 'info_dict': {. 'id': 'n~0hO7sfV1nBEw4Y29-Hqg__',. 'ext': 'mp4',. 'title': '...........',. 'thumbnail': 're:^https?://.*/n~0hO7sfV1nBEw4Y29-Hqg___m.jpg',. }. }.. _USER_AGENT_IPAD = 'Mozilla/5.0 (iPad; CPU OS 9_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13B143 Safari/601.1'.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. url, video_id, headers={'User-Agent': self._USER_AGENT_IPAD}).. title = self._html_search_regex(. r'<title>([^<]+

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\microsoftvirtualacademy.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7476
Entropy (8bit):	4.608336674283991
Encrypted:	false
SSDEEP:	192:sMBdgoVKzyJ/zjGSi5sVTBfVuTw6N2JxP7tWrQVKnMKlLh:JBKosWJnGSi5sVTbuTw6N2JxjtWrJFLh
MD5:	44B725F053C07947D5D39888398ED2A6
SHA1:	E411859EEDA266D4DD9986F0694D127B6BCBE257
SHA-256:	C3CD65860999E6B474A347434F44E20E991BD674F8CE066841740322CAB7939D
SHA-512:	D09A43C6258F17C582906F7049F1AAF4F08591F2616FBEAED24B96E7DFEB091067921BB10690371378F381EFC902CD3EEA26BF614F8271DA9A05E97835E6D35B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_xpath,.).from ..utils import (. int_or_none,. parse_duration,. smuggle_url,. unsmuggle_url,. xpath_text,.)...class MicrosoftVirtualAcademyBaseIE(InfoExtractor):. def _extract_base_url(self, course_id, display_id):. return self._download_json(. 'https://api-mlxprod.microsoft.com/services/products/anonymous/%s' % course_id,. display_id, 'Downloading course base URL').. def _extract_chapter_and_title(self, title):. if not title:. return None, None. m = re.search(r'(?P<chapter>\d+)\s\\|\s(?P<title>.+)', title). return (int(m.group('chapter')), m.group('title')) if m else (None, title)...class MicrosoftVirtualAcademyIE(MicrosoftVirtualAcademyBaseIE):. IE_NAME = 'mva'. IE_DESC = 'Microsoft Virtual Academy videos'. _VALID_URL = r'(?:%s:\|https?://(?:mva\.microsoft\|(?:www\.)?microsoftvi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\minhateca.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2467
Entropy (8bit):	4.72493443514785
Encrypted:	false
SSDEEP:	48:+uodzpvYL/iXW1DajXjlksXk9Dq2JJB2onX4GkXTnZK/F7k5S8cbvf:cQLaXiDaqBD5Jmoo/jZKN7k88S3
MD5:	0065B9EBBCBB5419EB96C8B8B331289B
SHA1:	729286F7EF36D28247A458F9274FF0111956ECAB
SHA-256:	B1C02403D5ABABDDA0D20287AEC37AC30997FC6422B8EE2F56B67AE69BB2B8FF
SHA-512:	5224EC78CF59346E8F166F69D4419D6BB81DCD766F089E1D73F65409839AC8C5A0D7D87E26769E99016016199029CD2016C2234D6A660709804500D291EC1BAF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. parse_filesize,. sanitized_Request,. urlencode_postdata,.)...class MinhatecaIE(InfoExtractor):. _VALID_URL = r'https?://minhateca\.com\.br/[^?#]+,(?P<id>[0-9]+)\.'. _TEST = {. 'url': 'http://minhateca.com.br/pereba/misc/youtube-dl+test+video,125848331.mp4(video)',. 'info_dict': {. 'id': '125848331',. 'ext': 'mp4',. 'title': 'youtube-dl test video',. 'thumbnail': r're:^https?://.\.jpg$',. 'filesize_approx': 1530000,. 'duration': 9,. 'view_count': int,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. token = self._html_search_regex(. r'<input name="__RequestVerificationToken".?value="([^"]+)"',. webpage, 're

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ministrygrid.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	4.78814282128818
Encrypted:	false
SSDEEP:	48:PuqKxv6kjajNyXdrD1PT3jXhkGwJ64BLWq0zgnZxYBqzIz:PKVTajNyXdrJT3aX6lJqNy
MD5:	310C8F7D67EE33E536CB0AAEBFE9537D
SHA1:	969CC7B8A83A4B343DAFD34C5A47EBA736D640F5
SHA-256:	49B3C7CC7B345FCEFD59CCA8E3D3173EAEE79B63305049100EFEC0B266A7F134
SHA-512:	279A761C5604B768C76FCE35862AFC2DA51A0C951E4CBE70D068E26032CDC7A0458B2DB505F4920C76B8308B92DCEC2AB2BB546B0A9A35D8F38E2A351C4A3BEF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. smuggle_url,.)...class MinistryGridIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ministrygrid\.com/([^/?#]/)(?P<id>[^/#?]+)/?(?:$\|[?#])'.. _TEST = {. 'url': 'http://www.ministrygrid.com/training-viewer/-/training/t4g-2014-conference/the-gospel-by-numbers-4/the-gospel-by-numbers',. 'md5': '844be0d2a1340422759c2a9101bab017',. 'info_dict': {. 'id': '3453494717001',. 'ext': 'mp4',. 'title': 'The Gospel by Numbers',. 'thumbnail': r're:^https?://.*\.jpg',. 'upload_date': '20140410',. 'description': 'Coming soon from T4G 2014!',. 'uploader_id': '2034960640001',. 'timestamp': 1397145591,. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'add_ie': ['TDSLifeway'],. }.. def _real_extract

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\minoto.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1927
Entropy (8bit):	4.444792237670257
Encrypted:	false
SSDEEP:	48:+u3CdEdfFwFZK8sjKmtXqDMBNAm9U2BTVobjxpEA6Ng:DCdEA4jKmtXBNAmDBTVobjxpEA6Ng
MD5:	899C1B3ABE008862A62FC36512AEA0C4
SHA1:	DAE2EA1C4FA30B180D0CF229414B132C2D45B5E0
SHA-256:	6A36CC3328C1DDEE9C9E24244A07321C163E3BA49E6ED478723976DE2578A4C3
SHA-512:	B7ACA2917A865865C812AE3A468E42AD26B8E11F049A0FA16480664F4AAF999AAAA0CC091E2D7EE490F6B608F3A62E783FEDAA29DF870AA154A5FA33B92D1096
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_codecs,.)...class MinotoIE(InfoExtractor):. _VALID_URL = r'(?:minoto:\|https?://(?:play\|iframe\|embed)\.minoto-video\.com/(?P<player_id>[0-9]+)/)(?P<id>[a-zA-Z0-9]+)'.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). player_id = mobj.group('player_id') or '1'. video_id = mobj.group('id'). video_data = self._download_json('http://play.minoto-video.com/%s/%s.js' % (player_id, video_id), video_id). video_metadata = video_data['video-metadata']. formats = []. for fmt in video_data['video-files']:. fmt_url = fmt.get('url'). if not fmt_url:. continue. container = fmt.get('container'). if container == 'hls':. formats.extend(fmt_url, video_id, 'mp4', m3u8_id='hls', fatal=False). else:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\miomio.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5068
Entropy (8bit):	4.8684127985839565
Encrypted:	false
SSDEEP:	96:7t9MgXu08ILzoIQuR/va84l0S3G7zgPGRtukyS/aZ0dGY4KtdUyXysNsPW:B0c2CddSgzgPiEkyCGY5MyXDNsO
MD5:	617430C19AC774C425585C3A1B90A486
SHA1:	7B001C5C80AF9BE558AAE1474198B0E480215EA6
SHA-256:	6871864C1C605DF9BB147FFD45D642DA035E2CD86406B145F9C4810A49C98E3E
SHA-512:	D2C8E272584426449DB4B57E2ED5A01A6B216B2850C07A041B5E0F9DB610998FD47A21C30D3D153A6BC1C814069C393D04EC7F1803B9BCE5A6EB8082E097330C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. xpath_text,. int_or_none,. ExtractorError,. sanitized_Request,.)...class MioMioIE(InfoExtractor):. IE_NAME = 'miomio.tv'. _VALID_URL = r'https?://(?:www\.)?miomio\.tv/watch/cc(?P<id>[0-9]+)'. _TESTS = [{. # "type=video" in flashvars. 'url': 'http://www.miomio.tv/watch/cc88912/',. 'info_dict': {. 'id': '88912',. 'ext': 'flv',. 'title': '.SKY... ....VS.. ......FEAT.. ..... ..',. 'duration': 5923,. },. 'skip': 'Unable to load videos',. }, {. 'url': 'http://www.miomio.tv/watch/cc184024/',. 'info_dict': {. 'id': '43729',. 'title': '..........',. },. 'playlist_mincount': 86,. 'skip': 'Unable to load vid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mit.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6025
Entropy (8bit):	4.727139228911961
Encrypted:	false
SSDEEP:	96:/V0t4CpKdIOuovERYHMZn8qZY6NFtpsbTMcpJd0NQyxHro5xFnOCvYqSEy6R3CDO:t0iwK0ocRYHMZn8B6NqHN0hxHc5jOCw0
MD5:	6473544E9C6215C64B4345168075240C
SHA1:	B753F4DBC5CF9604848C7BC5DE1FF428707F7B97
SHA-256:	6B0ED363F6993EF9F0A70B569A9A0E4B6706C6C77780B1B62F39047F0008A480
SHA-512:	C0575C4147FA78B959D6814CD83A5FC791AE688F09C18569BD6518B87848A394DC5F0263B1E9A3BC3F3893C43B65D095170891153E8ADEA97B6AAABDA221F7BD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re.import json..from .common import InfoExtractor.from .youtube import YoutubeIE.from ..utils import (. clean_html,. ExtractorError,. get_element_by_id,.)...class TechTVMITIE(InfoExtractor):. IE_NAME = 'techtv.mit.edu'. _VALID_URL = r'https?://techtv\.mit\.edu/(?:videos\|embeds)/(?P<id>\d+)'.. _TEST = {. 'url': 'http://techtv.mit.edu/videos/25418-mit-dna-learning-center-set',. 'md5': '00a3a27ee20d44bcaa0933ccec4a2cf7',. 'info_dict': {. 'id': '25418',. 'ext': 'mp4',. 'title': 'MIT DNA and Protein Sets',. 'description': 'md5:46f5c69ce434f0a97e7c628cc142802d',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). raw_page = self._download_webpage(. 'http://techtv.mit.edu/videos/%s' % video_id, video_id). clean_page = re.compile(r' .*?-->', re.S).sub('', raw_page).. base_url = self._proto_r

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mitele.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4444
Entropy (8bit):	4.682099036312254
Encrypted:	false
SSDEEP:	96:W8GjbJqLgj0FvsLCEgj5NFgfxBc3YybFvIy2NwEFjRp8a3Bk:KVqDFkLUF2+YyzEWSk
MD5:	9C3C743673D317F1A34D670760EA873A
SHA1:	E9F3D76129AB7FA1F6C109F7A4CC79AAE2C29EE9
SHA-256:	615DE94DE170D35F2AD485DA2BFCF62D63C08BD28BD8E40FEF3BB9C8FD5CA796
SHA-512:	FCAB26206ADB8FA2CA6ED38B761909B5A2353BFF0AC5B13C736E6730D0A20595358D500416C5F0F901E98418973C2EE08A21ED14DC0D0C2E4D5DDDD5346BB453
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. smuggle_url,. parse_duration,.)...class MiTeleIE(InfoExtractor):. IE_DESC = 'mitele.es'. _VALID_URL = r'https?://(?:www\.)?mitele\.es/(?:[^/]+/)+(?P<id>[^/]+)/player'.. _TESTS = [{. 'url': 'http://www.mitele.es/programas-tv/diario-de/57b0dfb9c715da65618b4afa/player',. 'info_dict': {. 'id': 'FhYW1iNTE6J6H7NkQRIEzfne6t2quqPg',. 'ext': 'mp4',. 'title': 'Tor, la web invisible',. 'description': 'md5:3b6fce7eaa41b2d97358726378d9369f',. 'series': 'Diario de',. 'season': 'La redacci.n',. 'season_number': 14,. 'season_id': 'diario_de_t14_11981',. 'episode': 'Programa 144',. 'episode_number': 3,. 'thumbnail': r're:(?i)^https?://.*\.jpg$',. 'duration': 2913,. },. 'add_ie': ['Ooyala'],. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mixcloud.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11343
Entropy (8bit):	4.681751372273376
Encrypted:	false
SSDEEP:	192:BHC9pGwEoy3E//yavl1ABe0cvRYRYOOrKuorvsST17i3/6N+9WRqiUaNVlOF5F6N:gfG15kOO/orsSTgP6NrlOF5F6fobR1I
MD5:	F9798D3F040CA8E39952EC3F961C306C
SHA1:	E713CDE0AEB5F966632078AB6622882969B5FA3A
SHA-256:	16A44F3B950CDF104A3F97F341C3C2B597158E1306F473B734821A79107498AC
SHA-512:	DB84D742186589B574F2C157CE5D5B6F50448E7635A08BBAAC86EC833489D4A2AC70961FE9936943878892E56719B91FF66EC08DBF48C801C74E5A5C2EE4A415
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_chr,. compat_ord,. compat_str,. compat_urllib_parse_unquote,. compat_zip.).from ..utils import (. int_or_none,. parse_iso8601,. strip_or_none,. try_get,.)...class MixcloudBaseIE(InfoExtractor):. def _call_api(self, object_type, object_fields, display_id, username, slug=None):. lookup_key = object_type + 'Lookup'. return self._download_json(. 'https://www.mixcloud.com/graphql', display_id, query={. 'query': '''{. %s(lookup: {username: "%s"%s}) {. %s. }.}''' % (lookup_key, username, ', slug: "%s"' % slug if slug else '', object_fields). })['data'][lookup_key]...class MixcloudIE(MixcloudBaseIE):. _VALID_URL = r'https?://(?:(?:www\|beta\|m)\.)?mixcloud\.com/([^/]+)/(?!stream\|uploads\|favorites\|listens\|playlists)([^/]+)'. IE_NAME = 'mixcloud'.. _T

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mlb.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5015
Entropy (8bit):	4.503825134221013
Encrypted:	false
SSDEEP:	96:v6IXhNlALTX+buhEWdoRX+2a+5A2lX+iPzqplX+kl5Pie5EQxC2wfEfAuwrd5ki:i0gCb/W52N5UAmywPv5zxC2wfEflAjki
MD5:	F0ADCEDC89ACCCCE64D59E7420DBFB1B
SHA1:	551C7120A40B413DAA43CD59C9FE8B2DE9668D34
SHA-256:	ACACFC2BF9C3EF3FD9EFF11D7BBEB15678FD757FCA363739BD5C2DD6F908BE33
SHA-512:	90E993F8A77954CB36BEDAE1461286B5733ED31A633D48257EA1384DA4EDD625BBEB83C3BC51F7F1604A85DC31E75A7170B943E5B3C27C0E55121A9076BB10DA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .nhl import NHLBaseIE...class MLBIE(NHLBaseIE):. _VALID_URL = r'''(?x). https?://. (?:[\da-z_-]+\.)(?P<site>mlb)\.com/. (?:. (?:. (?:[^/]+/)c-\|. (?:. shared/video/embed/(?:embed\|m-internal-embed)\.html\|. (?:[^/]+/)+(?:play\|index)\.jsp\|. )\?.*?\bcontent_id=. ). (?P<id>\d+). ). '''. _CONTENT_DOMAIN = 'content.mlb.com'. _TESTS = [. {. 'url': 'https://www.mlb.com/mariners/video/ackleys-spectacular-catch/c-34698933',. 'md5': '632358dacfceec06bad823b83d21df2d',. 'info_dict': {. 'id': '34698933',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mnet.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	4.660811505958183
Encrypted:	false
SSDEEP:	48:+uovxlSfPCyDF8XuR12iXlgtfjXi8O1BdXZ7PBWECrqrlqcBTg0oKfQ//DSU0DtU:mlMPjDF8XuqSsfuFLCSl/BTgvKoTytKD
MD5:	4F4407D623EA56CA22D46A3ADAA2F696
SHA1:	BC584D045F2B645DCD21BB0A4427DCC9687BE07E
SHA-256:	6A3D3CC16D0AF299841276E6DF6028698FFA7EEBB316A1E14CA0E39EE8DB7CAE
SHA-512:	183DC42FFB50EDFCE35B19E67BFD2024140F59730403A451B134B7F77CAD62CA09751B7CF5E487080FD42126E513129B6FB828E92AA6330C129817BE72B36949
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,. parse_iso8601,.)...class MnetIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mnet\.(?:com\|interest\.me)/tv/vod/(?:.?\bclip_id=)?(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.mnet.com/tv/vod/171008',. 'info_dict': {. 'id': '171008',. 'title': 'SS_...@....',. 'description': 'md5:b9efa592c3918b615ba69fe9f8a05c55',. 'duration': 88,. 'upload_date': '20151231',. 'timestamp': 1451564040,. 'age_limit': 0,. 'thumbnails': 'mincount:5',. 'thumbnail': r're:^https?://.\.jpg$',. 'ext': 'flv',. },. 'params': {. # rtmp download. 'skip_download': True,. },. }, {. 'url': 'http://mnet.interest.me/tv/vod/172790',. 'only_matching': True,. },

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\moevideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2835
Entropy (8bit):	4.770174794089422
Encrypted:	false
SSDEEP:	48:+uTMTOb7Ogbt8geHnXqVnnM+X80FNrQFeQX9xl7M+JHElfFIjimn4VSRiY4wSyo5:0TpgdCnXABXHFNrQFdXPldJHEFCyYyyS
MD5:	B50292F913DBFF8BDE949BDAFA1B81F3
SHA1:	37FA4F072D8A85F2776C4EAA4A970E6552412CE4
SHA-256:	6E9B9C5A44DA3D35678FC87DAF0298AA910C1057F94AAAF6146E77E3A0F4882E
SHA-512:	47FA791BADCEA7BD3E0E932EFA56506104A7E81FB9CA707CB9C08DECFA0C6328420BD29406E85AD573A4AA2E836D75ED43C5DE6893656D5E2865CB6F41B14FA8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,.)...class MoeVideoIE(InfoExtractor):. IE_DESC = 'LetitBit video services: moevideo.net, playreplay.net and videochart.net'. _VALID_URL = r'''(?x). https?://(?P<host>(?:www\.)?. (?:(?:moevideo\|playreplay\|videochart)\.net\|thesame\.tv))/. (?:video\|framevideo\|embed)/(?P<id>[0-9a-z]+\.[0-9A-Za-z]+)'''. _API_URL = 'http://api.letitbit.net/'. _API_KEY = 'tVL0gjqo5'. _TESTS = [. {. 'url': 'http://moevideo.net/video/00297.0036103fe3d513ef27915216fd29',. 'md5': '129f5ae1f6585d0e9bb4f38e774ffb3a',. 'info_dict': {. 'id': '00297.0036103fe3d513ef27915216fd29',. 'ext': 'flv',. 'title': 'Sink cut out machine',. 'description': 'md5:f29ff97b663aefa760bf7ca63c8ca8a8',. 'thumbnail': r're:^https?://.*\.j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mofosex.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2020
Entropy (8bit):	4.87001094018862
Encrypted:	false
SSDEEP:	48:PupXCfF67YXeXB99lGXEF40tfVpGWZnr28n4zjlDTly80svw:wX8G6eXB9nG0CKfyvb1DxF0sY
MD5:	0E156C3E7E7EF83B2FBB79BF1134295C
SHA1:	CA6BDED4C3631CCCD60B0D90164C88B38CB39F52
SHA-256:	95C55929668DC8EA860F97EA331CBACEE0890A36CB4E6DB4FA2222BCA89DBFAF
SHA-512:	50E667F37906DD13402717B2D00EA66AC7BB9D5FFF8FADADD01D008435B6ABCE5BD6E78E4CBFD27A21041391F14E8B4538CBDE565293534627566BAF64EBC70F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from ..utils import (. int_or_none,. str_to_int,. unified_strdate,.).from .keezmovies import KeezMoviesIE...class MofosexIE(KeezMoviesIE):. _VALID_URL = r'https?://(?:www\.)?mofosex\.com/videos/(?P<id>\d+)/(?P<display_id>[^/?#&.]+)\.html'. _TESTS = [{. 'url': 'http://www.mofosex.com/videos/318131/amateur-teen-playing-and-masturbating-318131.html',. 'md5': '558fcdafbb63a87c019218d6e49daf8a',. 'info_dict': {. 'id': '318131',. 'display_id': 'amateur-teen-playing-and-masturbating-318131',. 'ext': 'mp4',. 'title': 'amateur teen playing and masturbating',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20121114',. 'view_count': int,. 'like_count': int,. 'dislike_count': int,. 'age_limit': 18,. }. }, {. # This video is no longer available. 'url': 'http://www.mofosex.com/videos

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mojvideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2094
Entropy (8bit):	4.888059172215429
Encrypted:	false
SSDEEP:	48:+u6SDWx1FsL1qryNjMadfFkZVSpoDEkXejXVXpeXCKga6Pt/8ci:RDiAL6yNjMaGIHZjVKx6Pt/8B
MD5:	AB4FBBBB34F07F4139D2D47A2F147D56
SHA1:	C280A28B9F165EE92961361CF6C6F4E529A1E9CF
SHA-256:	346BFBD05B20EE93C5F8A2B1E4AE257DA875B86467B6FD267CE0C8E55A715901
SHA-512:	46E80B6E71361FFD783199327F8D6766F569D6DA8DC7EE3874A10395523BA216018809BE2CCFB56661B8251ECCE50C46B715146A2AB2838A64C519DAF596E24C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. parse_duration,.)...class MojvideoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mojvideo\.com/video-(?P<display_id>[^/]+)/(?P<id>[a-f0-9]+)'. _TEST = {. 'url': 'http://www.mojvideo.com/video-v-avtu-pred-mano-rdecelaska-alfi-nipic/3d1ed4497707730b2906',. 'md5': 'f7fd662cc8ce2be107b0d4f2c0483ae7',. 'info_dict': {. 'id': '3d1ed4497707730b2906',. 'display_id': 'v-avtu-pred-mano-rdecelaska-alfi-nipic',. 'ext': 'mp4',. 'title': 'V avtu pred mano rde.elaska - Alfi Nipi.',. 'thumbnail': r're:^http://.*\.jpg$',. 'duration': 242,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). display_id = mobj.group('display_id').. # XML is malformed. playerap

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\morningstar.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1862
Entropy (8bit):	4.911064433547342
Encrypted:	false
SSDEEP:	48:+uTxKNo3fg4OPZjib29XKvOctfdfFklkbXVfXt0leXWAXRUQjtOb:3xEQgRRjy29XKvOSftZl0lzHQjtk
MD5:	4F80D2438B99B19D1745DCB9C3078945
SHA1:	0B4BCE963326F943854549EE4C741E19DF81F6BF
SHA-256:	125BBEF8284DF14E3A524FE2A0D019CE6D9E80AC9A8E15539BA8FE7507EF0DF2
SHA-512:	FB38F86189FA6B8340BBB751DECD4CBFA1891E394E0F4269B19C201B3AB7A8E14BF4F363B75F2EB4A47ED4A727A2387A7246347856E8FA190462A6233D7D2E02
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class MorningstarIE(InfoExtractor):. IE_DESC = 'morningstar.com'. _VALID_URL = r'https?://(?:(?:www\|news)\.)morningstar\.com/[cC]over/video[cC]enter\.aspx\?id=(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.morningstar.com/cover/videocenter.aspx?id=615869',. 'md5': '6c0acface7a787aadc8391e4bbf7b0f5',. 'info_dict': {. 'id': '615869',. 'ext': 'mp4',. 'title': 'Get Ahead of the Curve on 2013 Taxes',. 'description': "Vanguard's Joel Dickson on managing higher tax rates for high-income earners and fund capital-gain distributions in 2013.",. 'thumbnail': r're:^https?://.*m(?:orning)?star\.com/.+thumb\.jpg$'. }. }, {. 'url': 'http://news.morningstar.com/cover/videocenter.aspx?id=825556',. 'only_matching': True,. }].. def _real_extract(self, url):. mobj = re.match(self._

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\motherless.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7867
Entropy (8bit):	4.6920686457191225
Encrypted:	false
SSDEEP:	192:ATMoe4vY75BLRuFIvB3IqNqdKbk4Ug+b4TU:ATMoeEY9BLRuFgrNqdKMg4
MD5:	80423BAC321E04B2FEB9910702BFFEC3
SHA1:	78EA9C115A6572C37383EF9E4539938030A5AB3B
SHA-256:	FF4B20D55ACDCDAF53FE0C3FBC9C29DCC99440C9C987B54F3997E909A887EACB
SHA-512:	92A23514C50B63D535959BC4A47662574DD6EB0BEBDAC7C2928748326EF7217AA58B25CA1154D88E33869CB32D98A60D0D8A87E2EDF6F09242E7B8BF954F9767
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import datetime.import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. ExtractorError,. InAdvancePagedList,. orderedSet,. str_to_int,. unified_strdate,.)...class MotherlessIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?motherless\.com/(?:g/[a-z0-9_]+/)?(?P<id>[A-Z0-9]+)'. _TESTS = [{. 'url': 'http://motherless.com/AC3FFE1',. 'md5': '310f62e325a9fafe64f68c0bccb6e75f',. 'info_dict': {. 'id': 'AC3FFE1',. 'ext': 'mp4',. 'title': 'Fucked in the ass while playing PS3',. 'categories': ['Gaming', 'anal', 'reluctant', 'rough', 'Wife'],. 'upload_date': '20100913',. 'uploader_id': 'famouslyfuckedup',. 'thumbnail': r're:http://.*\.jpg',. 'age_limit': 18,. }. }, {. 'url': 'http://motherless.com/532291B',. 'md5': 'bc59a6b47d1f958e61fbd38a4d31b131',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\motorsport.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1804
Entropy (8bit):	4.876544125779296
Encrypted:	false
SSDEEP:	48:+uuNKtg+h5s2KfYmlpyqAvKNfJoXjlhbXU5BwXL+EU:yNKtgwG/ffoqAvK5Jsf7+EU
MD5:	770887E4DA030BC98945A533362DA9BB
SHA1:	194897261E9BB5D79CD9979DAA904C3E06982C80
SHA-256:	E40D09CAB6DCD3143F17A423BA14DD73CC8B2BF4546F9C65D724969D1F4AE1CA
SHA-512:	482730B352030D130CC5C35D658D879EDFB9E944431C07121F8E1EF902581865679750F788A8941F31470D0244E6FBE682E9437E3CB13E4CF0C4A5C05329222B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urlparse,.)...class MotorsportIE(InfoExtractor):. IE_DESC = 'motorsport.com'. _VALID_URL = r'https?://(?:www\.)?motorsport\.com/[^/?#]+/video/(?:[^/?#]+/)(?P<id>[^/]+)/?(?:$\|[?#])'. _TEST = {. 'url': 'http://www.motorsport.com/f1/video/main-gallery/red-bull-racing-2014-rules-explained/',. 'info_dict': {. 'id': '2-T3WuR-KMM',. 'ext': 'mp4',. 'title': 'Red Bull Racing: 2014 Rules Explained',. 'duration': 208,. 'description': 'A new clip from Red Bull sees Daniel Ricciardo and Sebastian Vettel explain the 2014 Formula One regulations . which are arguably the most complex the sport has ever seen.',. 'uploader': 'mcomstaff',. 'uploader_id': 'UC334JIYKkVnyFoNCclfZtHQ',. 'upload_date': '20140903',. 'thumbnail': r're:^https?://.+\.jpg$'. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\movieclips.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1891
Entropy (8bit):	4.9013141582441175
Encrypted:	false
SSDEEP:	48:+uKDRcYJtnVdWlxXVFW1BjXjlkM37a20k0lckPV5NSvxiDxDi:GlcYJtnvWlxXVFW1BqK7erNKite
MD5:	99307663E0AE2DEAF87E7FA132ABF18A
SHA1:	DF5FC98AEA555F7FB89040649D2A64EE8C377D38
SHA-256:	EE145B05E90A80B648DA6B0929C0E5260CCFD2D10A056995BC169F7F5B2DC67C
SHA-512:	F979C6908B4CDA5CDB5049E6967FE4CA905009FC280DF918A18F898209F8BA382B8B59E3AF111BC040468C8F64A27F8DF9FA5054A560142270C15031D1FB2B5F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. smuggle_url,. float_or_none,. parse_iso8601,. update_url_query,.)...class MovieClipsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?movieclips\.com/videos/.+-(?P<id>\d+)(?:\?\|$)'. _TEST = {. 'url': 'http://www.movieclips.com/videos/warcraft-trailer-1-561180739597',. 'md5': '42b5a0352d4933a7bd54f2104f481244',. 'info_dict': {. 'id': 'pKIGmG83AqD9',. 'ext': 'mp4',. 'title': 'Warcraft Trailer 1',. 'description': 'Watch Trailer 1 from Warcraft (2016). Legendary.s WARCRAFT is a 3D epic adventure of world-colliding conflict based.',. 'thumbnail': r're:^https?://.*\.jpg$',. 'timestamp': 1446843055,. 'upload_date': '20151106',. 'uploader': 'Movieclips',. },. 'add_ie': ['ThePlatform'],. }.. def _real_extract(self, url):. vid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\moviezine.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	4.814613342416339
Encrypted:	false
SSDEEP:	24:zi8lzvRGOw5w/pdl0lMyOZHdfFs1lgtzitYVd4aBxsioBrHdbTllPMvjP5mTe6K0:+uFPwwpIl6ZHdfFklkzVr4aPsJBrHBTJ
MD5:	4379A3953F0BECC16383D89D8493F507
SHA1:	387ABE35D0DC28D2C0CC027F5473571B728568F5
SHA-256:	C651D149F26437668A7145944EC7A1014F4FE186311D28DF71317C189FD8C205
SHA-512:	A1710F5140B9641F75626B54704433637592FDBE2C18F06A61CC210633E637A8810B468BF69BCCD434AD2A5D0C3D61800D6543BFAF6A8D375D276CAB8911AEAC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class MoviezineIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?moviezine\.se/video/(?P<id>[^?#]+)'.. _TEST = {. 'url': 'http://www.moviezine.se/video/205866',. 'info_dict': {. 'id': '205866',. 'ext': 'mp4',. 'title': 'Oculus - Trailer 1',. 'description': 'md5:40cc6790fc81d931850ca9249b40e8a4',. 'thumbnail': r're:http://.*\.jpg',. },. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id').. webpage = self._download_webpage(url, video_id). jsplayer = self._download_webpage('http://www.moviezine.se/api/player.js?video=%s' % video_id, video_id, 'Downloading js api player').. formats = [{. 'format_id': 'sd',. 'url': self._html_search_regex(r'file: "(.+?)",', jsplayer, 'file'),. 'qual

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\movingimage.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1774
Entropy (8bit):	4.852101556807145
Encrypted:	false
SSDEEP:	48:Puh0yzbs+jfmXVjXhkiqGHiZDkQh5C2vllbeB4RXP6NeQ8cjtc:kzbs8fmXVaidCpJ3CSllbBNP6NH8atc
MD5:	FD92C0DE5547E29A80BDBA9DE7302010
SHA1:	723A7734B116955E1B088F68283138282F8409AB
SHA-256:	40AF44979A6F38D56CBCC4C9F2A2794B004A9A5CFF1143235A2FE25D98589516
SHA-512:	D751F990E1FEE061676865A8E193963B2589C699A74FD1CC653066F0876DEA45173C3BC14CFF81AF7194CFACCA70F286EA180204FD4C9C870583F9A37D644943
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. unescapeHTML,. parse_duration,.)...class MovingImageIE(InfoExtractor):. _VALID_URL = r'https?://movingimage\.nls\.uk/film/(?P<id>\d+)'. _TEST = {. 'url': 'http://movingimage.nls.uk/film/3561',. 'md5': '4caa05c2b38453e6f862197571a7be2f',. 'info_dict': {. 'id': '3561',. 'ext': 'mp4',. 'title': 'SHETLAND WOOL',. 'description': 'md5:c5afca6871ad59b4271e7704fe50ab04',. 'duration': 900,. 'thumbnail': r're:^https?://.\.jpg$',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. formats = self._extract_m3u8_formats(. self._html_search_regex(r'file\s:\s*"([^"]+)"', webpage, 'm3u8 manifest URL'),. video_id, ext='mp4', entry_protocol='m3u8_native').. def search_field(fie

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\msn.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4628
Entropy (8bit):	4.717624433140512
Encrypted:	false
SSDEEP:	96:rOcxsjJjqpCbrwzvbTqy8LF75vfKeIQeJkJ02xPdr3zmjsl2oBTmOj5Wxiz3ZXTF:acQJjmiwbHqy8LF7hKFtePdr3zAsl2or
MD5:	760816652C5CFEFC9EFE2E3499680862
SHA1:	38AF8205B92138F1E758746A4835A02438C82CDE
SHA-256:	0A0C4E9067B7CFA36A38ADCD9A92BEA61FFF1E03EA2BF834B5A03C841A52C456
SHA-512:	FE523D60D79F44DCE06197BFF68846F70921441567CDC88420B77B8E8F0FCCE4EB8393718C0F01330C8919D9D4EED4196F9260248DF793FF6CB78A2CDD2C25C6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. unescapeHTML,.)...class MSNIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?msn\.com/(?:[^/]+/)+(?P<display_id>[^/]+)/[a-z]{2}-(?P<id>[\da-zA-Z]+)'. _TESTS = [{. 'url': 'http://www.msn.com/en-ae/foodanddrink/joinourtable/criminal-minds-shemar-moore-shares-a-touching-goodbye-message/vp-BBqQYNE',. 'md5': '8442f66c116cbab1ff7098f986983458',. 'info_dict': {. 'id': 'BBqQYNE',. 'display_id': 'criminal-minds-shemar-moore-shares-a-touching-goodbye-message',. 'ext': 'mp4',. 'title': 'Criminal Minds - Shemar Moore Shares A Touching Goodbye Message',. 'description': 'md5:e8e89b897b222eb33a6b5067a8f1bc25',. 'duration': 104,. 'uploader': 'CBS Entertainment',. 'uploader

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mtv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18984
Entropy (8bit):	4.740260857191167
Encrypted:	false
SSDEEP:	384:esfKm735EX9EOLPlRTsbCV9CzjTI6NL8RrXlyX07Fxe59/Q7j7clEaQO2dxOw8T7:esfKm35EX9EOLPlRTsbCV9CzjTI8L8Rm
MD5:	5698F064F22BB90BD74E5C1426E3B97E
SHA1:	994A8F438698EB8E3DC980E9951372F72B389DAB
SHA-256:	5FBF52BC555553D0958BA4C7E6B628931689F2FB5B78A956D5959CBE43F39AA9
SHA-512:	420EF080680639597DFC3AA40C2D58EE57A8AA65D8D3C8BBAEDB954E30C546B8C51C2D4F30DAD80E21259F7509012F151A3C4FF60BF665BC51919015284E6D6C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_xpath,.).from ..utils import (. ExtractorError,. find_xpath_attr,. fix_xml_ampersands,. float_or_none,. HEADRequest,. RegexNotFoundError,. sanitized_Request,. strip_or_none,. timeconvert,. try_get,. unescapeHTML,. update_url_query,. url_basename,. xpath_text,.)...def _media_xml_tag(tag):. return '{http://search.yahoo.com/mrss/}%s' % tag...class MTVServicesInfoExtractor(InfoExtractor):. _MOBILE_TEMPLATE = None. _LANG = None.. @staticmethod. def _id_from_uri(uri):. return uri.split(':')[-1].. @staticmethod. def _remove_template_parameter(url):. # Remove the templates, like &device={device}. return re.sub(r'&[^=]?={.?}(?=(&\|$))', '', url).. def _get_feed_url(self, uri):. return self._FEED_URL.. def _get_thumbnail_url(self, uri, itemdoc):. search_path

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\muenchentv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	4.455459272137363
Encrypted:	false
SSDEEP:	48:+uoWODyZS40fRLyNbX3NqaJ8hr1+Bn95EpYHKc1nxPjNBT+6NYbtc:HODyZS40fRLgX3saJiO95EIKc1nxPZBH
MD5:	8723F038F3AEAFA1789CA36513A31378
SHA1:	1E0BE257D85F92D77DD73EC31769AD6913B0AF07
SHA-256:	46B3173E761200C0386F0B65C7C14615C8F4FD639AB0289BA36B6071F664029C
SHA-512:	62CF4E19C4E1850921D9DBF2B6670C0B3C76433DE425979F4A8A3BB5C6EFFF1157A6944847C23EFCF499EC56CE0E866DD4F1BC02559757713060E34ACD014F60
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. js_to_json,.)...class MuenchenTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?muenchen\.tv/livestream'. IE_DESC = 'm.nchen.tv'. _TEST = {. 'url': 'http://www.muenchen.tv/livestream/',. 'info_dict': {. 'id': '5334',. 'display_id': 'live',. 'ext': 'mp4',. 'title': 're:^m.nchen.tv-Livestream [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'is_live': True,. 'thumbnail': r're:^https?://.\.jpg$'. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. display_id = 'live'. webpage = self._download_webpage(url, display_id).. title = self._live_title(self._og_search_title(webpage)).. data_js = self._search_regex(. r'(?s)\nplaylist:\s

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\musicplayon.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2310
Entropy (8bit):	4.850053854109523
Encrypted:	false
SSDEEP:	48:+uf7oflwGvdT7dWflwG6tTKwGnjXjZukdV5VEeVxJJKaVTtXpcuX7VZa6AtNfA6u:nKWedT7dWfWpje7oOJKqf7gtNfA6Ng
MD5:	451B818EF5563F000B5E77340986170F
SHA1:	F88A7D41D21F5DF9A92C000529C8A3ECDD5BB7F7
SHA-256:	3359D8759CD15E0A4A3D5CB695402236BA06A341953833FC456EE9B685364E96
SHA-512:	D9E791C0549810C5E6C36555975A0304063A39D7925B1E9FFDBF9736875ECF0B2278FF100A2A5D4E204B24010799C2DEE62223C8F573C9F15650C5C5F1989E8F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. js_to_json,. mimetype2ext,.)...class MusicPlayOnIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?musicplayon\.com/play(?:-touch)?\?(?:v\|pl=\d+&play)=(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://en.musicplayon.com/play?v=433377',. 'md5': '00cdcdea1726abdf500d1e7fd6dd59bb',. 'info_dict': {. 'id': '433377',. 'ext': 'mp4',. 'title': 'Rick Ross - Interview On Chelsea Lately (2014)',. 'description': 'Rick Ross Interview On Chelsea Lately',. 'duration': 342,. 'uploader': 'ultrafish',. },. }, {. 'url': 'http://en.musicplayon.com/play?pl=102&play=442629',. 'only_matching': True,. }].. _URL_TEMPLATE = 'http://en.musicplayon.com/play?v=%s'.. def _real_extract(self, url):. video_id = self._mat

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mwave.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3279
Entropy (8bit):	4.787465594412977
Encrypted:	false
SSDEEP:	96:Ko2+Qo7QD2X1cv7FflYccTTNSSXBTNjUMEY+e6NNQT7L2DXfkv76Cfqmz:9fQo7Q1v7FlPcTZSSxTNIsx6NGT7iAvL
MD5:	FFAB8B8C8A0A781D7A6FFEC77BB9C1CB
SHA1:	AADC53A69AA7E67C1C9C066E937C1DA1137C1600
SHA-256:	79BBDA6FF8EB1C4ECCD477B5B358D8B2645321B8D869028A15B618FA73A5C708
SHA-512:	51491F453FE9BE23436A300EA73F98DA3080570D62459DA46E788ADF15E340E283FC16B8D5B6D390913C954C867E8763540D9CD4A72434B6953190A6F34A6718
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_duration,.)...class MwaveIE(InfoExtractor):. _VALID_URL = r'https?://mwave\.interest\.me/(?:[^/]+/)?mnettv/videodetail\.m\?searchVideoDetailVO\.clip_id=(?P<id>[0-9]+)'. _URL_TEMPLATE = 'http://mwave.interest.me/mnettv/videodetail.m?searchVideoDetailVO.clip_id=%s'. _TESTS = [{. 'url': 'http://mwave.interest.me/mnettv/videodetail.m?searchVideoDetailVO.clip_id=168859',. # md5 is unstable. 'info_dict': {. 'id': '168859',. 'ext': 'flv',. 'title': '[M COUNTDOWN] SISTAR - SHAKE IT',. 'thumbnail': r're:^https?://.*\.jpg$',. 'uploader': 'M COUNTDOWN',. 'duration': 206,. 'view_count': int,. }. }, {. 'url': 'http://mwave.interest.me/en/mnettv/videodetail.m?searchVideoDetailVO.clip_id=176199',. 'only_matching': True

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\mychannels.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	4.93504684628155
Encrypted:	false
SSDEEP:	48:+udMg0A9ypl3cLNVF8aWfFI7mX3Nl3N/PYcqYx4V:5t0i0l3cL7F8a0ld/PFhxS
MD5:	36463FAED5B28F015E01303A83A73E3E
SHA1:	B80E48E58BF0E7FC8337FC4765AEEB89F29C2444
SHA-256:	B864DD48602D3B3EC2E637F32F3B7813F499E5AF114F54E532F0519423A816BA
SHA-512:	11C3FEBEC89293C143EBFC9EFCDF298C1DB2CE26A994AC0AF1BE7190DB32A0A1F5CEAA4B27492F082E669B401355996E57C320533A920284E894366E8C970FE8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class MyChannelsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?mychannels\.com/.*(?P<id_type>video\|production)_id=(?P<id>[0-9]+)'. _TEST = {. 'url': 'https://mychannels.com/missholland/miss-holland?production_id=3416',. 'md5': 'b8993daad4262dd68d89d651c0c52c45',. 'info_dict': {. 'id': 'wUUDZZep6vQD',. 'ext': 'mp4',. 'title': 'Miss Holland joins VOTE LEAVE',. 'description': 'Miss Holland \| #13 Not a potato',. 'uploader': 'Miss Holland',. }. }.. def _real_extract(self, url):. id_type, url_id = re.match(self._VALID_URL, url).groups(). webpage = self._download_webpage(url, url_id). video_data = self._html_search_regex(r'<div([^>]+data-%s-id="%s"[^>]+)>' % (id_type, url_id), webpage, 'video data').. def extract_data_val(attr, fatal=False):. return se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\myspace.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	4.446090871387455
Encrypted:	false
SSDEEP:	192:HZSFcHv9l/3VSYM1rRqKHIZJynpDCGzK++UTu6NQ1C4+9pT83dn6NaujLRVFAV:HZSFgXVSYerRqKHIZKDCUK++UTu6NAC0
MD5:	81D7573C625A25708A53B46ECBF07212
SHA1:	F45BEB71CF0F0C184B531B5227F95353F6E8C23A
SHA-256:	07855DCCE0D3005795F24AD09D92A399286EF85CE638C93B6B4867E2C96367EB
SHA-512:	5B81E367906E226E6ED1867ADEE016E41BD9DBEC561D79D4C37445E2B30D8FA23BE5BA1B8614C9C085E5A8E96CD40219B8B80C45C2FF5AE143481A5CB9ADF3D4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,.)...class MySpaceIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. myspace\.com/[^/]+/. (?P<mediatype>. video/[^/]+/(?P<video_id>\d+)\|. music/song/[^/?#&]+-(?P<song_id>\d+)-\d+(?:[/?#&]\|$). ). '''.. _TESTS = [{. 'url': 'https://myspace.com/fiveminutestothestage/video/little-big-town/109594919',. 'md5': '9c1483c106f4a695c47d2911feed50a7',. 'info_dict': {. 'id': '109594919',. 'ext': 'mp4',. 'title': 'Little Big Town',. 'description': 'This country quartet was all smiles.while.playing a sold out show at the Pacific.Amphitheatre.in Orange County, California.',. 'uplo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\myspass.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2728
Entropy (8bit):	4.645016957800249
Encrypted:	false
SSDEEP:	48:PuSRVgWwu4XGxQkw6BlP/wOXkrQwtBGLpBa1s4V7og+Pu7ssr5jtOb:jW97XGxTwoSOXlqByBenVlfr5jtk
MD5:	4A72015D36F35E8EAD3D37C53A7E73CE
SHA1:	C3532A086FA79724392FAFF4F824DBD237EE240D
SHA-256:	42E1C6B8F07321F791D6B12CB4F04B29FA75CE61D7F28B50447500317F242982
SHA-512:	28BB74CBFF8C824A6A632ED111A0AA6864D28784D1E680A59D2A0033F18664C0B8EEEC3440B6897E361E3D9EAED6CAC3AAD5B6AA611E6EBBBC87FD7BB92F7D86
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals.import os.path..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,.)...class MySpassIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?myspass\.de/.*'. _TEST = {. 'url': 'http://www.myspass.de/myspass/shows/tvshows/absolute-mehrheit/Absolute-Mehrheit-vom-17022013-Die-Highlights-Teil-2--/11741/',. 'md5': '0b49f4844a068f8b33f4b7c88405862b',. 'info_dict': {. 'id': '11741',. 'ext': 'mp4',. 'description': 'Wer kann in die Fu\u00dfstapfen von Wolfgang Kubicki treten und die Mehrheit der Zuschauer hinter sich versammeln? Wird vielleicht sogar die Absolute Mehrheit geknackt und der Jackpot von 200.000 Euro mit nach Hause genommen?',. 'title': 'Absolute Mehrheit vom 17.02.2013 - Die Highlights, Teil 2',. },. }.. def _real_extract(self, url):. META_DATA_URL_TEMPLATE = 'http://www.m

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\myvi.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4018
Entropy (8bit):	4.82458745729241
Encrypted:	false
SSDEEP:	96:jQj1wQqeJ4pELWNTXj3er1eoteLqePM4kcTfdxDxnT5/JDbDeRHrNZXjFo7DUmBo:EjGT0IrV41htfpUT9V/hbD25A7DNBno
MD5:	797E38FB12D387C650519BAC667B102C
SHA1:	C729B8751FB6F68F40E51CD12B32B13F6ABEC3A0
SHA-256:	B22BBFEE5F62AE966B2670DDB2EA134274B3550E2F8F4DB5A32B5A50E9F31724
SHA-512:	EBA228F3B36BCE0C3C69E9ABA13A57104F463793F5A447A94D4D4BA306DD343B444693715F0A38AAA5B5E4B69E4E2BBF2D18E216C6DB9EF0D7178E8ACE26B08E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .vimple import SprutoBaseIE...class MyviIE(SprutoBaseIE):. _VALID_URL = r'''(?x). (?:. https?://. (?:www\.)?. myvi\.. (?:. (?:ru/player\|tv)/. (?:. (?:. embed/html\|. flash\|. api/Video/Get. )/\|. content/preloader\.swf\?.*\bid=. )\|. ru/watch/. )\|. myvi:. ). (?

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\myvidster.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	918
Entropy (8bit):	4.943366590054517
Encrypted:	false
SSDEEP:	24:1R8lFvDEGamwVpv/Vdl1m2RnnUdhUMO0eIXjlgtprXsAxv8:PuqMeVpm2RnevjjXjlkprXfv8
MD5:	D48617555F0903847059C7FC0FAD4685
SHA1:	6338D589DA18F5771E67E8E9975961CFF8BF22B3
SHA-256:	AF02DCED7373ED1BD1A45B8F267815960EC9C41518D2E7ABD54D7C3268C2EEE4
SHA-512:	E4CFFDAF2F3F9DC4798180A8D11CE0823E60D3F67229631A972E53105C1CFCBF37ABB4CA53C4A4C27BFFA8914956A44E70788CD6CE7D6446490E8173C24206DD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class MyVidsterIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?myvidster\.com/video/(?P<id>\d+)/'.. _TEST = {. 'url': 'http://www.myvidster.com/video/32059805/Hot_chemistry_with_raw_love_making',. 'md5': '95296d0231c1363222c3441af62dc4ca',. 'info_dict': {. 'id': '3685814',. 'title': 'md5:7d8427d6d02c4fbcef50fe269980c749',. 'upload_date': '20141027',. 'uploader': 'utkualp',. 'ext': 'mp4',. 'age_limit': 18,. },. 'add_ie': ['XHamster'],. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. return self.url_result(self._html_search_regex(. r'rel="videolink" href="(?P<real_url>.*)">',. webpage, 'real video url')).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nationalgeographic.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	4.85016276369869
Encrypted:	false
SSDEEP:	48:PuTR3bECRuA1dZ6bfO2Nz4Oh5BqyFdrBwEAxqQ/TMfo57NTlCEdNJnon:oVhuA1dZ6Jz4Oh5BqyTjAVqKNw8A
MD5:	FC1FADAE9C5ADD5259F42AFA799DFC5B
SHA1:	BF04294CACE7561374D7EC8151F18169D1EB4898
SHA-256:	CDB8625355B6321B11144059C006AC2BAED4A83C6BF2DCAEBD348BA861EAD777
SHA-512:	C101D92D3A6A9C90C86FCE2DBF15EA71C8828007CA6AB18FCBA0DE884D78206A120413C63159FF5340CCED364D920C9ECFCD1D0E7C004876517B89BACF9783BE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .fox import FOXIE.from ..utils import (. smuggle_url,. url_basename,.)...class NationalGeographicVideoIE(InfoExtractor):. IE_NAME = 'natgeo:video'. _VALID_URL = r'https?://video\.nationalgeographic\.com/.*?'.. _TESTS = [. {. 'url': 'http://video.nationalgeographic.com/video/news/150210-news-crab-mating-vin?source=featuredvideo',. 'md5': '730855d559abbad6b42c2be1fa584917',. 'info_dict': {. 'id': '0000014b-70a1-dd8c-af7f-f7b559330001',. 'ext': 'mp4',. 'title': 'Mating Crabs Busted by Sharks',. 'description': 'md5:16f25aeffdeba55aaa8ec37e093ad8b3',. 'timestamp': 1423523799,. 'upload_date': '20150209',. 'uploader': 'NAGS',. },. 'add_ie': ['ThePlatform'],. },. {. 'url': 'http://video.nationalgeographic.com/wi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\naver.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	4.82161493424305
Encrypted:	false
SSDEEP:	96:eNN2Ipl38iNnxQFKRmfq4o1MpXntKRWibYUJyPAONOBT8bNu6hG5H6Ne90f:+0IvMi3Xsq4EAntribYUmAONaT8bgH69
MD5:	F98A93FA6850F23A77053A24556A07DE
SHA1:	99AF1618C0546545BFCA6A1430D46BC65F244766
SHA-256:	C35D5E8E5735E007C214177F5D26436B7B9C6436C69316BF44CDEE505C89C80C
SHA-512:	FE70A3EF0A359FCAE2FBF13474707F403FCA74C3B11910D1BC20C9C8FDC688D284204F8D63F6863BEB046617BE982871DBC021B0B3B2A8C66AFF4A87D564C3A7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. update_url_query,.)...class NaverIE(InfoExtractor):. _VALID_URL = r'https?://(?:m\.)?tv(?:cast)?\.naver\.com/v/(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://tv.naver.com/v/81652',. 'info_dict': {. 'id': '81652',. 'ext': 'mp4',. 'title': '[9. .... ....][.._...] .. A. 16~20.',. 'description': '..... .. ..... \| ..... .. ... .... 9. .... ..A. 16... 20... ..... ......',. 'upload_date': '20130903',. },. }, {. 'url': 'http://tv.naver.com/v/395837',. 'md5': '638ed4c12012c458fefcddfd01f173cd',. 'info_dict': {. 'id': '395837',. 'ext': 'mp4',. 'title': '9.. ... ..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nba.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5956
Entropy (8bit):	4.783178212128582
Encrypted:	false
SSDEEP:	96:Rhj1OVVnhTDwZBxrE9ijWnnp/fBfpydBiNrQihPXeidradeivZXDhKGolAnANhrs:RhmVpwugjWn/UdBrVqo7vyhmR69cWakw
MD5:	4C0F21A684A0A8286BEEA5DB2426A95B
SHA1:	A45C268FEB892AC78A3549FDBA7A0FB3DB547FFD
SHA-256:	0B409176ADBA50836BF7156E178E83E9EAE6DFB0C4CE92649E37A9905200FC45
SHA-512:	5266729E30405224FBFF2289F43347CF6C47471A049839CB33E7A1B1E17A44434477E0CB9460FD58B51B25B55AC6A5B6911697FDC66659C22086FBCFBABA53A8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import functools.import re..from .turner import TurnerBaseIE.from ..compat import (. compat_urllib_parse_urlencode,. compat_urlparse,.).from ..utils import (. OnDemandPagedList,. remove_start,.)...class NBAIE(TurnerBaseIE):. _VALID_URL = r'https?://(?:watch\.\|www\.)?nba\.com/(?P<path>(?:[^/]+/)+(?P<id>[^?]?))/?(?:/index\.html)?(?:\?.)?$'. _TESTS = [{. 'url': 'http://www.nba.com/video/games/nets/2012/12/04/0021200253-okc-bkn-recap.nba/index.html',. 'md5': '9e7729d3010a9c71506fd1248f74e4f4',. 'info_dict': {. 'id': '0021200253-okc-bkn-recap',. 'ext': 'mp4',. 'title': 'Thunder vs. Nets',. 'description': 'Kevin Durant scores 32 points and dishes out six assists as the Thunder beat the Nets in Brooklyn.',. 'duration': 181,. 'timestamp': 1354638466,. 'upload_date': '20121204',. },. 'params': {. # m3u8 download.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nbc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18728
Entropy (8bit):	4.78593162939913
Encrypted:	false
SSDEEP:	384:YVhsHlZGVDA43Fna2NGHTYZjqMsaEfH8dZnTv6NhRz4FJ9n6SG3tbGbcfJtols5j:J4na2BVvgH8dZnTv8k91wrhxyAVJzNdV
MD5:	48C01BE80AC15FFA78EA2186659AE4EF
SHA1:	0C07720A296772AD558FF906E8F8AB8EB63B28F6
SHA-256:	06E71043DE3B8A25E5E8AE84A2DEB815F12AB1536187E9CA9E12A7D20E9115B4
SHA-512:	D63DEFEE47DDBA94FD27A76E1890476C1A9AD3B4E88F95ECB6CEDFAA571C04C8F0A6203DBA8B9D2D6B43767516D720F4AA0E9D6477F2E83326FB325417117B62
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import base64.import json.import re..from .common import InfoExtractor.from .theplatform import ThePlatformIE.from .adobepass import AdobePassIE.from ..compat import compat_urllib_parse_unquote.from ..utils import (. smuggle_url,. try_get,. update_url_query,. int_or_none,.)...class NBCIE(AdobePassIE):. _VALID_URL = r'https?(?P<permalink>://(?:www\.)?nbc\.com/(?:classic-tv/)?[^/]+/video/[^/]+/(?P<id>n?\d+))'.. _TESTS = [. {. 'url': 'http://www.nbc.com/the-tonight-show/video/jimmy-fallon-surprises-fans-at-ben-jerrys/2848237',. 'info_dict': {. 'id': '2848237',. 'ext': 'mp4',. 'title': 'Jimmy Fallon Surprises Fans at Ben & Jerry\'s',. 'description': 'Jimmy gives out free scoops of his new "Tonight Dough" ice cream flavor by surprising customers at the Ben & Jerry\'s scoop shop.',. 'timestamp': 1424246400,. 'upload_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ndr.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	14346
Entropy (8bit):	4.820457275247811
Encrypted:	false
SSDEEP:	384:F1uJgzwHkK8WAJqXwR9+RwEbqiiyOG9VoImTaf77ex6N+qKGDsjG4N4Ykm01GzXr:PuIYAiy9abqiiyOGroImTaT7ex8+PnlF
MD5:	A38BB9901FB1253C5BF9D439A526CA1D
SHA1:	033A7EA16075AC2F6122B228CB9FB07B011B17EC
SHA-256:	445BA9C66E7D8042B1C4979493EF3720BB08FB6285056150EE826D4188F2A18F
SHA-512:	B78F5E2FFC91896AD4A6EC474B8003B763C4D7ABD3B2A672EBE4F46882A2129DA1879EDD5235C109B5A3AD0DCE6EF2A1AC3D377F2D88077C3BA0D25CA6186298
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. parse_iso8601,. qualities,.)...class NDRBaseIE(InfoExtractor):. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). display_id = next(group for group in mobj.groups() if group). webpage = self._download_webpage(url, display_id). return self._extract_embed(webpage, display_id)...class NDRIE(NDRBaseIE):. IE_NAME = 'ndr'. IE_DESC = 'NDR.de - Norddeutscher Rundfunk'. _VALID_URL = r'https?://(?:www\.)?ndr\.de/(?:[^/]+/)*(?P<id>[^/?#]+),[\da-z]+\.html'. _TESTS = [{. # httpVideo, same content id. 'url': 'http://www.ndr.de/fernsehen/Party-Poette-und-Parade,hafengeburtstag988.html',. 'md5': '6515bc255dc5c5f8c85bbc38e035a659',. 'info_dict': {. 'id': 'hafengeburtstag988',. 'display_id': 'Party-Poette-und-Parade',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ndtv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4606
Entropy (8bit):	4.892708408289217
Encrypted:	false
SSDEEP:	96:RUUqSHbRHldUaIAUm7u6tNH9uoI5O89gLfVvXLL784A6qndMK3o5uqdYHs860f:RUNSVcAR7ZtN45OQgLfVvXLL784A6qq2
MD5:	0F2FA187BE73BD6A9022FEAEDE9DFD90
SHA1:	D85F72438B3170CB8DF7C8E6DB4FAAB9C7FE9900
SHA-256:	3333BA44E82DA43F2AFF45DF902CC408AE0065C4E0F65BACE05A20D2EF998549
SHA-512:	46DC296D5BE936762E1E1EE09CFD7B8BCABD057E1247FD7492720B9A872AD35A880786862D579828B1BEC801CC4CDD2CED317544D7D9D78FAFDC421EDFC61452
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote_plus.).from ..utils import (. parse_duration,. remove_end,. unified_strdate,. urljoin.)...class NDTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?ndtv\.com/(?:[^/]+/)videos?/?(?:[^/]+/)[^/?^&]+-(?P<id>\d+)'.. _TESTS = [. {. 'url': 'https://khabar.ndtv.com/video/show/prime-time/prime-time-ill-system-and-poor-education-468818',. 'md5': '78efcf3880ef3fd9b83d405ca94a38eb',. 'info_dict': {. 'id': '468818',. 'ext': 'mp4',. 'title': "...... ....: ...... ....., ..... .....",. 'description': 'md5:f410512f1b49672e5695dea16ef2731d',. 'upload_date': '20170928',. 'duration': 2218,. 'thumbnail': r're:https?://.*\.jpg',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nerdcubed.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	4.610669936549896
Encrypted:	false
SSDEEP:	24:zi8l40vg4GQw1V/5dlBQI5d210RMWyltWNlQSk3XMIFOwDEojaBhhlBvQ:+u4r4zQ59QIrI0RM8cr3XMuOUE/lvQ
MD5:	413A3146E224762FDA2729C26D66C003
SHA1:	9F6F4B88F1B7CC5A06254277CDC9F6B23D296F0A
SHA-256:	BCECFD0E68CEA35964AFCD8771462706D8413F8F4C4CD6D77D95A8BD10CBB8D6
SHA-512:	75E8CFA9DCB5E31485C2BC6A1DAE1FE4A5D36704229EAB619F211F479D898BC36193FA8A0013487C0E3295718FAF0503557422C96FB82E46B6F85646BB104087
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import datetime..from .common import InfoExtractor...class NerdCubedFeedIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nerdcubed\.co\.uk/feed\.json'. _TEST = {. 'url': 'http://www.nerdcubed.co.uk/feed.json',. 'info_dict': {. 'id': 'nerdcubed-feed',. 'title': 'nerdcubed.co.uk feed',. },. 'playlist_mincount': 1300,. }.. def _real_extract(self, url):. feed = self._download_json(url, url, 'Downloading NerdCubed JSON feed').. entries = [{. '_type': 'url',. 'title': feed_entry['title'],. 'uploader': feed_entry['source']['name'] if feed_entry['source'] else None,. 'upload_date': datetime.datetime.strptime(feed_entry['date'], '%Y-%m-%d').strftime('%Y%m%d'),. 'url': 'http://www.youtube.com/watch?v=' + feed_entry['youtube_id'],. } for feed_entry in feed].. return {. '_type': 'pla

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\neteasemusic.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	17336
Entropy (8bit):	4.901696700667971
Encrypted:	false
SSDEEP:	384:ec/IGOgd9kNnUU5K2QFJcwkyTRn6NfFMjV5haRAR/ELhhT9+6NX2FfVMwikETx6Z:b/IBgPkN2kyTt8fuB3WhhTY8XMAkETxC
MD5:	B9FD13951B3065F45B7B0C4B0BB33644
SHA1:	D9E7DE7A2E1DBF745A1C0B33457EB8BDBCC2DDCB
SHA-256:	8D693D53CD9ABB5F4CFE9992ADB6061FE1CBD0618B32787ECB2EA7E2CC9AFBD2
SHA-512:	D3A7506711894C4E503CBD5CCE602A4ACB085196019A8DBC22CCF91F5813C677F6FE09D2A7EA68D41E93A7E670E418E2815A21E2A571F051975CB54A8455F0AC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from hashlib import md5.from base64 import b64encode.from datetime import datetime.import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlencode,. compat_str,. compat_itertools_count,.).from ..utils import (. sanitized_Request,. float_or_none,.)...class NetEaseMusicBaseIE(InfoExtractor):. _FORMATS = ['bMusic', 'mMusic', 'hMusic']. _NETEASE_SALT = '3go8&$833h0k(2)2'. _API_BASE = 'http://music.163.com/api/'.. @classmethod. def _encrypt(cls, dfsid):. salt_bytes = bytearray(cls._NETEASE_SALT.encode('utf-8')). string_bytes = bytearray(compat_str(dfsid).encode('ascii')). salt_len = len(salt_bytes). for i in range(len(string_bytes)):. string_bytes[i] = string_bytes[i] ^ salt_bytes[i % salt_len]. m = md5(). m.update(bytes(string_bytes)). result = b64encode(m.digest()).decode('ascii'). return result.repla

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\netzkino.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3050
Entropy (8bit):	4.675218005963205
Encrypted:	false
SSDEEP:	48:+uXAKcu74AI51B9I5dJGmgqnuYadfFBXb74eHvVb9xkFzEB9Huu/pLN8EaB6IYB0:zAKl74t51Y5d4mznuYaR7PPkzIldN8EU
MD5:	D7031F2BBCC679C5F1F1EDD545E53760
SHA1:	B73116BB039EE35033C03293AC84B720F23528FF
SHA-256:	6122F2C4FA2C92F1EEBBB993FE76C6B3DE406333D53CBD8AFC6813F306D76611
SHA-512:	58FEF9D078F2B394245FCA693FF157B0A410E29C97FAD607EA48A9A30D37AD5A1E68F8148DD396ADD2E9732A1ABEC1EE099FB44D9DEC70384E21ED5D6EFEB5C4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. js_to_json,. parse_iso8601,.)...class NetzkinoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?netzkino\.de/\#!/(?P<category>[^/]+)/(?P<id>[^/]+)'.. _TEST = {. 'url': 'http://www.netzkino.de/#!/scifikino/rakete-zum-mond',. 'md5': '92a3f8b76f8d7220acce5377ea5d4873',. 'info_dict': {. 'id': 'rakete-zum-mond',. 'ext': 'mp4',. 'title': 'Rakete zum Mond (Endstation Mond, Destination Moon)',. 'comments': 'mincount:3',. 'description': 'md5:1eddeacc7e62d5a25a2d1a7290c64a28',. 'upload_date': '20120813',. 'thumbnail': r're:https?://.*\.jpg$',. 'timestamp': 1344858571,. 'age_limit': 12,. },. 'params': {. 'skip_download': 'Download only works from Germany',. }. }.. def _r

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\newgrounds.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5583
Entropy (8bit):	4.714426107106111
Encrypted:	false
SSDEEP:	96:KTJnw+kTAYMX35PhxqfSrQSeuCQTTkBT42NMc5Krb5qS8V6NlUYDIcKq4Il/fO07:uPG4XpJmHS0QTTsTbvgb5qtV6NOC53XP
MD5:	373066E145C6FBA903E7F863F3EA7E48
SHA1:	7DD8368BF8C4E7B699288F11F2218054BF276220
SHA-256:	A2F50650D359AA026779989E03D581638304B9B713B1BC3C9C329366C2526E89
SHA-512:	CB74FD05F0DE0113427C1AE2240D2413657C99141018A5653D9487A6327AC436694DDC2B4FC8F5E47A73806CADD09313E34175E72CA19075C1ABB2F63833B2D2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,. int_or_none,. parse_duration,. parse_filesize,. unified_timestamp,.)...class NewgroundsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?newgrounds\.com/(?:audio/listen\|portal/view)/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://www.newgrounds.com/audio/listen/549479',. 'md5': 'fe6033d297591288fa1c1f780386f07a',. 'info_dict': {. 'id': '549479',. 'ext': 'mp3',. 'title': 'B7 - BusMode',. 'uploader': 'Burn7',. 'timestamp': 1378878540,. 'upload_date': '20130911',. 'duration': 143,. },. }, {. 'url': 'https://www.newgrounds.com/portal/view/673111',. 'md5': '3394735822aab2478c31b1004fe5e5bc',. 'info_dict': {. 'id': '673111',. 'ext': 'mp4',. 'title': 'Dancin',. 'uploader':

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\newstube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3123
Entropy (8bit):	4.889432053044251
Encrypted:	false
SSDEEP:	96:5YAysGibzUqaJAxdq3LgGNUOz7B4YDQeTQ6BTUXbWS/E3b6Ng:5vysvQqt6LReOnmYDQeTQOTj6Ng
MD5:	AD1A52C84CCDCD31D49932FE296BC1FA
SHA1:	CEA4F9F691D9953F4C602C4863EC06D6B754B0B9
SHA-256:	3059D1EBA605B89866466B20C68C684169BB0EB36C0BEEE4AC91F343B2197D0D
SHA-512:	2711313D6D89F700E5B421B0FA63D2E75AEDD26FA4298D537FB0672F06145053D5D3B01A0A669CAA108B092E2E6B9F399B2D7112B360348DA582DAA5BD8AB5D6
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import hashlib..from .common import InfoExtractor.from ..aes import aes_cbc_decrypt.from ..utils import (. bytes_to_intlist,. int_or_none,. intlist_to_bytes,. parse_codecs,. parse_duration,.)...class NewstubeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?newstube\.ru/media/(?P<id>.+)'. _TEST = {. 'url': 'http://www.newstube.ru/media/telekanal-cnn-peremestil-gorod-slavyansk-v-krym',. 'md5': '9d10320ad473444352f72f746ccb8b8c',. 'info_dict': {. 'id': '728e0ef2-e187-4012-bac0-5a081fdcb1f6',. 'ext': 'mp4',. 'title': '......... CNN .......... ..... ........ . ....',. 'description': 'md5:419a8c9f03442bc0b0a794d689360335',. 'duration': 31.05,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. page = self._download_webpage(url, video_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nextmedia.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8975
Entropy (8bit):	5.303030497374518
Encrypted:	false
SSDEEP:	192:KGBnnw6U/7GiceVVLIbuufVydEPvWJtskPvNJFNG42dtXfm5GF+IlZaF5:9BnnnicePIbuufVydEHWJtskHNJFNG4B
MD5:	160F897F74865A40A10C16364FE2907D
SHA1:	8D30CADD48EC80E51A129D81591C35A43A7C70FC
SHA-256:	D2EF1B5880E3125D3CA621D00978D3B43BCE220E074653971A6A4F9F55247628
SHA-512:	497C6F2EAC52AAEA4AF930E9EA394C85ABEEEEA6A293F5AA998F70E26A727A380C70EBF944330D7601A9D780B445ED9EF488EF85BF4E581C3052AC577F0C4A8A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. clean_html,. get_element_by_class,. int_or_none,. parse_iso8601,. remove_start,. unified_timestamp,.)...class NextMediaIE(InfoExtractor):. IE_DESC = '....'. _VALID_URL = r'https?://hk\.apple\.nextmedia\.com/[^/]+/[^/]+/(?P<date>\d+)/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://hk.apple.nextmedia.com/realtime/news/20141108/53109199',. 'md5': 'dff9fad7009311c421176d1ac90bfe4f',. 'info_dict': {. 'id': '53109199',. 'ext': 'mp4',. 'title': '......50........ ..........',. 'thumbnail': r're:^https?://.*\.jpg$',. 'description': 'md5:28222b9912b6665a21011b034c70fcc7',. 'timestamp': 1415456273,. 'upload_date': '20141108',. }. }].. _URL_PATTERN = r'\{ url: \'(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nexx.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	16598
Entropy (8bit):	4.52371239431554
Encrypted:	false
SSDEEP:	384:yMUKNuSkdT+OVknL0g8Qe2ZUNzoa4OZ+YX8Q58rRdqo4sqoN10m9SVy/FhPqjdBo:wKfnL0g8Qe2ZUNzoa4OZJX8Q6Rdqo4s7
MD5:	679137AEFF204AEA569F1BA9D32508AA
SHA1:	47E19FFF838172ECBA07AFB6B321954EC389E2CE
SHA-256:	8D58E871A66591CAC0FA6D5A4C17DBE105BB5CC8E78EBB16B39051CEDB1FBB8D
SHA-512:	B1F112554B3D0FE030A255F0CDF9152D311BB440ECB08AE7A674583DD4DC64D38B03EE4116A4435DAAABC5C9CEEEB38C937792D198D40874CB58F23008D26ABC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hashlib.import random.import re.import time..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. parse_duration,. try_get,. urlencode_postdata,.)...class NexxIE(InfoExtractor):. _VALID_URL = r'''(?x). (?:. https?://api\.nexx(?:\.cloud\|cdn\.com)/v3/(?P<domain_id>\d+)/videos/byid/\|. nexx:(?:(?P<domain_id_s>\d+):)?\|. https?://arc\.nexx\.cloud/api/video/. ). (?P<id>\d+). '''. _TESTS = [{. # movie. 'url': 'https://api.nexx.cloud/v3/748/videos/byid/128907',. 'md5': '31899fd683de49ad46f4ee67e53e83fe',. 'info_dict': {. 'id': '128907',. 'ext': 'mp4',. 'title': 'Stiftung Warentest',. 'alt_title': 'Wie ein Tes

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nfb.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4486
Entropy (8bit):	4.144908415401477
Encrypted:	false
SSDEEP:	96:yOOjlIl0Gx2a1Suxx7rDik17uyRN4vPZpBTRlkNl5bIazdWe8N6No:vadaRyM45HTgIAqN6No
MD5:	0E6863D32D7CDE06C739D862218730F1
SHA1:	31D7319C909587DB03F2AB6944460421BD1085AC
SHA-256:	C12A588F14A1C562370350D3F07821735347625192D0767AA3B27131B9577B6A
SHA-512:	69E73F14F64995EE3C27F19785580C3B090723B97BFFB93ABB0BDFC19952884F5E7A9B3FF2DD1476C50358E27C255E2C75C2434E9AEFBDC9D7109C39EA6ED019
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. int_or_none,. qualities,. urlencode_postdata,. xpath_text,.)...class NFBIE(InfoExtractor):. IE_NAME = 'nfb'. IE_DESC = 'National Film Board of Canada'. _VALID_URL = r'https?://(?:www\.)?(?:nfb\|onf)\.ca/film/(?P<id>[\da-z_-]+)'.. _TEST = {. 'url': 'https://www.nfb.ca/film/qallunaat_why_white_people_are_funny',. 'info_dict': {. 'id': 'qallunaat_why_white_people_are_funny',. 'ext': 'flv',. 'title': 'Qallunaat! Why White People Are Funny ',. 'description': 'md5:6b8e32dde3abf91e58857b174916620c',. 'duration': 3128,. 'creator': 'Mark Sandiford',. 'uploader': 'Mark Sandiford',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nfl.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9148
Entropy (8bit):	4.270465256107691
Encrypted:	false
SSDEEP:	192:pUpQ20ueyuv7wvu7a0LTCsJuxmCfooBYt7BiyShPZivezUTS6Nam+:S/0ueV7Mu7a0LTCwuxrocYt7BiykUTSx
MD5:	6DB9C2B2221B7AB4206A921E419F07AB
SHA1:	DA295DDBA0C3E66ABB9376618FC970582B2F3EF5
SHA-256:	CE5F7ED0736155E254FF2D6ADA72BD012B6CD0F50AD8AFDA1878F382255DFB17
SHA-512:	8E84A8601613B8F37123419C2CD9EC26F10E76ECB28D461DC49A972B9C019DBB7A0EB6A1D9D5B07BA2B1DA46E4D77CE1C9EEDAB696A819673B65C02E73F446DF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. int_or_none,. remove_end,.)...class NFLIE(InfoExtractor):. IE_NAME = 'nfl.com'. _VALID_URL = r'''(?x). https?://. (?P<host>. (?:www\.)?. (?:. (?:. nfl\|. buffalobills\|. miamidolphins\|. patriots\|. newyorkjets\|. baltimoreravens\|. bengals\|. clevelandbrowns\|. steelers\|. houstontexans\|.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nhk.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3165
Entropy (8bit):	4.66239612647012
Encrypted:	false
SSDEEP:	48:Pu52nXKnfJJXbXeIBLuOfFIZ05V2gNBdv6hx11kU2f5Ygtp62G6kso6XGjVzNqz6:TsDzju5KjBShx1Sf6op6B6kxRjVzNqNM
MD5:	FA057466DFD3136D231BA9EB53CB4DD3
SHA1:	16C678D97E79FA05FF95599D4B8747999ECF5BB7
SHA-256:	27D2E1BF36E164D9BAA3429CC1EBD773C5C62B77C35580ABE47C8129C4F3917A
SHA-512:	179CCCDC71F176427B9E50A225E17E9612A2B2B3012EB0915E9F038465C6FD395EB4DDC7B2BC1D3CB0CC96393386B175CB4F9EA1DA23E3CBB95FA79998047528
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor...class NhkVodIE(InfoExtractor):. _VALID_URL = r'https?://www3\.nhk\.or\.jp/nhkworld/(?P<lang>[a-z]{2})/ondemand/(?P<type>video\|audio)/(?P<id>\d{7}\|[a-z]+-\d{8}-\d+)'. # Content available only for a limited period of time. Visit. # https://www3.nhk.or.jp/nhkworld/en/ondemand/ for working samples.. _TESTS = [{. 'url': 'https://www3.nhk.or.jp/nhkworld/en/ondemand/video/2015173/',. 'only_matching': True,. }, {. 'url': 'https://www3.nhk.or.jp/nhkworld/en/ondemand/audio/plugin-20190404-1/',. 'only_matching': True,. }, {. 'url': 'https://www3.nhk.or.jp/nhkworld/fr/ondemand/audio/plugin-20190404-1/',. 'only_matching': True,. }]. _API_URL_TEMPLATE = 'https://api.nhk.or.jp/nhkworld/%sodesdlist/v7/episode/%s/%s/all%s.json'.. def _real_extract(self, url):. lang, m_type, episode_id = re.match(self._VALID_URL, url).groups(). if epis

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nhl.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5004
Entropy (8bit):	4.708413876050088
Encrypted:	false
SSDEEP:	96:EOqVGND5ZbjdNMLQMzdLd8BTeFsCrtWwVxEYhNWF6N4309o7FEGCKpCNjLy2LUoy:RqeNjdNMLQMzxdUTqvZM6NI0+7fCKwNU
MD5:	AC640614F92F426A3B6D06E0A5CE4BC5
SHA1:	597F56BA41AD46DF220442F3E6CF57EC20773C51
SHA-256:	623E37D28E6A66150AAF32340DA1E8D7548B0D2DC3C60100B43E16F500D8B588
SHA-512:	7D71548A0CDCD4BFD8386DDEF7297326CE7929F456582B9DA9A40030FCE342C12AF63AE6A7D5CDB1FAA32EA8E84D4AC612B0D7C693D45357EE2E9CD3AE9AA170
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. int_or_none,. parse_iso8601,. parse_duration,.)...class NHLBaseIE(InfoExtractor):. def _real_extract(self, url):. site, tmp_id = re.match(self._VALID_URL, url).groups(). video_data = self._download_json(. 'https://%s/%s/%sid/v1/%s/details/web-v1.json'. % (self._CONTENT_DOMAIN, site[:3], 'item/' if site == 'mlb' else '', tmp_id), tmp_id). if video_data.get('type') != 'video':. video_data = video_data['media']. video = video_data.get('video'). if video:. video_data = video. else:. videos = video_data.get('videos'). if videos:. video_data = videos[0].. video_id = compat_str(video_data['id']). title = video_data['title'].. formats = []. for play

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nick.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10837
Entropy (8bit):	4.973651487064187
Encrypted:	false
SSDEEP:	192:X3vCZHbEJbBOKbxEFbGnEN/bK/4H4RcAqGoQ4yH3GmZ82Rt4/AadJqRvirVuqY5B:X6ZHG5oCO/bKSRAqGoQXXr82RtOAaJqt
MD5:	CD82DB2F362BC38C5362A6ACF02ED8FD
SHA1:	2D8FF49F77BDFB68CABC50D9D37EA183D2792E34
SHA-256:	B530F4FF5EE36E9791F4B899D540C2E1B8C8058FFDCBD4B1C39D489F6C07BBB1
SHA-512:	722679D2E34FD41F96E121B34166336176C673859EF2B695E8662581A5A3683F546EB8E9C5D0424C0698F62B16836BAFBB06EE4DEC94B66FEDF67C8A7AFD7F7C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .mtv import MTVServicesInfoExtractor.from ..utils import update_url_query...class NickIE(MTVServicesInfoExtractor):. # None of videos on the website are still alive?. IE_NAME = 'nick.com'. _VALID_URL = r'https?://(?P<domain>(?:(?:www\|beta)\.)?nick(?:jr)?\.com)/(?:[^/]+/)?(?:videos/clip\|[^/]+/videos)/(?P<id>[^/?#.]+)'. _FEED_URL = 'http://udat.mtvnservices.com/service1/dispatch.htm'. _GEO_COUNTRIES = ['US']. _TESTS = [{. 'url': 'http://www.nick.com/videos/clip/alvinnn-and-the-chipmunks-112-full-episode.html',. 'playlist': [. {. 'md5': '6e5adc1e28253bbb1b28ab05403dd4d4',. 'info_dict': {. 'id': 'be6a17b0-412d-11e5-8ff7-0026b9414f30',. 'ext': 'mp4',. 'title': 'ALVINNN!!! and The Chipmunks: "Mojo Missing/Who\'s The Animal" S1',. 'description': 'Alvin is convinced his mojo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\niconico.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	18642
Entropy (8bit):	4.565526883511982
Encrypted:	false
SSDEEP:	384:ZN6O+B06qD+ZYoGdb0OrVgeuP0LZ/11vgpTZ1MaHxNw26NWBhg:fXVgXP0LZ/11vgpTZSaRJ8WA
MD5:	C6920EB3C43C00AA504AF2F4F093CB4C
SHA1:	811500202797B1D59BACEE028F1751762AA3F645
SHA-256:	DCFD513D45A5DDD15CDD132F7EE6EC2D8C4E40E31B8B590E8D8D5EB5850FD67A
SHA-512:	F4B00B6FE845CB00468A41A099F62EF715B2F7EDBBF352865B07E0589DD14F612B981E931DF1A8B00B385135E26F628BCF98C90DDF2F536F8AD2BBF6446ED57A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import datetime..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import (. determine_ext,. dict_get,. ExtractorError,. int_or_none,. float_or_none,. parse_duration,. parse_iso8601,. remove_start,. try_get,. unified_timestamp,. urlencode_postdata,. xpath_text,.)...class NiconicoIE(InfoExtractor):. IE_NAME = 'niconico'. IE_DESC = '......'.. _TESTS = [{. 'url': 'http://www.nicovideo.jp/watch/sm22312215',. 'md5': 'd1a75c0823e2f629128c43e1212760f9',. 'info_dict': {. 'id': 'sm22312215',. 'ext': 'mp4',. 'title': 'Big Buck Bunny',. 'thumbnail': r're:https?://.*',. 'uploader': 'takuya0301',. 'uploader_id': '2698420',. 'upload_date': '20131123',. 'timestamp': int, # timestamp is unstable.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ninecninemedia.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3767
Entropy (8bit):	4.504400938410313
Encrypted:	false
SSDEEP:	96:IMOs6EbhXNIOcHiWxoDBTeoUT1UUQX+v91WNs6NPW:BOs6ErIOcHiqolTxL+D6NPW
MD5:	E8475744E2DA2A0B5E3A19226F15D379
SHA1:	FF2D399BB807C40029BA0675D7563EE0EB83555C
SHA-256:	E0229B0BCBE67F41C48EB12DC5C586A734010CF66A1FD3DE2F1837CA7D9CE390
SHA-512:	82A3532243303A2613949708AF13CA31C91A9FFECAEC66453165751EC6A1E8AF950B0661049B0A223F54823D089E514A361C10F2B820E783F0C8B1A6BC400BAB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_iso8601,. float_or_none,. ExtractorError,. int_or_none,.)...class NineCNineMediaIE(InfoExtractor):. IE_NAME = '9c9media'. _GEO_COUNTRIES = ['CA']. _VALID_URL = r'9c9media:(?P<destination_code>[^:]+):(?P<id>\d+)'. _API_BASE_TEMPLATE = 'http://capi.9c9media.com/destinations/%s/platforms/desktop/contents/%s/'.. def _real_extract(self, url):. destination_code, content_id = re.match(self._VALID_URL, url).groups(). api_base_url = self._API_BASE_TEMPLATE % (destination_code, content_id). content = self._download_json(api_base_url, content_id, query={. '$include': '[Media,Season,ContentPackages]',. }). title = content['Name']. if len(content['ContentPackages']) > 1:. raise ExtractorError('multiple content packages'). content_package = content['ContentPackages'][0].

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ninegag.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3708
Entropy (8bit):	4.7629151835244254
Encrypted:	false
SSDEEP:	96:bfP0dlKtmXwmyCsWrTIP9nm5nTnCGIXSv/JbIm8itc:b8DvXzxsWrs+jCGICHumA
MD5:	E8B85E735491D230E250F233957E57E8
SHA1:	A567A5FE60A4CE89309364F5454B5FE42D12BE2B
SHA-256:	1FAA2970B43B381BD8CDA7D4288E1A35AA1A9D533ECE4C3D70AF6113302B529F
SHA-512:	E8F1B230C9F96106F4BB864CCB24FCAD243892883557D5662348EC31A83450AB68D540CE4342858D785053C050F04BE9C9EF1AA7BAC3D67C0A68414A72E3D62B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import str_to_int...class NineGagIE(InfoExtractor):. IE_NAME = '9gag'. _VALID_URL = r'https?://(?:www\.)?9gag(?:\.com/tv\|\.tv)/(?:p\|embed)/(?P<id>[a-zA-Z0-9]+)(?:/(?P<display_id>[^?#/]+))?'.. _TESTS = [{. 'url': 'http://9gag.com/tv/p/Kk2X5/people-are-awesome-2013-is-absolutely-awesome',. 'info_dict': {. 'id': 'kXzwOKyGlSA',. 'ext': 'mp4',. 'description': 'This 3-minute video will make you smile and then make you feel untalented and insignificant. Anyway, you should share this awesomeness. (Thanks, Dino!)',. 'title': '\"People Are Awesome 2013\" Is Absolutely Awesome',. 'uploader_id': 'UCdEH6EjDKwtTe-sO2f0_1XA',. 'uploader': 'CompilationChannel',. 'upload_date': '20131110',. 'view_count': int,. },. 'add_ie': ['Youtube'],. }, {. 'url': 'http://9gag.com/tv/p/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ninenow.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3269
Entropy (8bit):	4.856412809818029
Encrypted:	false
SSDEEP:	96:q0cJKQS6AFjN7kO5JsX8K09f4Y1vj3I9hE:8/6N7k4JsinaE
MD5:	44EC8BA619B7E63CCB50FC2D6AA14BCF
SHA1:	1BCFBA37B781222C10FBE59E27F05805A2A14D74
SHA-256:	CE6D3B24B2785455AEC2734838AE4047F1360DDAE9CAB42225C72362FFF229D1
SHA-512:	DEE6EC19C50904903CA28E682E0868997FD6DBD04879A58003BA80DA79E7A46E0CB6D798F2727B8EA5B183BF5F5C9DF7B6D6EDD953563950CEE9A6ED67F87D05
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. smuggle_url,.)...class NineNowIE(InfoExtractor):. IE_NAME = '9now.com.au'. _VALID_URL = r'https?://(?:www\.)?9now\.com\.au/(?:[^/]+/){2}(?P<id>[^/?#]+)'. _GEO_COUNTRIES = ['AU']. _TESTS = [{. # clip. 'url': 'https://www.9now.com.au/afl-footy-show/2016/clip-ciql02091000g0hp5oktrnytc',. 'md5': '17cf47d63ec9323e562c9957a968b565',. 'info_dict': {. 'id': '16801',. 'ext': 'mp4',. 'title': 'St. Kilda\'s Joey Montagna on the potential for a player\'s strike',. 'description': 'Is a boycott of the NAB Cup "on the table"?',. 'uploader_id': '4460760524001',. 'upload_date': '20160713',. 'timestamp': 1468421266,. },. 'skip': 'Only available in Australia',. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nintendo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	4.950783015979502
Encrypted:	false
SSDEEP:	24:zi8lzvGXLtGPfwC/G8JH4l/CbAxHNPb5PwL/ulk8UfVXhgLFlbJl8RIRDcQM:+u6XLtsf/G8QCbuNPFKuUfVXhgLFZJlU
MD5:	D5531675B0FE2A8A42EE1CCD3DC0A463
SHA1:	743E97C655505C04D08F1B60585295BE14CFA7C4
SHA-256:	7C9129AC6CCF0EC13793CB66878961E54B02DC39A449A0DA3396BF0B35DAD4B3
SHA-512:	7BC7AF647EF35CFB2CBE548A41D0DE47333996F713B6BA2487DADE50438076AECA898867EC5F84D3E54C6CD40604DE33C75D567A9A2276543092E2990A806F2D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .ooyala import OoyalaIE.from ..utils import unescapeHTML...class NintendoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nintendo\.com/games/detail/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'http://www.nintendo.com/games/detail/yEiAzhU2eQI1KZ7wOHhngFoAHc1FpHwj',. 'info_dict': {. 'id': 'MzMmticjp0VPzO3CCj4rmFOuohEuEWoW',. 'ext': 'flv',. 'title': 'Duck Hunt Wii U VC NES - Trailer',. 'duration': 60.326,. },. 'params': {. 'skip_download': True,. },. 'add_ie': ['Ooyala'],. }, {. 'url': 'http://www.nintendo.com/games/detail/tokyo-mirage-sessions-fe-wii-u',. 'info_dict': {. 'id': 'tokyo-mirage-sessions-fe-wii-u',. 'title': 'Tokyo Mirage Sessions .FE',. },. 'playlist_count': 3,. }].. def _real_extract(self, url):. pag

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\njpwworld.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3286
Entropy (8bit):	4.839359449664393
Encrypted:	false
SSDEEP:	96:xUHSkOavoacZi2F7IPxn9airCIBugzkYKUiRo6alTm+a+qBTK6Npa:xGSV06A/59aifRgVR+lTm+a++TK6Npa
MD5:	D156F72DA060CC617D4736BA4309F1C4
SHA1:	AB1F7E8DEFAB26B78EEB0BD81E2E2A0BA2769069
SHA-256:	C57544607C8DD97691B5CF4172A805098AF7B4CBB2DEAF8EDCD68EEB8FC052A7
SHA-512:	C887CAB792D8295B71C72F7FF80B24945776D09EB6A7C9CFC4912449CB1C758BF489EA9986088786CC574EB37ACBBF9AD6BC25EDE476422992CB7489803FAA3D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. extract_attributes,. get_element_by_class,. urlencode_postdata,.)...class NJPWWorldIE(InfoExtractor):. _VALID_URL = r'https?://njpwworld\.com/p/(?P<id>[a-z0-9_]+)'. IE_DESC = '...........'. _NETRC_MACHINE = 'njpwworld'.. _TEST = {. 'url': 'http://njpwworld.com/p/s_series_00155_1_9/',. 'info_dict': {. 'id': 's_series_00155_1_9',. 'ext': 'mp4',. 'title': '.9.............vs..........',. 'tags': list,. },. 'params': {. 'skip_download': True, # AES-encrypted m3u8. },. 'skip': 'Requires login',. }.. _LOGIN_URL = 'https://front.njpwworld.com/auth/login'.. def _real_initialize(self):. self._login().. def _login(self):. user

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nobelprize.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2123
Entropy (8bit):	4.5569693822152555
Encrypted:	false
SSDEEP:	48:+usWOYcY8j/Frz7/ajXjlk5wng+aDyW04dELOW41iYq89BThRTNs6Ng:zO/Yqlz7/aqgg+VW7dELOWEi389BThRC
MD5:	ECD986C4E9F5FB16E3A4586FFDCBA036
SHA1:	1093DC3BC6C86255C85765D41A599E84362FFE56
SHA-256:	3B57BA8A3134AF0CED06A6FB045EA7D0BA9C7B65301CD57DB55C51F74F442525
SHA-512:	E333C3ED4D1755D978202AE0655772574818823BEB2E466F9785EDC2E51187CFAC5357837345D8AC661FDC462360C7F51EFBDCDE58B65E0D0DA0AC1E111DE6AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. js_to_json,. mimetype2ext,. determine_ext,. update_url_query,. get_element_by_attribute,. int_or_none,.)...class NobelPrizeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nobelprize\.org/mediaplayer.?\bid=(?P<id>\d+)'. _TEST = {. 'url': 'http://www.nobelprize.org/mediaplayer/?id=2636',. 'md5': '04c81e5714bb36cc4e2232fee1d8157f',. 'info_dict': {. 'id': '2636',. 'ext': 'mp4',. 'title': 'Announcement of the 2016 Nobel Prize in Physics',. 'description': 'md5:05beba57f4f5a4bbd4cf2ef28fcff739',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). media = self._parse_json(self._search_regex(. r'(?s)var\sconfig\s=\s({.+?});', webpage,. 'config'), video_id, js_to_j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\noco.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8443
Entropy (8bit):	4.544250951800426
Encrypted:	false
SSDEEP:	96:hYt8sL5dH4Lz3PVhRX89zEufiSJgulezoLzbjo/+qHGAJuy+bL1X26U9kBTa6EVq:fYSLh4BqJ6bjUTHxkyslU9sTbkYzV6Ng
MD5:	22DAA56F1F3E36DF1C6F69004A704968
SHA1:	FE576BDE907CFB2751307BC6E69DF101D1BAC4B9
SHA-256:	A130A4398256C3F41253D74A7A316C95E93A47187F1584BDCEDF00C656EA5E80
SHA-512:	4E4EF55699E7A9600493165EE18A9DE5DC3C8749B85A69032A5B17F7B4C1074BC853CECC78AF31CEA78D07E13CCA5C77903D778B5554A05C0995F8459B9B6DF4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time.import hashlib..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. clean_html,. ExtractorError,. int_or_none,. float_or_none,. parse_iso8601,. sanitized_Request,. urlencode_postdata,.)...class NocoIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.)?noco\.tv/emission/\|player\.noco\.tv/\?idvideo=)(?P<id>\d+)'. _LOGIN_URL = 'https://noco.tv/do.php'. _API_URL_TEMPLATE = 'https://api.noco.tv/1.1/%s?ts=%s&tk=%s'. _SUB_LANG_TEMPLATE = '&sub_lang=%s'. _NETRC_MACHINE = 'noco'.. _TESTS = [. {. 'url': 'http://noco.tv/emission/11538/nolife/ami-ami-idol-hello-france/',. 'md5': '0a993f0058ddbcd902630b2047ef710e',. 'info_dict': {. 'id': '11538',. 'ext': 'mp4',. 'title': 'Ami Ami Idol - Hello! France',. 'description

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nonktube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.8886091381657115
Encrypted:	false
SSDEEP:	24:1R8lQuGHQfUlDGP/X/dlFvO5hUGDHNqHPU18tfeIX0L924Ei:PuQuIQfUlDGnX/pvS1rNqvU18tfjX0Lb
MD5:	4F630CABFBA987A36B85C7F5B04D6203
SHA1:	1C9C10B794BC5A98CC392EC9BFA8693A0944896D
SHA-256:	29ED49317D38F60C8314F14C138D72556179F91419DB71E4DDDCEEB7034EC25C
SHA-512:	DB03C2E93E3692B90DEB4E91B944A72C9854D4B35B452810C67DF008F92EB44F431F56FC793B7E61F982B6228EA2E91E34F3259FE2F544D8D5EE6BFBE61D7C5B
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .nuevo import NuevoBaseIE...class NonkTubeIE(NuevoBaseIE):. _VALID_URL = r'https?://(?:www\.)?nonktube\.com/(?:(?:video\|embed)/\|media/nuevo/embed\.php\?.*?\bid=)(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.nonktube.com/video/118636/sensual-wife-uncensored-fucked-in-hairy-pussy-and-facialized',. 'info_dict': {. 'id': '118636',. 'ext': 'mp4',. 'title': 'Sensual Wife Uncensored Fucked In Hairy Pussy And Facialized',. 'age_limit': 18,. 'duration': 1150.98,. },. 'params': {. 'skip_download': True,. }. }, {. 'url': 'https://www.nonktube.com/embed/118636',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. info = self._extract_nuevo(. 'https://www.nonktube.com/media/nuevo/econfig.php?key=%s'. % video_id, video_id).. info['age_limit']

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\noovo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3658
Entropy (8bit):	4.751752668646228
Encrypted:	false
SSDEEP:	96:Y6zvodh0WUNTSUssx5azTrBGzt9qj/KLqWwcRMFkNKVy7RO:Vo7GNvHa/ii9hx
MD5:	4B489B003C0109E4A542E500622D5DB0
SHA1:	A287A79704F6EC1CCAA9E2BBCECBDAC5270300A7
SHA-256:	3F0BA4246A55434F0863C90E61840A490E7B2289FEEE1032F6A94DF498F92946
SHA-512:	B51F2377DD4C3B9A1DB79701BD51A754C65D6ECCB644B78D73C97BDDF50BEC236F418BB668BA28C5D7C72133B5FD60DD03DAC87492D87ADFDC6690A5E9D03A9E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .brightcove import BrightcoveNewIE.from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. js_to_json,. smuggle_url,. try_get,.)...class NoovoIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?noovo\.ca/videos/(?P<id>[^/]+/[^/?#&]+)'. _TESTS = [{. # clip. 'url': 'http://noovo.ca/videos/rpm-plus/chrysler-imperial',. 'info_dict': {. 'id': '5386045029001',. 'ext': 'mp4',. 'title': 'Chrysler Imperial',. 'description': 'md5:de3c898d1eb810f3e6243e08c8b4a056',. 'timestamp': 1491399228,. 'upload_date': '20170405',. 'uploader_id': '618566855001',. 'series': 'RPM+',. },. 'params': {. 'skip_download': True,. },. }, {. # episode. 'url': 'http://noovo.ca/videos/l-amour-est-dans-le-pre/episode-13-8',. 'info_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\normalboots.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (384)
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	4.915769508918261
Encrypted:	false
SSDEEP:	48:+uVYaaeYuRxpbHA90+bHYM6R6rD1PNjXjlkFX/m2p0gzj64eXUqv+Mf:JaeYu5bHWFHWR6rJNqtLagqt2Mf
MD5:	CA3533FAC0BCFF9E9E8FA8DAA58D08F1
SHA1:	0423000BAFAD5AA5A5118DCE23E476380616FDA0
SHA-256:	9B894D7257EA1C16E5FA71DFDFEE0737558DCB13DA4CDC7C3410186C8B12217A
SHA-512:	C60C8B3EB80B66963F56203C66A0BEABDB68C8900F9C7489986BEEE41D1CB949AC4718B3A0D6739A04C1A2F4D88B90E05B5123B8E01FEB807F789BCFC843FAC8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from .jwplatform import JWPlatformIE..from ..utils import (. unified_strdate,.)...class NormalbootsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?normalboots\.com/video/(?P<id>[0-9a-z-]*)/?$'. _TEST = {. 'url': 'http://normalboots.com/video/home-alone-games-jontron/',. 'info_dict': {. 'id': 'home-alone-games-jontron',. 'ext': 'mp4',. 'title': 'Home Alone Games - JonTron - NormalBoots',. 'description': 'Jon is late for Christmas. Typical. Thanks to: Paul Ritchey for Co-Writing/Filming: http://www.youtube.com/user/ContinueShow Michael Azzi for Christmas Intro Animation: http://michafrar.tumblr.com/ Jerrod Waters for Christmas Intro Music: http://www.youtube.com/user/xXJerryTerryXx Casey Ormond for .Tense Battle Theme.:\xa0http://www.youtube.com/Kiamet/',. 'uploader': 'JonTron',. 'upload_date': '20140

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nosvideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2480
Entropy (8bit):	4.7631702765358055
Encrypted:	false
SSDEEP:	48:+uh79JBc0hL7EpBvNZXgajXmzqyBcaFp537BAS/aFJzhQY0KBsuaPjqt46Ng:djlupBvNZXgaKBcouS8zhQdKBsuejqtE
MD5:	6B6183D0951EA29E404317F6F8B6E15E
SHA1:	67E61EE3711E25916F07E8740D194B957E9AE594
SHA-256:	573832E55C338234C76FAE1C4FF8C0293121E75FA53B3CDA1B88FC25F6E82389
SHA-512:	0976198A3D2F188DF849F1E9B7642E7DE26767CC907741051F437990A2E88C47D46601897F35AABDEBD423F213E03AFEA2A3402F00408E3DD91874597B2CE484
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. sanitized_Request,. urlencode_postdata,. xpath_text,. xpath_with_ns,.).._x = lambda p: xpath_with_ns(p, {'xspf': 'http://xspf.org/ns/0/'})...class NosVideoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nosvideo\.com/' + \. r'(?:embed/\|\?v=)(?P<id>[A-Za-z0-9]{12})/?'. _PLAYLIST_URL = 'http://nosvideo.com/xml/{xml_id:s}.xml'. _FILE_DELETED_REGEX = r'<b>File Not Found</b>'. _TEST = {. 'url': 'http://nosvideo.com/?v=mu8fle7g7rpq',. 'md5': '6124ed47130d8be3eacae635b071e6b6',. 'info_dict': {. 'id': 'mu8fle7g7rpq',. 'ext': 'mp4',. 'title': 'big_buck_bunny_480p_surround-fix.avi.mp4',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. fields = {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nova.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9455
Entropy (8bit):	4.724941506838349
Encrypted:	false
SSDEEP:	192:wCkaW3uHnLyTxV6Nc8ORvLlz/5yEuVLVlW/gbMpxXY6eMtWwET46Ng:wCFW3uHLyTxV6NJOVBVyfV5lW/lpxofY
MD5:	4537BF43CC9A99FAA4EE0DCCD72B3E99
SHA1:	55B03B737381FF779AF0ADD22F8588478877CF0A
SHA-256:	62C35F617035D2F3D38D5F16980EDF41F6BAD18A67FF5E25805DDC31DA3A3A25
SHA-512:	57E2E9895227B7B3B96A4628EA2CC1BBB6C2DA421815B636964B37DF4C647724B60EC51A594700D5069382D8E3090919DD293E2D31EAA997676E683A9915E604
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. js_to_json,. qualities,. unified_strdate,. url_or_none,.)...class NovaEmbedIE(InfoExtractor):. _VALID_URL = r'https?://media\.cms\.nova\.cz/embed/(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'https://media.cms.nova.cz/embed/8o0n0r?autoplay=1',. 'md5': 'b3834f6de5401baabf31ed57456463f7',. 'info_dict': {. 'id': '8o0n0r',. 'ext': 'mp4',. 'title': '2180. d.l',. 'thumbnail': r're:^https?://.\.jpg',. 'duration': 2578,. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. bitrates = self._parse_json(. self._search_regex(. r'(?s)(?:src\|bitrates)\s=\s({.+?})\s;', webpage, 'formats'),. video_id, transform_source=j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\novamov.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7292
Entropy (8bit):	5.073712094736978
Encrypted:	false
SSDEEP:	192:xJ6tedv2ezHVr+kjjaoxtw3ZJs2ovB0xypN+lJWEq:T6tQv2wr+kjjxWHoJi8Eq
MD5:	55FA43B24FFA088897116F1DDCFB5D1F
SHA1:	F3FCD3B82CDB8C5797BEE0ACA45D4E507BF88A8C
SHA-256:	0D63E2F6777E16C4C270D5C9B26F2C65C86E9BA0C8CB32A130B7BA66C3B5777A
SHA-512:	5D0C1C2DB929BF996E2AA193A846C832622706D1CC89F41EE5D1951C62E0D9DB86E37C36328694E16B758B06194C06D4FA0A28E95D93CF0447A3FE7ECE530462
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. ExtractorError,. NO_DEFAULT,. sanitized_Request,. urlencode_postdata,.)...class NovaMovIE(InfoExtractor):. IE_NAME = 'novamov'. IE_DESC = 'NovaMov'.. _VALID_URL_TEMPLATE = r'''(?x). http://. (?:. (?:www\.)?%(host)s/(?:file\|video\|mobile/\#/videos)/\|. (?:(?:embed\|www)\.)%(host)s/embed(?:\.php\|/)?\?(?:.*?&)?\bv=. ). (?P<id>[a-z\d]{13}). '''. _VALID_URL = _VALID_URL_TEMPLATE % {'host': r'novamov\.com'}.. _HOST = 'www.novamov.com'.. _FILE_DELETED_REGEX = r'This file no longer exists on our servers!</h2>'. _FILEKEY_REGEX = r'flashvars\.filekey=(?P<filekey>"?[^"]+"?);'. _TITLE_REGEX = r'(?s)<div class

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nowness.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	4.732353398879731
Encrypted:	false
SSDEEP:	96:xLA9X4tni7oGSaNdH9F/yCos5HD5yPk1DNC2fFAghwILOaxgGhktwIfJWcEqyZ3/:VA9X4tnnnedbyCoilyPm08SgPmT/JWcs
MD5:	415C7AF752AD219516483F3E94025C62
SHA1:	9FF34EDF26DF66EA55CB45C89FE9541AC4F58C56
SHA-256:	0DBBFAA09B643BB5E9CEFF7B8B7A9F80A595E054C963877DF6DE17E69BC828E2
SHA-512:	3A8609D568538B874FDE18523B3BF9CC76C6A813EF9C5BAA9C7A87F11C9679A17E3938B33AC98E1DDCFC8ADF6CEA8919CC84D1DA0555DFB817AA4499A81B915F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .brightcove import (. BrightcoveLegacyIE,. BrightcoveNewIE,.).from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. sanitized_Request,.)...class NownessBaseIE(InfoExtractor):. def _extract_url_result(self, post):. if post['type'] == 'video':. for media in post['media']:. if media['type'] == 'video':. video_id = media['content']. source = media['source']. if source == 'brightcove':. player_code = self._download_webpage(. 'http://www.nowness.com/iframe?id=%s' % video_id, video_id,. note='Downloading player JavaScript',. errnote='Unable to download player JavaScript'). bc_url = BrightcoveLegacyIE._extract_brightcove_url(player_code).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\noz.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3665
Entropy (8bit):	4.55776307990221
Encrypted:	false
SSDEEP:	96:0ibgO9kf8qPAfqrc87KzNlrZ22FIiVsOV8BTg6Nv86tc:db2QqkPZ22FIi2OVUTg6N0Z
MD5:	74C0014C8886C402B1457FEDC2916AA6
SHA1:	FC1688DBC96BC4D214AEB73D6A4D6E75284745BD
SHA-256:	E034E5C37B8AD994950E85DC9F154A3A35A85A1D759DDCF8434F332E7F2DEF81
SHA-512:	6922B94F92098BE21B2F5114B94A8609A4F0A64E8CE5E8E811908696790677D27D7FD63FC19594333A5DDE6CEC2FAA6C91D2289DF3FE1209B22FB900BA0B7C81
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote,. compat_xpath,.).from ..utils import (. int_or_none,. find_xpath_attr,. xpath_text,. update_url_query,.)...class NozIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?noz\.de/video/(?P<id>[0-9]+)/'. _TESTS = [{. 'url': 'http://www.noz.de/video/25151/32-Deutschland-gewinnt-Badminton-Lnderspiel-in-Melle',. 'info_dict': {. 'id': '25151',. 'ext': 'mp4',. 'duration': 215,. 'title': '3:2 - Deutschland gewinnt Badminton-L.nderspiel in Melle',. 'description': 'Vor rund 370 Zuschauern gewinnt die deutsche Badminton-Nationalmannschaft am Donnerstag ein EM-Vorbereitungsspiel gegen Frankreich in Melle. Video Moritz Frankenberg.',. 'thumbnail': r're:^http://.*\.jpg',. },. }].. def _real_extract(self, url):. video_id = self._match_i

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\npo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	28194
Entropy (8bit):	4.607071252095226
Encrypted:	false
SSDEEP:	768:Ko6+Sg5sso2o83O8Ms81B1TU8SPCC+8nXWWPhuGSOln3MUA5mOMid4VSahTQZ8ue:Ko6+Sg5sso2o83O8Ms81B1TU8SPCCnn/
MD5:	523AD9F68CD3968910C75D217EFF1B57
SHA1:	E340D0F75D481FEC74A8A6CF7FF6AC8E91602309
SHA-256:	5D3DF9AE0DD639AFA73047E46125393ED119D650808234230B6F2A66631DCD81
SHA-512:	B050E691A19796804567B357C938FD2C3F10442FDB639FF452AA9DF5ADE40A41645928FA0852AE71013FF49CC0A901455CB721883C5E552C54211814A803B4B9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. determine_ext,. ExtractorError,. fix_xml_ampersands,. int_or_none,. merge_dicts,. orderedSet,. parse_duration,. qualities,. str_or_none,. strip_jsonp,. unified_strdate,. unified_timestamp,. url_or_none,. urlencode_postdata,.)...class NPOBaseIE(InfoExtractor):. def _get_token(self, video_id):. return self._download_json(. 'http://ida.omroep.nl/app.php/auth', video_id,. note='Downloading token')['token']...class NPOIE(NPOBaseIE):. IE_NAME = 'npo'. IE_DESC = 'npo.nl, ntr.nl, omroepwnl.nl, zapp.nl and npo3.nl'. _VALID_URL = r'''(?x). (?:. npo:\|. https?://. (?:www\.)?. (?:. npo\.nl/(?:[^/]+/)*

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\npr.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4336
Entropy (8bit):	4.475244681127321
Encrypted:	false
SSDEEP:	96:abf6u6uZjiQ0YCRJloSPQwCMfOe5eceT/MQXpGmdpTw+aArOxBtXXSv7FoBTzJDl:sfg82roLECoQZGmdpTw+aArOxBtXSv7E
MD5:	D8B7690F513DEB9415AC697E094F9C27
SHA1:	2A3639D68C37976D3419CDF8097B3688A509B86E
SHA-256:	D577FF1B7AC98A0D60FBCFD2107766E076E0400F1916990A06BC3B710EF147CA
SHA-512:	FDF169D337665D79B3F1BB758583249B05A22601EE8E6BF9D00EDA8DADDDF2E4885A23BDE4E15E25B9CA20182EF403B06F2F9B60518725D80D1C5F811E7F170D
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. qualities,.)...class NprIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?npr\.org/(?:sections/[^/]+/)?\d{4}/\d{2}/\d{2}/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.npr.org/sections/allsongs/2015/10/21/449974205/new-music-from-beach-house-chairlift-cmj-discoveries-and-more',. 'info_dict': {. 'id': '449974205',. 'title': 'New Music From Beach House, Chairlift, CMJ Discoveries And More'. },. 'playlist_count': 7,. }, {. 'url': 'https://www.npr.org/sections/deceptivecadence/2015/10/09/446928052/music-from-the-shadows-ancient-armenian-hymns-and-piano-jazz',. 'info_dict': {. 'id': '446928052',. 'title': "Songs We Love: Tigran Hamasyan, 'Your Mercy is Boundless'". },. 'playlist': [{. 'md5': '12fa60cb2d3ed932f53609d4aeceabf1',. 'info_dict': {

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nrk.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	24502
Entropy (8bit):	4.663376994553551
Encrypted:	false
SSDEEP:	384:nG0eeiETgSN6NNeWyT/V6NYRlhEKvTM+HunVyM4CJ4nYp0TQnlCynlD6/fbun4ed:nG0eeiETgSN8NeWyT/V8YRzEW+/CaDEG
MD5:	2D6F6914347AD1A993CF39CCF70FBC2D
SHA1:	DF582AF8A888C1D3E3D553A27F273980C4AFB45D
SHA-256:	2C70F69EAF55DD77F24B14BA53ECD479525EDE51BE7BA8ABD45D562DDCAF8F1B
SHA-512:	A7134F3664F9D94853625594B36B0750BCAB6D9FA683DB342F8E662DA3F198F8C96C728D4B3AD3C8F98C1D8CCB8760B448998256AA87FC8C407D842FFE4F0BD7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urllib_parse_unquote,.).from ..utils import (. ExtractorError,. int_or_none,. JSON_LD_RE,. NO_DEFAULT,. parse_age_limit,. parse_duration,. try_get,.)...class NRKBaseIE(InfoExtractor):. _GEO_COUNTRIES = ['NO'].. _api_host = None.. def _real_extract(self, url):. video_id = self._match_id(url).. api_hosts = (self._api_host, ) if self._api_host else self._API_HOSTS.. for api_host in api_hosts:. data = self._download_json(. 'http://%s/mediaelement/%s' % (api_host, video_id),. video_id, 'Downloading mediaelement JSON',. fatal=api_host == api_hosts[-1]). if not data:. continue. self._api_host = api_host. break.. title = data.get('fullTitle') or data.get('mainTitle') or data['title'].

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nrl.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	4.948992507591847
Encrypted:	false
SSDEEP:	24:zi8lFvkAGXUV8V/4bLjddlXIHTnD1f/JoXjlhHw5N4+IC:+uJ2MssHd+rD1XJoXjlhHwHMC
MD5:	D1144FC6263F41B858D7DBAB6D44FC79
SHA1:	0E07D3AA1E71F84F1A2D85740195A776EBE29E07
SHA-256:	2770E2B3AF0094996CDE41CFA756345C51B57A72D3ED236147345FF2A59BF4C9
SHA-512:	63AFF4DE11DFC8EF4F18029F658D47CD45BBC94A684411B93676398B61D7DFD12A0E52446B62FC45B001ACCE319F8F058EA7CDE2C95F4FF871D6B23B0DA15B3B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class NRLTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nrl\.com/tv(/[^/]+)*/(?P<id>[^/?&#]+)'. _TEST = {. 'url': 'https://www.nrl.com/tv/news/match-highlights-titans-v-knights-862805/',. 'info_dict': {. 'id': 'YyNnFuaDE6kPJqlDhG4CGQ_w89mKTau4',. 'ext': 'mp4',. 'title': 'Match Highlights: Titans v Knights',. },. 'params': {. # m3u8 download. 'skip_download': True,. 'format': 'bestvideo',. },. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id). q_data = self._parse_json(self._search_regex(. r"(?s)q-data='({.+?})'", webpage, 'player data'), display_id). ooyala_id = q_data['videoId']. return self.url_result(. 'ooyala:' + ooyala_id, 'Ooyala', ooyala_id, q_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ntvcojp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	5.353135592160199
Encrypted:	false
SSDEEP:	48:+u8SPWpfqROrcrD1vi/+5JoXjlhHwnL9j946LsbmiLFRRQJE:gHpftwrVp5JsmL9jK6LstLhQJE
MD5:	9056D5EEB9406400D1F9055770B7A7D7
SHA1:	CB531C51FA5511B265F370B937042CA63B8B60DA
SHA-256:	CDAAFF7CFC7D5B2D5F5874B663A7E11E692E989F06E70ACEFBD89B31192ACD82
SHA-512:	85A49FC57ADA9EE097D47700E436E87365D84C4CF4B22A0F3176B926F9ECC9B8EE7619B1CD35CFBC0232F256AB17267960862D1A932B0508B001D62A14E62C53
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. js_to_json,. smuggle_url,.)...class NTVCoJpCUIE(InfoExtractor):. IE_NAME = 'cu.ntv.co.jp'. IE_DESC = 'Nippon Television Network'. _VALID_URL = r'https?://cu\.ntv\.co\.jp/(?!program)(?P<id>[^/?&#]+)'. _TEST = {. 'url': 'https://cu.ntv.co.jp/televiva-chill-gohan_181031/',. 'info_dict': {. 'id': '5978891207001',. 'ext': 'mp4',. 'title': '............. .... ....................',. 'upload_date': '20181213',. 'description': 'md5:211b52f4fd60f3e0e72b68b0c6ba52a9',. 'uploader_id': '3855502814001',. 'timestamp': 1544669941,. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/%s/defaul

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ntvde.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (326)
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	4.852301494039982
Encrypted:	false
SSDEEP:	96:QfVQtSOKZXUYj2KfqKMBHMusBymZNx5CpzIO11QBTCY8V6Ng:Q4YVqKIMuyym55WMO11gT8V6Ng
MD5:	8F36096859CC696EA1B353EF0D849EF7
SHA1:	28280EBB9223C17C44E3040A0D1022F6E7CC9BA5
SHA-256:	76DFB7C07728A6C17739D224774E0A966A9363895856207FB0A509EF620BD703
SHA-512:	277F0C17F0D27DAF0C7C82D5208341B1BFCA6E55F9B3B125A8ABC096A4231DC667E5D2AE71A412AD914A1E64988412B0DE8E82A19EFB089CE711AFA7A5423407
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. js_to_json,. parse_duration,.)...class NTVDeIE(InfoExtractor):. IE_NAME = 'n-tv.de'. _VALID_URL = r'https?://(?:www\.)?n-tv\.de/mediathek/videos/[^/?#]+/[^/?#]+-article(?P<id>.+)\.html'.. _TESTS = [{. 'url': 'http://www.n-tv.de/mediathek/videos/panorama/Schnee-und-Glaette-fuehren-zu-zahlreichen-Unfaellen-und-Staus-article14438086.html',. 'md5': '6ef2514d4b1e8e03ca24b49e2f167153',. 'info_dict': {. 'id': '14438086',. 'ext': 'mp4',. 'thumbnail': r're:^https?://.*\.jpg$',. 'title': 'Schnee und Gl.tte f.hren zu zahlreichen Unf.llen und Staus',. 'alt_title': 'Winterchaos auf deutschen Stra.en',. 'description': 'Schnee und Gl.tte sorgen deutschlandweit f.r einen chaotischen Start in die Woche: Auf den Stra.en

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ntvru.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5121
Entropy (8bit):	5.121295724424904
Encrypted:	false
SSDEEP:	96:h+fTLRaSu7aSunp6pnKSSsSHpSNQppkC1pp/vu5dpogGaaeyNyQWK5Nl9jYe/4PV:sf/RaSu7aSukpKF7cSMEn2TGaizD74PV
MD5:	D9D96C1D6ABA579BC0ADB7D7E1469ABC
SHA1:	0367879AE6260FB00385EE4008DFC405D20A5875
SHA-256:	524AB562A1A7E83DF172E26181B9F7492B3863E51EC012537E0F130B067B22C9
SHA-512:	6AFBAE05BF0D08CE7670BF9B1F2554728AE5FC21F2F154CE0CEF6E1A192625885003F0CC3AC901922E5C1EA69C0A6EC5576DFD3D13BD0906F01EBDFAB8EBDE32
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. xpath_text,. int_or_none,.)...class NTVRuIE(InfoExtractor):. IE_NAME = 'ntv.ru'. _VALID_URL = r'https?://(?:www\.)?ntv\.ru/(?:[^/]+/)(?P<id>[^/?#&]+)'.. _TESTS = [{. 'url': 'http://www.ntv.ru/novosti/863142/',. 'md5': 'ba7ea172a91cb83eb734cad18c10e723',. 'info_dict': {. 'id': '746000',. 'ext': 'mp4',. 'title': '........... ............ ...... ...... .......... . ..... ... .......',. 'description': '........... ............ ...... ...... .......... . ..... ... .......',. 'thumbnail': r're:^http://.\.jpg',. 'duration': 136,. },. }, {. 'url': 'http://www.ntv.ru/video/novosti/750370/',. 'md5': 'adecff79691b4d71e25220

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nuevo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	4.335887159154758
Encrypted:	false
SSDEEP:	24:zi8lFv/LOtlidtoHwhyChKTKhN3hU6Wmry6gfhXNTlKHl5RL/8c26Kwq:+u1yli7CmKTKhNxUCrtmrTQnt/8c26Nq
MD5:	74716AE85A0B3622B6DEC237CFF7698C
SHA1:	72C53AEB47EB5ECBB4EE7E855469D9130FB206C3
SHA-256:	CF66D880917A3D27BDE41AFE0417DFB38C9C2D4CBE2F97B75334E035D7BA2092
SHA-512:	0ECD5583F54E45B28416938D85C2541066DF9DE8AF48E575BDF6690DC4E97B3072FED03D2F009A1E1555F9F19120367C56D1591A4205A47DE6894F0C6F092A6B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor..from ..utils import (. float_or_none,. xpath_text.)...class NuevoBaseIE(InfoExtractor):. def _extract_nuevo(self, config_url, video_id, headers={}):. config = self._download_xml(. config_url, video_id, transform_source=lambda s: s.strip(),. headers=headers).. title = xpath_text(config, './title', 'title', fatal=True).strip(). video_id = xpath_text(config, './mediaid', default=video_id). thumbnail = xpath_text(config, ['./image', './thumb']). duration = float_or_none(xpath_text(config, './duration')).. formats = []. for element_name, format_id in (('file', 'sd'), ('filehd', 'hd')):. video_url = xpath_text(config, element_name). if video_url:. formats.append({. 'url': video_url,. 'format_id': format_id,. }). self._check_for

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nuvid.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2587
Entropy (8bit):	4.784928682084195
Encrypted:	false
SSDEEP:	48:PuufmaT2dGYLfEajXkPy99xUFy9CXw6XkMaHEe4X3dNLI0aO4gEBHBKTqt/8cI6u:hmaadLLfEa19nUU9X7MCEeKdNk0aO4gv
MD5:	CAF8086329AF11F681475ABD9A063CE2
SHA1:	798212796C0F64B0CF2965465475F35DFF8E08DB
SHA-256:	93103E648CFDF506570A05D0ED52896F76F7BE52C39FE3FC413E8C52BA4EA9F0
SHA-512:	B4847C4F78E8027F6DA1A80DA457C2AE821767432FDBFB3FB50D8BDEBD59F9C0E40635C837031852FEED68A8EF0ECF5A0DE46FE198B874FF103874ED6BD7841F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_duration,.)...class NuvidIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\|m)\.nuvid\.com/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://m.nuvid.com/video/1310741/',. 'md5': 'eab207b7ac4fccfb4e23c86201f11277',. 'info_dict': {. 'id': '1310741',. 'ext': 'mp4',. 'title': 'Horny babes show their awesome bodeis and',. 'duration': 129,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. page_url = 'http://m.nuvid.com/video/%s' % video_id. webpage = self._download_webpage(. page_url, video_id, 'Downloading video page'). # When dwnld_speed exists and has a value larger than the MP4 file's. # bitrate, Nuvid returns the MP4 URL. # It's unit is 100bytes/millisecond, see mobile-nuvid-min.js for t

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nytimes.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8836
Entropy (8bit):	4.775665609345363
Encrypted:	false
SSDEEP:	192:Lubjky9sz3LOlmDo0INTVFs6Nk0svs++DS2JvnetvQCWRVXvk:I59snOlmDo0INTVFs6NRwV+DS2depQC1
MD5:	600351E65AC976D4DB6CD758D78C8BB6
SHA1:	22EDB93173AFBBA21BBD46113766951F9E3477EB
SHA-256:	00A78C6338C0BA0B12A4EDB587E05F264492B47E1F0248AAFE42796EFD78E603
SHA-512:	CD27EC5E13DDCA3941BE0A4051C9078051B6791F4768EE3CC049AC5BE89BEA8E4F5A77E8C70BA4818CA2512984571F15AE222AC4067431F780D406B7923E9E22
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import hmac.import hashlib.import base64..from .common import InfoExtractor.from ..utils import (. determine_ext,. float_or_none,. int_or_none,. js_to_json,. mimetype2ext,. parse_iso8601,. remove_start,.)...class NYTimesBaseIE(InfoExtractor):. _SECRET = b'pX(2MbU2);4N{7J8)>YwKRJ+/pQ3JkiU2Q^V>mFYv6g6gYvt6v'.. def _extract_video_from_id(self, video_id):. # Authorization generation algorithm is reverse engineered from `signer` in. # http://graphics8.nytimes.com/video/vhs/vhs-2.x.min.js. path = '/svc/video/api/v3/video/' + video_id. hm = hmac.new(self._SECRET, (path + ':vhs').encode(), hashlib.sha512).hexdigest(). video_data = self._download_json('http://www.nytimes.com' + path, video_id, 'Downloading video JSON', headers={. 'Authorization': 'NYTV ' + base64.b64encode(hm.encode()).decode(),. 'X-NYTV': 'vhs',. }, fatal=False). if not vide

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\nzz.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	4.881544501053117
Encrypted:	false
SSDEEP:	24:zi8lzvxGU+fwGyrMU/PTI5UP8BAuKyq0X/hifVXjleAl+cUDAgI0+:+u1ofpyg0bIoMnvhifVXjleAQb+
MD5:	3A8CFC97B44B18BA5F247BAFD8F8A7CB
SHA1:	7D650A50BE00D44794FD3A2806F87CA6D3117C32
SHA-256:	27A0694018399B486C969B232F436827D4F7CC334672B385507347359306CFC5
SHA-512:	38216C91D9C920E57ABED042FBF9D957958459B282A467C6A98FEE64ECE2CADA00F29A1D4504B6D14B6C3E4E5A6E35C79526702BDD290896A7D126B765EB5B36
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,.)...class NZZIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?nzz\.ch/(?:[^/]+/)[^/?#]+-ld\.(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.nzz.ch/zuerich/gymizyte/gymizyte-schreiben-schueler-heute-noch-diktate-ld.9153',. 'info_dict': {. 'id': '9153',. },. 'playlist_mincount': 6,. }, {. 'url': 'https://www.nzz.ch/video/nzz-standpunkte/cvp-auf-der-suche-nach-dem-mass-der-mitte-ld.1368112',. 'info_dict': {. 'id': '1368112',. },. 'playlist_count': 1,. }].. def _real_extract(self, url):. page_id = self._match_id(url). webpage = self._download_webpage(url, page_id).. entries = []. for player_element in re.findall(. r'(<[^>]+class="kalturaPlayer[^"]"[^>]*>)', webpage):. player_params = extract_att

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\odatv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1497
Entropy (8bit):	4.897553376669123
Encrypted:	false
SSDEEP:	24:zi8lFvli3ZGuC9fw0sNiP/2dln8OAeHbcmwOvqw0tfeIXjlgtsQieGkBs+aPrPkh:+usZ1C9fein278OAe7TyRtfjXjlksQDb
MD5:	446A3D7CB74E09767658625C903FEBE9
SHA1:	3F3255ECB0855A31819675BCE4A38BC352FC28FD
SHA-256:	3DEE481CDB5AEF386EC12068E8ABE087B1C5CF2F73D14EBCC7D63FA59104EDF7
SHA-512:	3880B8D32C3966787579E31B87BD307453D5D9CBDC8E8C78C4ABBB7436750480F401C741B6E0114C23A9C162194456003F6D2C8F37B8F5D88C544AEAD01280F5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. NO_DEFAULT,. remove_start.)...class OdaTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?odatv\.com/(?:mob\|vid)_video\.php\?.*\bid=(?P<id>[^&]+)'. _TESTS = [{. 'url': 'http://odatv.com/vid_video.php?id=8E388',. 'md5': 'dc61d052f205c9bf2da3545691485154',. 'info_dict': {. 'id': '8E388',. 'ext': 'mp4',. 'title': 'Art.k Davuto.lu ile devam edemeyiz'. }. }, {. # mobile URL. 'url': 'http://odatv.com/mob_video.php?id=8E388',. 'only_matching': True,. }, {. # no video. 'url': 'http://odatv.com/mob_video.php?id=8E900',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. no_video = 'NO VIDEO!' in webpage.. video_url

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\odnoklassniki.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (552)
Category:	dropped
Size (bytes):	9238
Entropy (8bit):	4.847754913960245
Encrypted:	false
SSDEEP:	192:agOYmbcz9EXG3MpS3t10c24V/3GbW5NH6xfThm5O1OCRSCfnO1y5jMTGeP:agOYmbIEXG3wS3t10l4V/3esNH6xfThs
MD5:	D9BA8D2366338E09EB3B6BC10FB2D082
SHA1:	ABC83C2A9476E8CB84E94807CF1C1EE2CE58741D
SHA-256:	2863065928F835FC9BA7E0B75EB21C596F780F83AE7394662A3DA822AD9F1D74
SHA-512:	2AE43E759F2500264FC93F339A53425648AA28B87F2665180497A5CF38BD1795BEF711A7DDD06C61F90D93200F15488983C7C45F146425EA3DC3DC452E3287D4
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_etree_fromstring,. compat_parse_qs,. compat_urllib_parse_unquote,. compat_urllib_parse_urlparse,.).from ..utils import (. ExtractorError,. unified_strdate,. int_or_none,. qualities,. unescapeHTML,. urlencode_postdata,.)...class OdnoklassnikiIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:(?:www\|m\|mobile)\.)?. (?:odnoklassniki\|ok)\.ru/. (?:. video(?:embed)?/\|. web-api/video/moviePlayer/\|. live/\|. dk\?.*?st\.mvId=. ). (?P<id>[\d-]+). '''. _TESTS = [{. # metadata in JSON. 'url': 'http://ok.ru/video/20079905452',. 'md5': '0b62089b479e06681abaaca9d204f152',. 'info_dict': {. '

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\oktoberfesttv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1504
Entropy (8bit):	4.834794435781765
Encrypted:	false
SSDEEP:	24:zi8lFvpGuyJwFRKFn/MFFdlDTwQCYXHNqaeIXjlgtdHXjK0BmZ1UBNyq7leBoy8o:+uv1wNF/MFFn8XYXNqajXjlkd3jbBiuC
MD5:	64CC8CE5A6824791203E19330E058AFF
SHA1:	B1C97ECB396E7ADAECC1ABB6782C29AE8D2213A5
SHA-256:	7B6046FE43326DDFA0F1AE4F7509A61865AEF6022EA10AD4F32B52C26099945D
SHA-512:	536999FC23335BD09C95A236A208C506BD8236D40A0F7CDBF0B670E5B750EF4FE9C1750DAC8FCF7E5F207E471A630C8E97B1F91644C2719E9BBB13BFB69441D3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class OktoberfestTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?oktoberfest-tv\.de/[^/]+/[^/]+/video/(?P<id>[^/?#]+)'.. _TEST = {. 'url': 'http://www.oktoberfest-tv.de/de/kameras/video/hb-zelt',. 'info_dict': {. 'id': 'hb-zelt',. 'ext': 'mp4',. 'title': 're:^Live-Kamera: Hofbr.uzelt [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'thumbnail': r're:^https?://.\.jpg$',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. title = self._live_title(self._html_search_regex(. r'<h1><strong>.?</strong>(.?)</h1>', webpage, 'title')).. clip = self._search_regex(. r"clip:\s\{\surl:\s'([^']+)'", webpage,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\once.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	4.833648017759881
Encrypted:	false
SSDEEP:	48:+u2DEQE3EvLv2Ekge+DXQFIpqGFpU/LxPdbB7n0BOGCznNhp5JJpChpsv:CgQEN+DXZdDU/1Pdt0BJwN3HfC3sv
MD5:	88EAB85DB418E1921A0B8C1D71561390
SHA1:	8E4E752CA5F77585BF5B6CA7715A6000EB045ECA
SHA-256:	B4C773022240C2D75BE9514B81146A6BFE2621F7B9F9850D7802E6C9247C3384
SHA-512:	014AC247260BD9710B6FEE83C9EBEC165B99BF6D30D04C8E6A1BB16CA6501A8608F97ACF805AAEF96A722D1672D58F529C6C1B99C29125563FEE4F8FD30CE047
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class OnceIE(InfoExtractor):. _VALID_URL = r'https?://.+?\.unicornmedia\.com/now/(?:ads/vmap/)?[^/]+/[^/]+/(?P<domain_id>[^/]+)/(?P<application_id>[^/]+)/(?:[^/]+/)?(?P<media_item_id>[^/]+)/content\.(?:once\|m3u8\|mp4)'. ADAPTIVE_URL_TEMPLATE = 'http://once.unicornmedia.com/now/master/playlist/%s/%s/%s/content.m3u8'. PROGRESSIVE_URL_TEMPLATE = 'http://once.unicornmedia.com/now/media/progressive/%s/%s/%s/%s/content.mp4'.. def _extract_once_formats(self, url, http_formats_preference=None):. domain_id, application_id, media_item_id = re.match(. OnceIE._VALID_URL, url).groups(). formats = self._extract_m3u8_formats(. self.ADAPTIVE_URL_TEMPLATE % (. domain_id, application_id, media_item_id),. media_item_id, 'mp4', m3u8_id='hls', fatal=False). progressive_formats = []. for adaptive_format in formats:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ondemandkorea.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	4.701210640472291
Encrypted:	false
SSDEEP:	48:+u41Fy5us7SXd/9ajXjlkvppkGcLuFfFQVSeuXHMnJSHKmzvq:E1Fgus7SXd/9aqTk9u95+aKmzS
MD5:	298A62204B742AC1EB2CDCE11179AAA7
SHA1:	1E9F0E6A57E7B56A8B319814D96A98C8D9D97749
SHA-256:	493D551E91617FD2352031E53F43076FE025AE2BD6F43791956B2CFF64901AC6
SHA-512:	4210400F8A971C808DF0DA474CD112F61D914BA22CB88FB82A288D3277F5E45EAF4AF6E774C8A8D6D20F473CC3AEBB07B3C21CB9BC87C2C732C64EFBD14ED0B8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. js_to_json,.)...class OnDemandKoreaIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ondemandkorea\.com/(?P<id>[^/]+)\.html'. _GEO_COUNTRIES = ['US', 'CA']. _TEST = {. 'url': 'http://www.ondemandkorea.com/ask-us-anything-e43.html',. 'info_dict': {. 'id': 'ask-us-anything-e43',. 'ext': 'mp4',. 'title': 'Ask Us Anything : E43',. 'thumbnail': r're:^https?://.*\.jpg$',. },. 'params': {. 'skip_download': 'm3u8 download'. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id, fatal=False).. if not webpage:. # Page sometimes returns captcha page with HTTP 403. raise ExtractorError(. 'Unable to access page. You may have been blocked.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\onet.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9342
Entropy (8bit):	4.773019689144555
Encrypted:	false
SSDEEP:	192:H6DnAw6iAjaxe6sFKjoFOxTDh6N6COb+0mZbuFz/dnMPHk82yU99f3KtJL7P3LOX:inn6iAjh6sFKjoFOxTDh6N6NbTm4Fz/J
MD5:	4B39FA8BE38C2BC26D9B553509B3D6B4
SHA1:	FD12E284197FBD7B6A34AA31FAF033265F86FD1E
SHA-256:	61D5365D6B7B261BFF45308A637C89E4A7A8A53079CBDB3B40AF8D834A30E821
SHA-512:	25A420FE64877EC8837797CDFB7758F4F240BAA6A3FA066A136AE2EB9AD18CADE9369AAC50ECC771D49496F5F0F3F71CE202DA9E77F050BDD36EEE1360612EBE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. float_or_none,. get_element_by_class,. int_or_none,. js_to_json,. NO_DEFAULT,. parse_iso8601,. remove_start,. strip_or_none,. url_basename,.)...class OnetBaseIE(InfoExtractor):. def _search_mvp_id(self, webpage):. return self._search_regex(. r'id=(["\'])mvp:(?P<id>.+?)\1', webpage, 'mvp id', group='id').. def _extract_from_id(self, video_id, webpage=None):. response = self._download_json(. 'http://qi.ckm.onetapi.pl/', video_id,. query={. 'body[id]': video_id,. 'body[jsonrpc]': '2.0',. 'body[method]': 'get_asset_detail',. 'body[params][ID_Publikacji]': video_id,. 'body[params][Service]': 'www.onet.pl',. 'content-type': 'application/jsonp',. 'x-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\onionstudios.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2794
Entropy (8bit):	4.650703893966094
Encrypted:	false
SSDEEP:	48:+uvWOzx1YyrfsnZzjzX3elXAt8c3WBYaRnjXoBlN7eNdPLOt4PLW9iXncBTN/DI4:KOzx1YyTsnZzfXOpm8c3WBY0nkN7cdPW
MD5:	51C8ADF794FD215FD6BCBB874DD15BCE
SHA1:	C4BCAD008E8B50D3C448981B10023680B1329CDD
SHA-256:	FD65904D7148512F74DEC6C5845B1DBB0CCA498B1753EF53366B43CDB3A91D04
SHA-512:	D67194EFCC12F62B814808321BE875BBE708FAB73DACFCCA4CA5F84B9736AE339E2744B24F0DDC9751CDB4D174DCEBB6DDB3A686922632A62D9FFA174DD71DA5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. float_or_none,. mimetype2ext,.)...class OnionStudiosIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?onionstudios\.com/(?:video(?:s/[^/]+-\|/)\|embed\?.\bid=)(?P<id>\d+)(?!-)'.. _TESTS = [{. 'url': 'http://www.onionstudios.com/videos/hannibal-charges-forward-stops-for-a-cocktail-2937',. 'md5': '719d1f8c32094b8c33902c17bcae5e34',. 'info_dict': {. 'id': '2937',. 'ext': 'mp4',. 'title': 'Hannibal charges forward, stops for a cocktail',. 'thumbnail': r're:^https?://.\.jpg$',. 'uploader': 'The A.V. Club',. 'uploader_id': 'the-av-club',. },. }, {. 'url': 'http://www.onionstudios.com/embed?id=2855&autoplay=true',. 'only_matching': True,. }, {. 'url': 'http://www.onionstudios.com/video/6139.json',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ooyala.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable, with very long lines (334)
Category:	dropped
Size (bytes):	8753
Entropy (8bit):	4.654158190222714
Encrypted:	false
SSDEEP:	192:obGSBvMwJTbOwiyToLfje4rTKd6NnW3Fwvdo4dWF1WUYIqErJvAkQEkpE:PSBvMwxOwiyToLfje4rTW6NnmFkdo4dS
MD5:	15C6C0024E40A62BB1655675080ED082
SHA1:	097801B10049D49BBCF11CDE06D301A579C77EC0
SHA-256:	53D23C4C7AA1B1B57380ADBF76A8D74BED9B8DACF5FADF51379D65E4E0C79B7A
SHA-512:	2902A05D56B08F13C466AB30B2474C464161762C245CD6C652550DF6C2C000BE2E680B839955E737E3A63D2D2B85DB10DE7423D23A73CB72E437F43F2FBE92A6
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_str,. compat_urllib_parse_urlencode,.).from ..utils import (. determine_ext,. ExtractorError,. float_or_none,. int_or_none,. try_get,. unsmuggle_url,.)...class OoyalaBaseIE(InfoExtractor):. _PLAYER_BASE = 'http://player.ooyala.com/'. _CONTENT_TREE_BASE = _PLAYER_BASE + 'player_api/v1/content_tree/'. _AUTHORIZATION_URL_TEMPLATE = _PLAYER_BASE + 'sas/player_api/v2/authorization/embed_code/%s/%s?'.. def _extract(self, content_tree_url, video_id, domain='example.org', supportedformats=None, embed_token=None):. content_tree = self._download_json(content_tree_url, video_id)['content_tree']. metadata = content_tree[list(content_tree)[0]]. embed_code = metadata['embed_code']. pcode = metadata.get('asset_pcode') or embed_code. title = metadata['title'].. auth_data = self._download_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\openload.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16832
Entropy (8bit):	4.783652033629825
Encrypted:	false
SSDEEP:	384:SAu9oLg9G3W7nzzJg7ielSgqtHjxUjVoLq3nVXHHmIm8XKam7NXpJZrWpJycNulK:WzJ5bcNulbrch5c4f
MD5:	596AEBD47E9BC0FAEA7DBF155420B55F
SHA1:	8506544EF89203156C556D27133F04D36DF9F07C
SHA-256:	620CDB128ADDB5CFA81D747B669E74CF77C268749C4EF5A86157CCF4E7E64D22
SHA-512:	FBB916D5D0014881AC1FDAC0AB729DED2629B570F51D6CA84810125AF68D256CBDC6E1DFEE4683C32BF2D5435CBF935A9B9DF6E45BB00CD15D282E045932B3C7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import os.import re.import subprocess.import tempfile..from .common import InfoExtractor.from ..compat import (. compat_urlparse,. compat_kwargs,.).from ..utils import (. check_executable,. determine_ext,. encodeArgument,. ExtractorError,. get_element_by_id,. get_exe_version,. is_outdated_version,. std_headers,.)...def cookie_to_dict(cookie):. cookie_dict = {. 'name': cookie.name,. 'value': cookie.value,. }. if cookie.port_specified:. cookie_dict['port'] = cookie.port. if cookie.domain_specified:. cookie_dict['domain'] = cookie.domain. if cookie.path_specified:. cookie_dict['path'] = cookie.path. if cookie.expires is not None:. cookie_dict['expires'] = cookie.expires. if cookie.secure is not None:. cookie_dict['secure'] = cookie.secure. if cookie.discard is not None:. cookie_dict['discard'] = cookie.discard.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ora.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3226
Entropy (8bit):	4.8824676192408285
Encrypted:	false
SSDEEP:	48:+uJoBXfC0/s/n+xvgZ3tfJoXjlhpBofrBzAFqG7/3BHeu3iftE6iBTixBfoipRzF:eNi/n+xvK9fJswqFdw3iBTwywRHN6Ng
MD5:	DCDC0543DDD500633D5A9750AC0C4967
SHA1:	46E5482DAD006CAB547AF82295FFAD8D39FA8F06
SHA-256:	965111CCA838495549951C38E1A12BE66BD33D6139CFB1C701E4583B185C5CE1
SHA-512:	C2D6677E1D01356DC0649816DA77E4AB4A2BB9FFC1E9138C9402D5F0641983FAB9A2AA96852729D48800E4F4E5930CD3BB25897452054DF4BA24E0559714E7BF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. get_element_by_attribute,. qualities,. unescapeHTML,.)...class OraTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:ora\.tv\|unsafespeech\.com)/([^/]+/)*(?P<id>[^/\?#]+)'. _TESTS = [{. 'url': 'https://www.ora.tv/larrykingnow/2015/12/16/vine-youtube-stars-zach-king-king-bach-on-their-viral-videos-0_36jupg6090pq',. 'md5': 'fa33717591c631ec93b04b0e330df786',. 'info_dict': {. 'id': '50178',. 'ext': 'mp4',. 'title': 'Vine & YouTube Stars Zach King & King Bach On Their Viral Videos!',. 'description': 'md5:ebbc5b1424dd5dba7be7538148287ac1',. }. }, {. 'url': 'http://www.unsafespeech.com/video/2016/5/10/student-self-censorship-and-the-thought-police-on-university-campuses-0_6622bnkppw4d',. 'only_matching': True,. }].. de

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\orf.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	15609
Entropy (8bit):	4.487260362491979
Encrypted:	false
SSDEEP:	384:O74ycqtX7OO2Ai2BiEutTQyTt6NzXGEghp8h8yLoirMOrpTgV6NYzH8pP8SLoibv:QVOO2Ai2BiEutTQyTt898yLoirMOrpTl
MD5:	E76D027E62B626D5BE8B5E099986719C
SHA1:	7307708D5C5E8D9B9210283570FF8CFBAEA988CB
SHA-256:	A3615A70AF300224D566F6E0A84DA166BAC069EB62DEF78A442F3FEA922AF820
SHA-512:	7C0BB1DA3B3189DD1B4549F575E08E7CADBD557F35C7B6D092C1C321C6949F73455D2D97460241BA40E1BFFDE04498E66BDAF18431972947C60F688B54ED89FC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. float_or_none,. HEADRequest,. int_or_none,. orderedSet,. remove_end,. strip_jsonp,. unescapeHTML,. unified_strdate,. url_or_none,.)...class ORFTVthekIE(InfoExtractor):. IE_NAME = 'orf:tvthek'. IE_DESC = 'ORF TVthek'. _VALID_URL = r'https?://tvthek\.orf\.at/(?:[^/]+/)+(?P<id>\d+)'.. _TESTS = [{. 'url': 'http://tvthek.orf.at/program/Aufgetischt/2745173/Aufgetischt-Mit-der-Steirischen-Tafelrunde/8891389',. 'playlist': [{. 'md5': '2942210346ed779588f428a92db88712',. 'info_dict': {. 'id': '8896777',. 'ext': 'mp4',. 'title': 'Aufgetischt: Mit der Steirischen Tafelrunde',. 'description': 'md5:c1272f0245537812d4e36419c207b67d',. 'duration': 2668,. 'upload_dat

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\outsidetv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	995
Entropy (8bit):	5.177264353530179
Encrypted:	false
SSDEEP:	24:zi8lFvsGu1xCfwsb8rhR1/pdlFmtlVhD/teZSHPw983tfWXjron:+uG11xCf1Q9jpRmtDR/tZvf3tfWXjEn
MD5:	B1A97906F0A4E65F2DC573ACEAC1E4D6
SHA1:	FDA51898EFD183F4B948835DCAAE35EB3C4A4FC2
SHA-256:	11163A8C1260380D6FB38758C16CD9BC6A9D5A1D9442230C592A3C569102C2CF
SHA-512:	365CADB80517A493AD8E482D6B99826F4B9C2AE439C4B24728A557B20FFEEE393EED903889630608D4B4E11A478E5F1DC0BABD496D655D30D22751A6EB0F61BA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class OutsideTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?outsidetv\.com/(?:[^/]+/)*?play/[a-zA-Z0-9]{8}/\d+/\d+/(?P<id>[a-zA-Z0-9]{8})'. _TESTS = [{. 'url': 'http://www.outsidetv.com/category/snow/play/ZjQYboH6/1/10/Hdg0jukV/4',. 'md5': '192d968fedc10b2f70ec31865ffba0da',. 'info_dict': {. 'id': 'Hdg0jukV',. 'ext': 'mp4',. 'title': 'Home - Jackson Ep 1 \| Arbor Snowboards',. 'description': 'md5:41a12e94f3db3ca253b04bb1e8d8f4cd',. 'upload_date': '20181225',. 'timestamp': 1545742800,. }. }, {. 'url': 'http://www.outsidetv.com/home/play/ZjQYboH6/1/10/Hdg0jukV/4',. 'only_matching': True,. }].. def _real_extract(self, url):. jw_media_id = self._match_id(url). return self.url_result(. 'jwplatform:' + jw_media_id, 'JWPlatform', jw_media_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\packtpub.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6327
Entropy (8bit):	4.801049665608095
Encrypted:	false
SSDEEP:	96:qx5Hdg0h+P0QM0qMBlJlJRpOBOAAjrJojaCgjtIPT2WXMJTmnj2rmTccH9:qnHdt3Q/9DkOAAj2jJx8QnsRcd
MD5:	1846046168EB6457261ED813C345AAF9
SHA1:	B4AF91D5EE0475BB10896B56B252516F210EA026
SHA-256:	ADE12147DEA28AD7827C2B00F8C7BCF62E4AE7D08ABE324B9481B611DFCA191A
SHA-512:	F1E73B178AC45A8EA51D1736D7D5A4397328344FE431C688E1646CC0D42F167FF02C8AA3B23C7F135542A0AB4EA60476317BA6518FF2A1D9690208938C22FBE8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import (. # compat_str,. compat_HTTPError,.).from ..utils import (. clean_html,. ExtractorError,. # remove_end,. str_or_none,. strip_or_none,. unified_timestamp,. # urljoin,.)...class PacktPubBaseIE(InfoExtractor):. # _PACKT_BASE = 'https://www.packtpub.com'. _STATIC_PRODUCTS_BASE = 'https://static.packt-cdn.com/products/'...class PacktPubIE(PacktPubBaseIE):. _VALID_URL = r'https?://(?:(?:www\.)?packtpub\.com/mapt\|subscription\.packtpub\.com)/video/[^/]+/(?P<course_id>\d+)/(?P<chapter_id>[^/]+)/(?P<id>[^/]+)(?:/(?P<display_id>[^/?&#]+))?'.. _TESTS = [{. 'url': 'https://www.packtpub.com/mapt/video/web-development/9781787122215/20528/20530/Project+Intro',. 'md5': '1e74bd6cfd45d7d07666f4684ef58f70',. 'info_dict': {. 'id': '20530',. 'ext': 'mp4',. 'title': 'Project Intro',. 'th

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pandatv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	4.5240925737168105
Encrypted:	false
SSDEEP:	96:Pn7y+PFuPfBRL8oDQLnH15RybnvZXEoetYAIIBTd6Nl:jZ0nBV8UQLnH15RQ3IYAIITd6Nl
MD5:	DAD576C0AE180C07C33C3A43E598C548
SHA1:	5861080A4BE91F620A18AAF4267209F50518B70E
SHA-256:	4B50A7EA4DE69EBBF2BDCBBD4B2FB847F28DCDCBDF255A034F013449F786DF15
SHA-512:	33B15BC16A005DEB8E8159BFB9691BFC2A1AFF3FCB0F9305A7CE10EC30405C1D64789A840B7B342F4953C07C3D248D5F0692649971F0CA05451140701D1EBC0E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. qualities,.)...class PandaTVIE(InfoExtractor):. IE_DESC = '..TV'. _VALID_URL = r'https?://(?:www\.)?panda\.tv/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.panda.tv/66666',. 'info_dict': {. 'id': '66666',. 'title': 're:.+',. 'uploader': '...',. 'ext': 'flv',. 'is_live': True,. },. 'params': {. 'skip_download': True,. },. 'skip': 'Live stream is offline',. }, {. 'url': 'https://www.panda.tv/66666',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. config = self._download_json(. 'https://www.panda.tv/api_room_v2?roomid=%s' % video_id, video_id).. error_code = config.get('errno', 0). if error_code != 0:. raise E

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pandoratv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4801
Entropy (8bit):	4.597570238126891
Encrypted:	false
SSDEEP:	96:fZUUeBJgvXjzFL2vonCqXjwVp7Hu23UfrCwjafpZ4xHWoBTdLI91pb9w6Ng:2XpvoCvi23CrCwja3gWoTdLl6Ng
MD5:	B0FA1810480F46A300FD5F377AA2D6CB
SHA1:	D167C58F03D9E008D187860ABC6C7A20574D7268
SHA-256:	3EDE93C9C853743280F9E035069F4549C18AF35BCC5958B82782AD68B5E1F328
SHA-512:	F2A8C45EF319763429FAFF59469CD67C1D9471B74D4299A621B308FD3E7086D82A1F52383DA40A14777D1891A8249FA166334144331A087AEB12E43E6F9C3B80
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. float_or_none,. parse_duration,. str_to_int,. urlencode_postdata,.)...class PandoraTVIE(InfoExtractor):. IE_NAME = 'pandora.tv'. IE_DESC = '...TV'. _VALID_URL = r'''(?x). https?://. (?:. (?:www\.)?pandora\.tv/view/(?P<user_id>[^/]+)/(?P<id>\d+)\| # new format. (?:.+?\.)?channel\.pandora\.tv/channel/video\.ptv\?\| # old format. m\.pandora\.tv/?\? # mobile. ). '''. _TESTS = [{. 'url': 'http://jp.channel.pandora.tv/channel/video.ptv?c1=&prgid=53294230&ch_userid=mikakim&ref=main&lot=cate_01_2',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\parliamentliveuk.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.947523952925114
Encrypted:	false
SSDEEP:	48:Puz2f2xrTwwdcfidhol153tfjXjl3ZDUwnR87SI/B8T3:O2exHuidhq159fbDDRISIaT3
MD5:	89C3F0A2DC61F86D5B98116B9F8B2E8E
SHA1:	01800362E2D486585C41EB8B5D5A98D65C313D11
SHA-256:	1D1890F2C48961DB29D6C705E6264528A4A7AF2B9D64CEA286785EB1A42C3BC0
SHA-512:	F9B67BBF507A0BB09D16CA63CC841F85EE326684219E1C411A2D199511EBECF5185D96A711AD9516F522525B0FAE01C32BE7919EF15E9048BE7B28CA848FD182
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class ParliamentLiveUKIE(InfoExtractor):. IE_NAME = 'parliamentlive.tv'. IE_DESC = 'UK parliament videos'. _VALID_URL = r'(?i)https?://(?:www\.)?parliamentlive\.tv/Event/Index/(?P<id>[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12})'.. _TESTS = [{. 'url': 'http://parliamentlive.tv/Event/Index/c1e9d44d-fd6c-4263-b50f-97ed26cc998b',. 'info_dict': {. 'id': '1_af9nv9ym',. 'ext': 'mp4',. 'title': 'Home Affairs Committee',. 'uploader_id': 'FFMPEG-01',. 'timestamp': 1422696664,. 'upload_date': '20150131',. },. }, {. 'url': 'http://parliamentlive.tv/event/index/3f24936f-130f-40bf-9a5d-b3d6479da6a4',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. 'http://vodplayer.parliamentlive.tv/?mid='

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\patreon.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4651
Entropy (8bit):	4.551468860224716
Encrypted:	false
SSDEEP:	96:TOjuso9Tl7tdwGT1+iCTCidveZ2d+2dkBFGMSQ7bwIpgDq6:ixk/NZalv+I+2wjSpBq6
MD5:	B25E0666BB2F998775F5F8731E322920
SHA1:	E456F7AD30C0E1072D05013FC15F78EA596C04D1
SHA-256:	BA898D1591CDB12F2DF23AF5F53C1A1BC9B30CA6848B9097F96279A218F4D16B
SHA-512:	43BDD2AAE568584BD9537FE34A697BF0E4F395E8DD24A7DEBE71E652BD47ECDE204BBC052A1360BBF79D696C49B44F12004396EF3D78F127E2A65C0E65C0A010
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. int_or_none,. parse_iso8601,.)...class PatreonIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?patreon\.com/(?:creation\?hid=\|posts/(?:[\w-]+-)?)(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.patreon.com/creation?hid=743933',. 'md5': 'e25505eec1053a6e6813b8ed369875cc',. 'info_dict': {. 'id': '743933',. 'ext': 'mp3',. 'title': 'Episode 166: David Smalley of Dogma Debate',. 'description': 'md5:713b08b772cd6271b9f3906683cfacdf',. 'uploader': 'Cognitive Dissonance Podcast',. 'thumbnail': 're:^https?://.*$',. 'timestamp': 1406473987,. 'upload_date': '20140727',. },. }, {. 'url': 'http://www.patreon.com/creation?hid=754133',. 'md5': '3eb09345bf44bf60451b8b0b81759d0a',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pbs.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	36626
Entropy (8bit):	4.864156155725045
Encrypted:	false
SSDEEP:	768:jbF+G/imHQDTnEhO4FwC/wUMffXuknfj2Of2TIN9wVm5yTv8m:jb0GmDbEhOGT/SXbnfj2Of2TIN9wVm56
MD5:	4148F49C0CF90F62F0E704F3528A4A4F
SHA1:	F9D6DDE736D20CDFD14646E6D042CA1386852CC6
SHA-256:	CC6B126FAA35391BD38C08F6E2EDAA925CEA8019B59F5D782CD12E4DE4509B11
SHA-512:	38FC530758370F4B3E3519D3F3903DF1DBE0C1CE49BEB76466F4F08EA01238A483F6D9C085BB723C1823564AD4C118419F43F708C83335A8A69AE9D14CCD9259
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. determine_ext,. int_or_none,. float_or_none,. js_to_json,. orderedSet,. strip_jsonp,. strip_or_none,. unified_strdate,. url_or_none,. US_RATINGS,.)...class PBSIE(InfoExtractor):. _STATIONS = (. (r'(?:video\|www\|player)\.pbs\.org', 'PBS: Public Broadcasting Service'), # http://www.pbs.org/. (r'video\.aptv\.org', 'APT - Alabama Public Television (WBIQ)'), # http://aptv.org/. (r'video\.gpb\.org', 'GPB/Georgia Public Broadcasting (WGTV)'), # http://www.gpb.org/. (r'video\.mpbonline\.org', 'Mississippi Public Broadcasting (WMPN)'), # http://www.mpbonline.org. (r'video\.wnpt\.org', 'Nashville Public Television (WNPT)'), # http://www.wnpt.org. (r'video\.wfsu\.org', 'WFSU-TV (WFSU)'), # http://wfsu.org/. (r'video\.wsre\.org', 'WSRE (W

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pearvideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2103
Entropy (8bit):	5.0066775042950455
Encrypted:	false
SSDEEP:	48:+upnZDdfJVzB83LjdajXhktaOYNkYCFUJs+BTXB7rNYWPB1xEW8Ek4b6Ng:VnZDN/t83Ljdaat9MkXmG+BTlxJHPAOL
MD5:	D39B06D302C07FE41408AC2718F475DB
SHA1:	A7AE288A7DD72BCD7CB6682D056958DDA9A42D23
SHA-256:	9001C134D6C037CDC16DF0334537FD78721EDF3D71C9E27C552E952B339ED6B5
SHA-512:	6D2E4DD0723ED4E134BDDA628629B0AFECAFE5E662814E322DB6D6684EDC6B50C09C30117467B35D8D83DA6703785896040B405C8E57A283666129CEB55C8DC9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. qualities,. unified_timestamp,.)...class PearVideoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pearvideo\.com/video_(?P<id>\d+)'. _TEST = {. 'url': 'http://www.pearvideo.com/video_1076290',. 'info_dict': {. 'id': '1076290',. 'ext': 'mp4',. 'title': '................',. 'description': 'md5:01d576b747de71be0ee85eb7cac25f9d',. 'timestamp': 1494275280,. 'upload_date': '20170508',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. quality = qualities(. ('ldflv', 'ld', 'sdflv', 'sd', 'hdflv', 'hd', 'src')).. formats = [{. 'url': mobj.group('url'),. 'format_id': mobj.group('id'),. 'qual

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\peertube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10576
Entropy (8bit):	4.077770528612054
Encrypted:	false
SSDEEP:	192:lS1kx5Ei63vs2FLtnhWKqtIXl5l/jJayT2oluNfJ6Ng:lr5Eios2FLLFmCjJayTNlC6Ng
MD5:	A0DF5F55D8A28D54DDEBFC0BEB278629
SHA1:	B6CA52041F55BACFED2C2DB169CD52B311AA69AF
SHA-256:	6A0D64FCF2F8A7D25928C57B6D1FE73AB1AC1BFBDEA20DC19F8DFDFB9BAC8ACD
SHA-512:	7AF38B515530B86431E2B474836A926304348D3E4B020EDD03171201242BC5F3D775C48AFA82B74946505FE3EA3398F88524FCF570E9C9E91353A4C6E9009572
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_resolution,. try_get,. unified_timestamp,. url_or_none,. urljoin,.)...class PeerTubeIE(InfoExtractor):. _INSTANCES_RE = r'''(?:. # Taken from https://instances.joinpeertube.org/instances. tube\.openalgeria\.org\|. peertube\.pointsecu\.fr\|. peertube\.nogafa\.org\|. peertube\.pl\|. megatube\.lilomoino\.fr\|. peertube\.tamanoir\.foucry\.net\|. peertube\.inapurna\.org\|. peertube\.netzspielplatz\.de\|. video\.deadsuperhero\.com\|. peertube\.devosi\.org\|. peertube\.1312\.media\|.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\people.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	4.921142715908385
Encrypted:	false
SSDEEP:	24:zi8lFviLG5mAew1nMT/BODdlnDnIafEp2/nbZ6tbRHNPyW0e3NtXsy:+u0ryMLBc7DnI/I/ARxNPybYTXsy
MD5:	1CC4929A0D05FC12D8F8772CA5F1017A
SHA1:	FACEABFA95633C7C3597127755618C33CF71DAAB
SHA-256:	2B050B22FA5043AC750E934F8C611F676565656CC095122358E816E2E7F00214
SHA-512:	8F782F9492F30F26EB4D732A6A9BADD61B5D6E1E5321B8B4ED77E137A8352F7D26C26D94DC175790BC750233A644225649F689E529A7257B8F64A34BD2906696
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class PeopleIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?people\.com/people/videos/0,,(?P<id>\d+),00\.html'.. _TEST = {. 'url': 'http://www.people.com/people/videos/0,,20995451,00.html',. 'info_dict': {. 'id': 'ref:20995451',. 'ext': 'mp4',. 'title': 'Astronaut Love Triangle Victim Speaks Out: .The Crime in 2007 Hasn.t Defined Us.',. 'description': 'Colleen Shipman speaks to PEOPLE for the first time about life after the attack',. 'thumbnail': r're:^https?://.*\.jpg',. 'duration': 246.318,. 'timestamp': 1458720585,. 'upload_date': '20160323',. 'uploader_id': '416418724',. },. 'params': {. 'skip_download': True,. },. 'add_ie': ['BrightcoveNew'],. }.. def _real_extract(self, url):. return self.url_result(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\performgroup.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3355
Entropy (8bit):	4.737622281259504
Encrypted:	false
SSDEEP:	96:VJmwASbdaVN8VStdv0s4CGOLMioy90nnd7BTKsWxi1gNt6Ng:VJUoQ84dh4CGOLMioS0n/TKn76Ng
MD5:	55083DBC4E461DBC2DA344D1EB907748
SHA1:	3308F6CF51EE7376927925C821FC22498AFDDB25
SHA-256:	EC369749FE74228AC201040DC244705179135749D02370076D114F7CFFD03451
SHA-512:	4E438155AA039E52C6A63256A278EE3194B1BFD69654932A68C43A666B6705F77952F42701A4E051E686291182E4596A8842C13FA4F73323383997643D4D9961
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class PerformGroupIE(InfoExtractor):. _VALID_URL = r'https?://player\.performgroup\.com/eplayer(?:/eplayer\.html\|\.js)#/?(?P<id>[0-9a-f]{26})\.(?P<auth_token>[0-9a-z]{26})'. _TESTS = [{. # http://www.faz.net/aktuell/sport/fussball/wm-2018-playoffs-schweiz-besiegt-nordirland-1-0-15286104.html. 'url': 'http://player.performgroup.com/eplayer/eplayer.html#d478c41c5d192f56b9aa859de8.1w4crrej5w14e1ed4s1ce4ykab',. 'md5': '259cb03d142e2e52471e8837ecacb29f',. 'info_dict': {. 'id': 'xgrwobuzumes1lwjxtcdpwgxd',. 'ext': 'mp4',. 'title': 'Liga MX: Keine Einsicht nach Horrorfoul',. 'description': 'md5:7cd3b459c82725b021e046ab10bf1c5b',. 'timestamp': 1511533477,. 'upload_date': '20171124',. }. }].. def _call_api(self, service, auth_token, content_id, refer

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\periscope.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6063
Entropy (8bit):	4.7962279844468085
Encrypted:	false
SSDEEP:	96:VsbunJejU/Sbqh0D9riP8c3qnF39iEcEQMlVvEElXReNmY5ZydsEDrOzifspnBTF:CyJejuSD9uWz4ydsEDrOzcspBTM6NkP8
MD5:	CC496127B867CD545C757E491F312275
SHA1:	2A28DF772AFB1B55040147F48064F567AD9304DF
SHA-256:	0F19FF4AA87CFE3BE8C38BC9639E4C11EC6CB7FEC8D6947A6C13899E665A585E
SHA-512:	7ABDBA0E0A19C9D96340BF5D1628F5AEC78018CC535BA77BD7A7974AF387A0475723930B48DE1771CCE4043611213217FEF402B9BAEFF2EB4CFE78F316163787
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,. unescapeHTML,.)...class PeriscopeBaseIE(InfoExtractor):. def _call_api(self, method, query, item_id):. return self._download_json(. 'https://api.periscope.tv/api/v2/%s' % method,. item_id, query=query)...class PeriscopeIE(PeriscopeBaseIE):. IE_DESC = 'Periscope'. IE_NAME = 'periscope'. _VALID_URL = r'https?://(?:www\.)?(?:periscope\|pscp)\.tv/[^/]+/(?P<id>[^/?#]+)'. # Alive example URLs can be found here http://onperiscope.com/. _TESTS = [{. 'url': 'https://www.periscope.tv/w/aJUQnjY3MjA3ODF8NTYxMDIyMDl2zCg2pECBgwTqRpQuQD352EMPTKQjT4uqlM3cgWFA-g==',. 'md5': '65b57957972e503fcbbaeed8f4fa04ca',. 'info_dict': {. 'id': '56102209',. 'ext': 'mp4',. 'title': 'Bec Boop - ........ Fly above #London in Emirates Air Line cable

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\philharmoniedeparis.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3759
Entropy (8bit):	4.520469117058511
Encrypted:	false
SSDEEP:	96:JMeXXSDHIMq9eVOnqHyalFzdufOF38pBTi6NggtW5Bh:JMenSlq9eVOuyouOF38HTi6Ngh
MD5:	E292B90024D90DEA5E2390EB33E82854
SHA1:	6E50D7D199295362226703E581FA0FA1895C63B6
SHA-256:	3238AC0039087E77E46A13777EA2613761D6BC1F30BDD5C1F5250AEF4068483E
SHA-512:	2D5CEA4A8E850E2B68563F88955F6E1FAE116E85744594283D2773F2DD9A03614172754CC1E457688E33E37B7E74BC633A2AFBEF7CE347D3B7CDDB2B05B2C100
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. try_get,. urljoin,.)...class PhilharmonieDeParisIE(InfoExtractor):. IE_DESC = 'Philharmonie de Paris'. _VALID_URL = r'''(?x). https?://. (?:. live\.philharmoniedeparis\.fr/(?:[Cc]oncert/\|embed(?:app)?/\|misc/Playlist\.ashx\?id=)\|. pad\.philharmoniedeparis\.fr/doc/CIMU/. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://pad.philharmoniedeparis.fr/doc/CIMU/1086697/jazz-a-la-villette-knower',. 'md5': 'a0a4b195f544645073631cbec166a2c2',. 'info_dict': {. 'id': '1086697',. 'ext': 'mp4',. 'title': 'Jazz . la Villette : Knower',. },. }, {. 'url': 'http://live.philharmoniedeparis.fr/concert/1032066.html',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\phoenix.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	4.739207253848918
Encrypted:	false
SSDEEP:	24:1R8l9RoGPMX6mwPhnc/8btlwd6BiSXM65w0MTBRw0M6H/eIXjlgtiBKtpSnARusg:Puwu6G8elZXB5BWBRBXH/jXjlkiBkSn5
MD5:	6421EFBE2239971C59A1B951C241CE02
SHA1:	37983809867BDBAB375B2DB1A483E304A2CACAFE
SHA-256:	D52B9A011FDF26610C6E80CE4BAE3BBB8FA007A644930DCE45067386D06D10AA
SHA-512:	A8DCBCB12A7AA2492774AC070AB4378D913658FEE2B775C7C631F201A814089B0D0751D6A8393FE29713924814C2FB3835FF0B6A136B29E47F5DBFF992393454
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .dreisat import DreiSatIE...class PhoenixIE(DreiSatIE):. IE_NAME = 'phoenix.de'. _VALID_URL = r'''(?x)https?://(?:www\.)?phoenix\.de/content/. (?:. phoenix/die_sendungen/(?:[^/]+/)?. )?. (?P<id>[0-9]+)'''. _TESTS = [. {. 'url': 'http://www.phoenix.de/content/884301',. 'md5': 'ed249f045256150c92e72dbb70eadec6',. 'info_dict': {. 'id': '884301',. 'ext': 'mp4',. 'title': 'Michael Krons mit Hans-Werner Sinn',. 'description': 'Im Dialog - Sa. 25.10.14, 00.00 - 00.35 Uhr',. 'upload_date': '20141025',. 'uploader': 'Im Dialog',. }. },. {. 'url': 'http://www.phoenix.de/content/phoenix/die_sendungen/869815',. 'only_matching': True,. },. {. 'url': 'http://www.phoenix.de/content/phoenix/die_sendungen/diskussionen/9

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\photobucket.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1788
Entropy (8bit):	4.94110463067315
Encrypted:	false
SSDEEP:	48:PuE8XAj5YvY2yadfFkI7kcVkBx3NfpwyxNVhv:F8QFYvY/aacC3NfLrV1
MD5:	C2FAA18C0AFA00C8C0E0AC6B2F6ADDE2
SHA1:	79BB8705EAC7D37313356D43748618E023C570B4
SHA-256:	81DF6F0C3C1DE042C026741F43F2015233A790CB543933EF05F844F6CD9B5C65
SHA-512:	2E71D6955F6AD2922DE7FC7B45B2012D20E9E0B756FC50B55A4E433C1D18BA6AFEC7A34DE1A330189F3B55164B95DA36D2A366A481D1BC09837A94D396F66A38
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote...class PhotobucketIE(InfoExtractor):. _VALID_URL = r'https?://(?:[a-z0-9]+\.)?photobucket\.com/.(([\?\&]current=)\|_)(?P<id>.)\.(?P<ext>(flv)\|(mp4))'. _TEST = {. 'url': 'http://media.photobucket.com/user/rachaneronas/media/TiredofLinkBuildingTryBacklinkMyDomaincom_zpsc0c3b9fa.mp4.html?filters[term]=search&filters[primary]=videos&filters[secondary]=images&sort=1&o=0',. 'md5': '7dabfb92b0a31f6c16cebc0f8e60ff99',. 'info_dict': {. 'id': 'zpsc0c3b9fa',. 'ext': 'mp4',. 'timestamp': 1367669341,. 'upload_date': '20130504',. 'uploader': 'rachaneronas',. 'title': 'Tired of Link Building? Try BacklinkMyDomain.com!',. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). vide

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\picarto.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5200
Entropy (8bit):	4.47058605342563
Encrypted:	false
SSDEEP:	96:aaTIdgDrDVSBQ1RPquzTOaAkBTnu0/6NavvHD7gaPfaGvd93NhBTUS6Ng:JI+DrDewPq8TOFsTf/6Nqvj7DnaGvd97
MD5:	0B17A9D57A3794C1DAE752DD58A2F192
SHA1:	2CCBB78A35A345978E719229DCE3398432654F80
SHA-256:	26484D1F31B402E72FF4C431385CA49D45E3072AD3304635D69D07A19F628840
SHA-512:	D16FB10505DAB1DEDDABDB681D15A83E6AB409FC754685CA4E5BFB914F178FC04F28314ADE80B177797A9D2C0A7F01F5D723FFDB0983862A648C01664F2C184E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import time..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. js_to_json,. try_get,. update_url_query,. urlencode_postdata,.)...class PicartoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www.)?picarto\.tv/(?P<id>[a-zA-Z0-9]+)(?:/(?P<token>[a-zA-Z0-9]+))?'. _TEST = {. 'url': 'https://picarto.tv/Setz',. 'info_dict': {. 'id': 'Setz',. 'ext': 'mp4',. 'title': 're:^Setz [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'timestamp': int,. 'is_live': True. },. 'skip': 'Stream is offline',. }.. @classmethod. def suitable(cls, url):. return False if PicartoVodIE.suitable(url) else super(PicartoIE, cls).suitable(url).. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). channel_id = mobj.group('id').. metadata = se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\piksel.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4501
Entropy (8bit):	4.740393500544283
Encrypted:	false
SSDEEP:	96:2mbDsNd96PR17DXDMc9m9dTsyrc31nqPI/sKkH6oO1cW1tj/uBTKxtJ6Ng:2rd9q1DM0m/sygqPtKkvO1P1tj/6TKPF
MD5:	D85CBBA238EC135DEBE9249A631B4D4B
SHA1:	D7622E833D27988012FA4CCCB01DFB68163168D8
SHA-256:	CB33A93161B5DA5BDBDBFF4AA66442C71249513AAD840CC57938BBF2284D603A
SHA-512:	59CF91100016C22447080DAC0DB907916A4A0D9ED94D1B4B2D8583800AC236F1902D3241E3F2F5AB24CF54E76A7E3DC0C6DD67824B0CBC18B4B3E7335C8A175E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. dict_get,. int_or_none,. unescapeHTML,. parse_iso8601,.)...class PikselIE(InfoExtractor):. _VALID_URL = r'https?://player\.piksel\.com/v/(?P<id>[a-z0-9]+)'. _TESTS = [. {. 'url': 'http://player.piksel.com/v/nv60p12f',. 'md5': 'd9c17bbe9c3386344f9cfd32fad8d235',. 'info_dict': {. 'id': 'nv60p12f',. 'ext': 'mp4',. 'title': '.. ...... - ...... 1',. 'description': '.... ..... ....... ........ " ..... .... " .. ..... 2016... ...... ...',. 'timestamp': 1465231790,. 'upload_date': '20160606',. }. },. {. # Original source: http://www.uscourts.gov/cameras-courts/state-washing

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pinkbike.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3446
Entropy (8bit):	4.734751452304194
Encrypted:	false
SSDEEP:	96:nUU/q2UXXj2B1vk9f1iE5c5BTJxLDnSIdKNx/PnF/3Wwt/860F6Nq:nUUyDazvkd1ipXTJ1DqtMP6Nq
MD5:	1C4DB53AA6DDB9D3D57C2F2B0DAAD5E3
SHA1:	C0AC86944CBF4BDADAA254B2E9C805CB0B1CAD59
SHA-256:	58AFB4136EF3FBC3365079D3EFAE82C6EFE41EE40A8D247E0558FCA0A3F8BCA3
SHA-512:	5402D1C41A0DF7BB211762B90FF87DAAA548D982C75269D707B0467F128B87492413493D89E053BE4FBCE9C38E5FB11721078D5909AEBD1CB433F7319EBB323B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. remove_end,. remove_start,. str_to_int,. unified_strdate,.)...class PinkbikeIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.)?pinkbike\.com/video/\|es\.pinkbike\.org/i/kvid/kvid-y5\.swf\?id=)(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.pinkbike.com/video/402811/',. 'md5': '4814b8ca7651034cd87e3361d5c2155a',. 'info_dict': {. 'id': '402811',. 'ext': 'mp4',. 'title': 'Brandon Semenuk - RAW 100',. 'description': 'Official release: www.redbull.ca/rupertwalker',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 100,. 'upload_date': '20150406',. 'uploader': 'revelco',. 'location': 'Victoria, British Columbia, Canada',. 'view_count': int,. 'comment_count': int,. }. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pladform.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4244
Entropy (8bit):	4.600681394565451
Encrypted:	false
SSDEEP:	96:YOH8pwIBwXj3biKo8c3znj8/l3s1odXLOr3v09mvBTXVN1NlWt/8Z6Ng:tcpLBeeKuj+yWpLOr3v09oTXzZ6Ng
MD5:	1B1393C5563772DA3F1F17E638DAD53C
SHA1:	BB1C088CBF8FF1F05313AB149963C32A2255E4BF
SHA-256:	2FC65FEE98B7EA6554E10E8FC2AA591CB6D263D4238555B4D4D7CB2416307B60
SHA-512:	8E82E29AE3BA0E638881104D6F11009A9210436E137BBE4E44476EDBDEFA17960CC582141566C875E6F01535F47F58C82271799DCB2A4F09648D269DCA4B1E0E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. xpath_text,. qualities,.)...class PladformIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. (?:. out\.pladform\.ru/player\|. static\.pladform\.ru/player\.swf. ). \?.*\bvideoid=\|. video\.pladform\.ru/catalog/video/videoid/. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'https://out.pladform.ru/player?pl=64471&videoid=3777899&vk_puid15=0&vk_puid34=0',. 'md5': '53362fac3a27352da20fa2803cc5cd6f',. 'info_dict': {. 'id': '3777899',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\platzi.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7421
Entropy (8bit):	4.376671462052683
Encrypted:	false
SSDEEP:	192:meVdw2vz5Qk2OWy0joWBTtUV6N6szT0Isgub:meVdw272Or+ocTqV6N6szIR9
MD5:	D679585B64CD5EF2E0298E34C57310B2
SHA1:	E400987416988F9BEBF535A56F5412794E6ADDF0
SHA-256:	1890D1E68AFEF55B7116F491142A3E298EC3F47C9A0611DC6EE46C2B6B077D47
SHA-512:	8454AB58B5259EE685BD78385AD84AF71D728757D69862835B626F66D6C3B879E81ACC24977B9B9AD2D0FC3299EA53121B184EB64CE6AAB387E97DBD5FBE8F51
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_str,.).from ..utils import (. clean_html,. ExtractorError,. int_or_none,. str_or_none,. try_get,. url_or_none,. urlencode_postdata,. urljoin,.)...class PlatziIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. platzi\.com/clases\| # es version. courses\.platzi\.com/classes # en version. )/[^/]+/(?P<id>\d+)-[^/?\#&]+. '''. _LOGIN_URL = 'https://platzi.com/login/'. _NETRC_MACHINE = 'platzi'.. _TESTS = [{. 'url': 'https://platzi.com/clases/1311-next-js/12074-creando-nuestra-primera-pagina/',. 'md5': '8f56448241005b561c10f11a595b37e3',. 'info_dict': {. 'id': '12074',. 'ext': 'mp4',. 'title': 'Creando nues

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\playfm.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2599
Entropy (8bit):	4.724935270290998
Encrypted:	false
SSDEEP:	48:+uAzXwXLyOnbPPTPSVLchdfFkouBsLxlKioFtBrNlaBet/wCU/AQ8cFP9q:MzXwlbnTKVLydKbBrNlaBet/wCU/J8+U
MD5:	413A04E2A380EDD21E59B4D830464B30
SHA1:	C611F7EA9A19EC44D862ECABFEB9E591DAFA3376
SHA-256:	4D87C551C1D12877511FC4AEF319569F2009E04B313024DA15788BA503543D78
SHA-512:	FB372F1536CE5FAB5DA969668E6DC654C535A98FD208B26F11D55996EBC22726CEEF4669ADA76D836C6700594490DD42831235438014212DA929F22542BF5F74
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,.)...class PlayFMIE(InfoExtractor):. IE_NAME = 'play.fm'. _VALID_URL = r'https?://(?:www\.)?play\.fm/(?P<slug>(?:[^/]+/)+(?P<id>[^/]+))/?(?:$\|[?#])'.. _TEST = {. 'url': 'https://www.play.fm/dan-drastic/sven-tasnadi-leipzig-electronic-music-batofar-paris-fr-2014-07-12',. 'md5': 'c505f8307825a245d0c7ad1850001f22',. 'info_dict': {. 'id': '71276',. 'ext': 'mp3',. 'title': 'Sven Tasnadi - LEIPZIG ELECTRONIC MUSIC @ Batofar (Paris,FR) - 2014-07-12',. 'description': '',. 'duration': 5627,. 'timestamp': 1406033781,. 'upload_date': '20140722',. 'uploader': 'Dan Drastic',. 'uploader_id': '71170',. 'view_count': int,. 'comment_count': int,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\playplustv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3724
Entropy (8bit):	4.671204077419834
Encrypted:	false
SSDEEP:	96:9KbfVs5q57ppA4EP8JreYT/CFnuUDGBBTeKSECj6NWTXwWw4z:6fi5app7LlYuUqPTI6Nkjw4z
MD5:	4608C36B1F20CF664A72262CC7F7B0F9
SHA1:	9857E9445C4048B704618D527073B486F2FD134B
SHA-256:	03DC3196389B724F764A8747A4F45F99279B9CBE3CC2E889CD330E587BA96131
SHA-512:	F907A1CB299A5459482443767FEF535048DC80FDB9356986C9044966B4D6EA9337B7D30A6B6E34F2A0B59842EDD575AE7E0C64FD024A73A607BAD39CDD74E4C3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. clean_html,. ExtractorError,. int_or_none,. PUTRequest,.)...class PlayPlusTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?playplus\.(?:com\|tv)/VOD/(?P<project_id>[0-9]+)/(?P<id>[0-9a-f]{32})'. _TEST = {. 'url': 'https://www.playplus.tv/VOD/7572/db8d274a5163424e967f35a30ddafb8e',. 'md5': 'd078cb89d7ab6b9df37ce23c647aef72',. 'info_dict': {. 'id': 'db8d274a5163424e967f35a30ddafb8e',. 'ext': 'mp4',. 'title': 'Cap.tulo 179 - Final',. 'description': 'md5:01085d62d8033a1e34121d3c3cabc838',. 'timestamp': 1529992740,. 'upload_date': '20180626',. },. 'skip': 'Requires account credential',. }. _NETRC_MACHINE = 'playplustv'. _GEO_COUNTRIES = ['BR']. _token = None. _profile_id = None..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\plays.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1841
Entropy (8bit):	4.892048714440831
Encrypted:	false
SSDEEP:	48:+uM9ILfkeH25vqtfjXjlPc7urxmn6pqgP48VPbXDoBTEqjT6NL:A9EkeH25vIfmq9mS1P4wP3oBTX/6NL
MD5:	E82AE36C4BD9F43754310BC3B42FCE33
SHA1:	93B2C33A611340DC63791BF5D7A64B187BBE781F
SHA-256:	BB8509B5558E28A327BC9F06994A0A1BF026B55EFA59E059D07C7E4498DDC377
SHA-512:	4DF817724409ED3D0C4CCE11D579377535AD2812187874D7FF520D7D9BC7C39BECCD408EFA23FFEF9A061B4F8BC6E54471A5D1F003E0557522A574E791366F6E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class PlaysTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?plays\.tv/(?:video\|embeds)/(?P<id>[0-9a-f]{18})'. _TESTS = [{. 'url': 'https://plays.tv/video/56af17f56c95335490/when-you-outplay-the-azir-wall',. 'md5': 'dfeac1198506652b5257a62762cec7bc',. 'info_dict': {. 'id': '56af17f56c95335490',. 'ext': 'mp4',. 'title': 'Bjergsen - When you outplay the Azir wall',. 'description': 'Posted by Bjergsen',. }. }, {. 'url': 'https://plays.tv/embeds/56af17f56c95335490',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. 'https://plays.tv/video/%s' % video_id, video_id).. info = self._search_json_ld(webpage, video_id,).. mpd_url, sources = re

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\playtvak.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7271
Entropy (8bit):	4.791376742866182
Encrypted:	false
SSDEEP:	192:01FytPPoYzp36igRnVPdefaL81via2BsymzeLXATjJ6Ng:06ZoYzp3rKVPdeiL8hD2uXSLXATjJ6Ng
MD5:	DBDCC6A657A4A1C074036D1B94BEB061
SHA1:	974274AE26EC78977FBD2558E6F6CB313473624E
SHA-256:	D17AD6678BC8BCEF80BD3B9287444342E7033A6AE1CAFBC57F8468422B5D2A77
SHA-512:	295296B3B68316796D535A3ED6CEAE41AC3133E827C8800667F006F4B667288FB8BFCF311946A7A0AC7ECA8152262B5D0224971B794567ACE26C425214DC210A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urlparse,. compat_urllib_parse_urlencode,.).from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,. qualities,.)...class PlaytvakIE(InfoExtractor):. IE_DESC = 'Playtvak.cz, iDNES.cz and Lidovky.cz'. _VALID_URL = r'https?://(?:.+?\.)?(?:playtvak\|idnes\|lidovky\|metro)\.cz/.\?(?:c\|idvideo)=(?P<id>[^&]+)'. _TESTS = [{. 'url': 'http://www.playtvak.cz/vyzente-vosy-a-srsne-ze-zahrady-dn5-/hodinovy-manzel.aspx?c=A150730_150323_hodinovy-manzel_kuko',. 'md5': '4525ae312c324b4be2f4603cc78ceb4a',. 'info_dict': {. 'id': 'A150730_150323_hodinovy-manzel_kuko',. 'ext': 'mp4',. 'title': 'Vy.e.te vosy a sr.n. ze zahrady',. 'description': 'md5:4436e61b7df227a093778efb7e373571',. 'thumbnail': r're:(?i)^https?://.\.(?:jpg\|png)$',. 'duration': 279,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\playvid.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3299
Entropy (8bit):	4.539558601443991
Encrypted:	false
SSDEEP:	96:EtejpXV1io4Xefquiogwn9cvWrlbOBTe1gl6NF18t:59FkoPqu3aTL6NAt
MD5:	3549C212C0D074C15B2DB8FD63A2101A
SHA1:	D47CC536BB58B43C25F743D50B5CA418A6D16B5E
SHA-256:	64442A70A80A1E070EFAE94789CC105521F4FE4371143043A25A430F118F44B1
SHA-512:	7CF3BC799B1D4FF881932201FFBDF3499E59B9F4E4F4ECAB3BE1D1CE1C6F9933BADF4DDFD55C78F301A09B7543AA0012C96DABC13DCAA73BE1207081FB3AA3FD
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse_unquote,. compat_urllib_parse_unquote_plus,.).from ..utils import (. clean_html,. ExtractorError,.)...class PlayvidIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?playvid\.com/watch(\?v=\|/)(?P<id>.+?)(?:#\|$)'. _TESTS = [{. 'url': 'http://www.playvid.com/watch/RnmBNgtrrJu',. 'md5': 'ffa2f6b2119af359f544388d8c01eb6c',. 'info_dict': {. 'id': 'RnmBNgtrrJu',. 'ext': 'mp4',. 'title': 'md5:9256d01c6317e3f703848b5906880dc8',. 'duration': 82,. 'age_limit': 18,. },. 'skip': 'Video removed due to ToS',. }, {. 'url': 'http://www.playvid.com/watch/hwb0GpNkzgH',. 'md5': '39d49df503ad7b8f23a4432cbf046477',. 'info_dict': {. 'id': 'hwb0GpNkzgH',. 'ext': 'mp4',. 'title': 'Ellen Euro Cutie Blond Takes a Sexy

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\playwire.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2408
Entropy (8bit):	4.831533853102196
Encrypted:	false
SSDEEP:	48:PunRrcyNfajzDmp+jJhiO38nDh/xrD1cSXyXAXvtfdfFA1PnBVLK7K2VOproq6GX:aR7ajzDmp+jP338n3rqSXC81f8pLKPVq
MD5:	FC01CA3D68140779E51540AD64018256
SHA1:	9502A9D375F2B56C4BA3535BCA8DAB3D9EEFDB10
SHA-256:	D063C484A7A8DC148F371F4E79F37E4CCBBD8C264913B9E3D42FFE78B1BEF4EB
SHA-512:	6E95B7507A1A8627E2EE12B88ABA308625A294A64AAEC89B742D2AAF3CA92A15B8C3BCBE4718728292BFF72C2012C619614E4D1058442AD879B145219603A141
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. dict_get,. float_or_none,.)...class PlaywireIE(InfoExtractor):. _VALID_URL = r'https?://(?:config\|cdn)\.playwire\.com(?:/v2)?/(?P<publisher_id>\d+)/(?:videos/v2\|embed\|config)/(?P<id>\d+)'. _TESTS = [{. 'url': 'http://config.playwire.com/14907/videos/v2/3353705/player.json',. 'md5': 'e6398701e3595888125729eaa2329ed9',. 'info_dict': {. 'id': '3353705',. 'ext': 'mp4',. 'title': 'S04_RM_UCL_Rus',. 'thumbnail': r're:^https?://.*\.png$',. 'duration': 145.94,. },. }, {. # m3u8 in f4m. 'url': 'http://config.playwire.com/21772/videos/v2/4840492/zeus.json',. 'info_dict': {. 'id': '4840492',. 'ext': 'mp4',. 'title': 'ITV EL SHOW FULL',. },. 'params': {. # m3u8 download. 'skip_download': True,. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pluralsight.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18653
Entropy (8bit):	4.514561007533472
Encrypted:	false
SSDEEP:	384:hoKdqqsl0vr/HxaAY25NiFABGcEUlVevT5Y6NEYm++s:hjr/xaAY26FABEc4vT5Y8zd
MD5:	B4F1EA1AB44A601CBCC24F4EB4034520
SHA1:	9F04C374427A17FA5AE5C0823414CF4E2AF1935A
SHA-256:	646EF7B9FECE5A371F904C8C7CD8AED0D7B73DDCADFF0C51D2801D2F0449E80D
SHA-512:	BC773F8E162F528227B33F4CC88126730D66E865AE1EBA473C3CA0F9D62B1F1E58D7019D9FA3DC84FB7431B0019DCCDF3A35BFBE3BCAA4DBDA8204F03F883ADC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import collections.import json.import os.import random.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urlparse,.).from ..utils import (. dict_get,. ExtractorError,. float_or_none,. int_or_none,. parse_duration,. qualities,. srt_subtitles_timecode,. try_get,. update_url_query,. urlencode_postdata,.)...class PluralsightBaseIE(InfoExtractor):. _API_BASE = 'https://app.pluralsight.com'.. _GRAPHQL_EP = '%s/player/api/graphql' % _API_BASE. _GRAPHQL_HEADERS = {. 'Content-Type': 'application/json;charset=UTF-8',. }. _GRAPHQL_COURSE_TMPL = '''.query BootstrapPlayer {. rpc {. bootstrapPlayer {. profile {. firstName. lastName. email. username. userHandle. authed. isAuthed. plan. }. course(courseId: "%s") {. name. title. courseHasCaptions. translationLanguag

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\podomatic.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2640
Entropy (8bit):	4.660585640534153
Encrypted:	false
SSDEEP:	48:Pu/+LEfWWUHny1ZEoK1ivGEFDx0j98va6JtfdfFk2D2Jr2ZD9AL6keo7t/8ci:anWW4n2ZlK1ivGEFDx0j98vasfqE993L
MD5:	D4D878C647F43E72A5FB24C8EE8E489C
SHA1:	D139063130B563A575EAB39BF717B81F8414AC1D
SHA-256:	0708A8093ECB8C22009CC8A2A90A2EB09A741172384DAA886EB50308FFEC5ADE
SHA-512:	55D0EC831DE80547E3FFA2720081B293D9B0E042BE2D416F27890D0F2AFE87D75F59BAE5A6C271B41BF31928A0DBB2461DA54F28DBC2E02962A1C4E3C9981F28
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor.from ..utils import int_or_none...class PodomaticIE(InfoExtractor):. IE_NAME = 'podomatic'. _VALID_URL = r'''(?x). (?P<proto>https?)://. (?:. (?P<channel>[^.]+)\.podomatic\.com/entry\|. (?:www\.)?podomatic\.com/podcasts/(?P<channel_2>[^/]+)/episodes. )/. (?P<id>[^/?#&]+). '''.. _TESTS = [{. 'url': 'http://scienceteachingtips.podomatic.com/entry/2009-01-02T16_03_35-08_00',. 'md5': '84bb855fcf3429e6bf72460e1eed782d',. 'info_dict': {. 'id': '2009-01-02T16_03_35-08_00',. 'ext': 'mp3',. 'uploader': 'Science Teaching Tips',. 'uploader_id': 'scienceteachingtips',. 'title': '64. When the Moon Hits Your Eye',. 'duration': 446,. }. }, {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pokemon.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3021
Entropy (8bit):	4.945444103908502
Encrypted:	false
SSDEEP:	48:+uQnSfMJgdacn2/EvHVHd0+N23dXXcXSptfOfFI7kmv4MfrhmsBm:MMMGdzn2svHV90+o3xQSXfomfzh7Bm
MD5:	90B56C97505F676CE1E7B4B1717D85BA
SHA1:	3FD175E6BDAC55478B7680DAABC55D49E472C77E
SHA-256:	4C0325DB6CA1BE8F91A648E3C3D4AB2AC949519637EEA76DB9CE16EDD9D7A730
SHA-512:	54E9561A83A8537094EFF9A112992BC56C4EA76CADDE8372E41F54A2B4A71EF6622E5BE8847E5B8412A89191847086D6B40D854D4D648D072B972F0C506AD8C1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,. int_or_none,.)...class PokemonIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pokemon\.com/[a-z]{2}(?:.*?play=(?P<id>[a-z0-9]{32})\|/(?:[^/]+/)+(?P<display_id>[^/?#&]+))'. _TESTS = [{. 'url': 'https://www.pokemon.com/us/pokemon-episodes/20_30-the-ol-raise-and-switch/',. 'md5': '2fe8eaec69768b25ef898cda9c43062e',. 'info_dict': {. 'id': 'afe22e30f01c41f49d4f1d9eab5cd9a4',. 'ext': 'mp4',. 'title': 'The Ol. Raise and Switch!',. 'description': 'md5:7db77f7107f98ba88401d3adc80ff7af',. 'timestamp': 1511824728,. 'upload_date': '20171127',. },. 'add_id': ['LimelightMedia'],. }, {. # no data-video-title. 'url': 'https://www.pokemon.com/us/pokemon-episodes/pokemon-movies/pokemon-the-rise-of-darkrai-2008',. 'info

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\polskieradio.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6668
Entropy (8bit):	4.877495923013117
Encrypted:	false
SSDEEP:	192:UEz2G/DQlsOA3T2rExmlW3GwCxex50dOqb:UNG/Ds1ST2rExmo3GwCxyof
MD5:	18E7C7D681C563AC9873A5EA8BCDE154
SHA1:	E97FC8D74A3231953E5054A49233C6A60B03871A
SHA-256:	8316C2D7CE8B13C5D443C9BBF05FA3C4AB38D6BD746D0AC1BF2C58BC39571054
SHA-512:	B6BCEC918167BB1C1901F59270F49B9DCEAFEA44CB727E5148551E5FCCAB7EE046A6F428671F2EC4C4460A187AD74C322EE3CBFFA4F11F2925DC295A54F7B466
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_urllib_parse_unquote,. compat_urlparse.).from ..utils import (. extract_attributes,. int_or_none,. strip_or_none,. unified_timestamp,.)...class PolskieRadioIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?polskieradio\.pl/\d+/\d+/Artykul/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.polskieradio.pl/7/5102/Artykul/1587943,Prof-Andrzej-Nowak-o-historii-nie-da-sie-myslec-beznamietnie',. 'info_dict': {. 'id': '1587943',. 'title': 'Prof. Andrzej Nowak: o historii nie da si. my.le. beznami.tnie',. 'description': 'md5:12f954edbf3120c5e7075e17bf9fc5c5',. },. 'playlist': [{. 'md5': '2984ee6ce9046d91fc233bc1a864a09a',. 'info_dict': {. 'id': '1540576',. 'ext': 'mp3',. 'tit

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\popcorntv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2686
Entropy (8bit):	4.785109406373677
Encrypted:	false
SSDEEP:	48:PuBYWNfrCeCUPe/CUPHeRzXrEmK6xC3tfdfFfu1dhXf5MqGMkbBCVSmXn0UcNeVL:DCr+76WeFXrEmKuOfbuFP5MdMJ05NR4V
MD5:	F1D2C449DA9CAEAF787FD208CFDB79E6
SHA1:	0813D179ADD0A2A8CC399CF4E49D6FAE98A36B3F
SHA-256:	62E8FC1D7269A5BD54A101A77126A5D7DAF2EF8B2C46F8D8130205D5D98F4A38
SHA-512:	2C7D43538464F27EEE57497E9BF8AD2920A9488233E11F7B2E29BC28702E5CB48BCA30C9E8EE9E2DBB37F62DEA994B8F49F6F838AAE83D9212DFC23A7895CEDA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. extract_attributes,. int_or_none,. unified_timestamp,.)...class PopcornTVIE(InfoExtractor):. _VALID_URL = r'https?://[^/]+\.popcorntv\.it/guarda/(?P<display_id>[^/]+)/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://animemanga.popcorntv.it/guarda/food-wars-battaglie-culinarie-episodio-01/9183',. 'md5': '47d65a48d147caf692ab8562fe630b45',. 'info_dict': {. 'id': '9183',. 'display_id': 'food-wars-battaglie-culinarie-episodio-01',. 'ext': 'mp4',. 'title': 'Food Wars, Battaglie Culinarie \| Episodio 01',. 'description': 'md5:b8bea378faae4651d3b34c6e112463d0',. 'thumbnail': r're:^https?://.*\.jpg$',. 'timestamp': 1497610857,. 'upload_date': '20170616',. 'duration': 1440,. 'view_count': int,. },. }, {. 'url': 'https://cinema.popcorn

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\porn91.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2116
Entropy (8bit):	5.186038717986418
Encrypted:	false
SSDEEP:	48:+ug4ZXv1SVfmajXj3j0Us4rBkaBbdOPfE6DbBRIKzmj98cI:xXv1mfmaT0d42IdOn3DbcK298t
MD5:	060931E027990242A7B91FF835AF5D09
SHA1:	49AB178019BED00C4AA086BEE5D0728077629A6D
SHA-256:	DE8D6DCC9CBA7B170ED1043EEC1364743D29B146C7051614034E70B7E39B813C
SHA-512:	FC942F079DA0767F3931EBC01170F158C928036378E88E65175BDDC2267FA113D102A4E4A4EF2376BF36FA8D59111A378D281B3ABF5A706FA4E1BAB4044B2164
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_duration,. int_or_none,. ExtractorError,.)...class Porn91IE(InfoExtractor):. IE_NAME = '91porn'. _VALID_URL = r'(?:https?://)(?:www\.\|)91porn\.com/.+?\?viewkey=(?P<id>[\w\d]+)'.. _TEST = {. 'url': 'http://91porn.com/view_video.php?viewkey=7e42283b4f5ab36da134',. 'md5': '7fcdb5349354f40d41689bd0fa8db05a',. 'info_dict': {. 'id': '7e42283b4f5ab36da134',. 'title': '18..................',. 'ext': 'mp4',. 'duration': 431,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). self._set_cookie('91porn.com', 'language', 'cn_CN').. webpage = self._download_webpage(. 'http://91porn.com/view_video.php?viewkey=%s' % video_id, video_id).. if '.........

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\porncom.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3872
Entropy (8bit):	4.700467364092993
Encrypted:	false
SSDEEP:	96:VfF0NAQxXjiBn12hfGIXvpp3UjEhVbefFO1wLlLDBTJMat/896NiT:hmJmn2GIj3UcMO1C7TJQ96NiT
MD5:	262268A12DF095C23119AC600C886F7A
SHA1:	530F9DA92411BE8A1C7CB90205B55A64C3AD1240
SHA-256:	26B779F8C0927D7769CCAD1871E3794F53C5075229B8D0DF57EB9669B0B6790A
SHA-512:	2E76478ED054D4D62BC8856A1FF1708AD90906DEB47A18988FF41F618663287E4CC910B28C0778F4523099F51D61B280C3A7FA2C347A87FB482833D6793CA693
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. int_or_none,. js_to_json,. parse_filesize,. str_to_int,.)...class PornComIE(InfoExtractor):. _VALID_URL = r'https?://(?:[a-zA-Z]+\.)?porn\.com/videos/(?:(?P<display_id>[^/]+)-)?(?P<id>\d+)'. _TESTS = [{. 'url': 'http://www.porn.com/videos/teen-grabs-a-dildo-and-fucks-her-pussy-live-on-1hottie-i-rec-2603339',. 'md5': '3f30ce76267533cd12ba999263156de7',. 'info_dict': {. 'id': '2603339',. 'display_id': 'teen-grabs-a-dildo-and-fucks-her-pussy-live-on-1hottie-i-rec',. 'ext': 'mp4',. 'title': 'Teen grabs a dildo and fucks her pussy live on 1hottie, I rec',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 551,. 'view_count': int,. 'age_limit': 18,. 'categories': list,. 'tags': list,. },. }

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pornflip.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3447
Entropy (8bit):	4.707070027962389
Encrypted:	false
SSDEEP:	96:M9LxvXjgfPvZ9odf0izc7UdLworDNCoBTBRWN6NJ0gNqh10:QN6vZ9o90igIdLworBCoTBRw6NI30
MD5:	3893ECF4169935EC2D5D5839A8A5C136
SHA1:	4B2FD17BC935CCE9AD290581F6DEDA4CC47EC2F8
SHA-256:	9C05B2678AE77F60DAE0E67AF10C7EA2F673C982F54A7E5E3DE5DA79938F381F
SHA-512:	E8049319EE9BD8C80818AF6796371F53AB7CE7C705B9501F8C65BB72204EB5C0EC3D2879110A0109FB56B230233B34B09FCC348F2C22AD18E2A23850B548A6DA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_str,.).from ..utils import (. int_or_none,. try_get,. unified_timestamp,.)...class PornFlipIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pornflip\.com/(?:v\|embed)/(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://www.pornflip.com/v/wz7DfNhMmep',. 'md5': '98c46639849145ae1fd77af532a9278c',. 'info_dict': {. 'id': 'wz7DfNhMmep',. 'ext': 'mp4',. 'title': '2 Amateurs swallow make his dream cumshots true',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 112,. 'timestamp': 1481655502,. 'upload_date': '20161213',. 'uploader_id': '106786',. 'uploader': 'figifoto',. 'view_count': int,. 'age_limit': 18,. }. }, {. 'url': 'https://www.pornflip.com/embed/wz7DfNhMmep',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pornhd.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4090
Entropy (8bit):	4.823985934295519
Encrypted:	false
SSDEEP:	96:lOVlVjwK6HQnrMkZHcfG6tdV35h3C1BumNR34lGifBTYvgOmsxRjt3U6Ne:0bJwonIk0G6RgBuO34lzTYrx06Ne
MD5:	3C8D487145F094D705BBDFF488C754FF
SHA1:	B310EFE58E830C6564761AAB7BE2EAA69E022B89
SHA-256:	E9B2F88A5A76341F3EE50294ACFF58D54C678381F803F33EFA68764E28E055E8
SHA-512:	7856F9D81C21F97B23E5E3F082D4BCEC4F05EB2744746D50825BEB7251483AF4FCD2123683DFA55A998C31E96B42D2FAABC38BB47948992F67AFBD2237EDEED0
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. js_to_json,. urljoin,.)...class PornHdIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pornhd\.com/(?:[a-z]{2,4}/)?videos/(?P<id>\d+)(?:/(?P<display_id>.+))?'. _TESTS = [{. 'url': 'http://www.pornhd.com/videos/9864/selfie-restroom-masturbation-fun-with-chubby-cutie-hd-porn-video',. 'md5': '87f1540746c1d32ec7a2305c12b96b25',. 'info_dict': {. 'id': '9864',. 'display_id': 'selfie-restroom-masturbation-fun-with-chubby-cutie-hd-porn-video',. 'ext': 'mp4',. 'title': 'Restroom selfie masturbation',. 'description': 'md5:3748420395e03e31ac96857a8f125b2b',. 'thumbnail': r're:^https?://.*\.jpg',. 'view_count': int,. 'like_count': int,. 'age_limit': 18,. }. }, {. # removed video.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pornhub.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	21015
Entropy (8bit):	4.705784374502431
Encrypted:	false
SSDEEP:	384:nYG/t85/ZxRplvOqJVBVDL6DoldGhT3cwwBB6NXgIHBm5S7KwI54sdXc/xCS8+eq:5qJ5DLKoldGhT3OBB8XgIz
MD5:	F301BC356694C877EEC49A36C94FDEBE
SHA1:	4764A6B4358C068F3261FD0E9CBBB3DE7E6C086F
SHA-256:	77280DB1FB98DC617E4127C4ABE6EFC8143A6F4AEB8876A8199B24B561D309F1
SHA-512:	EA401F731A0972E7F12A1B9B2865063260BFD391F8398770B85E858F22A43B7A09F4079AB1D104DDAE56E5EE0712DBAD9C9137D6DC38D61703227D8DAFBC40AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import functools.import itertools.import operator.import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,. compat_urllib_request,.).from .openload import PhantomJSwrapper.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. orderedSet,. remove_quotes,. str_to_int,. url_or_none,.)...class PornHubBaseIE(InfoExtractor):. def _download_webpage_handle(self, args, kwargs):. def dl(args, *kwargs):. return super(PornHubBaseIE, self)._download_webpage_handle(args, *kwargs).. webpage, urlh = dl(args, *kwargs).. if any(re.search(p, webpage) for p in (. r'<body\b[^>]+\bonload=["\']go',. r'document\.cookie\s=\s*["\']RNKEY=',. r'document\.location\.reload$true$')):. url_or_request = args[0]. url = (url_or_request.get_full_url().

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pornotube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3154
Entropy (8bit):	4.680936526461476
Encrypted:	false
SSDEEP:	96:pdcddtTvopjXKat7aPJg3JAP6Q7ALVu0PfmAY38MtZ90:bwd9vopWaF7PLVcMN
MD5:	F9CDED50A8497C9495B38ACE88B00C55
SHA1:	5020202727C0A3237D7798C850DD534D0CD9B159
SHA-256:	0E664DE490EC3C67B872889F382102D309C546411DE3FC6FBD527DF43FFDD6CF
SHA-512:	AEF0B7A5DFFF42F451DFBAA95D191C475BD8028E27371BB84A347D517A0F0893D4AEAFCA493B7058535758FED8A40C13BBC732AE270C57DF1E9ED2D0A1A7D366
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json..from .common import InfoExtractor.from ..utils import int_or_none...class PornotubeIE(InfoExtractor):. _VALID_URL = r'https?://(?:\w+\.)?pornotube\.com/(?:[^?#]?)/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.pornotube.com/orientation/straight/video/4964/title/weird-hot-and-wet-science',. 'md5': '60fc5a4f0d93a97968fc7999d98260c9',. 'info_dict': {. 'id': '4964',. 'ext': 'mp4',. 'upload_date': '20141203',. 'title': 'Weird Hot and Wet Science',. 'description': 'md5:a8304bef7ef06cb4ab476ca6029b01b0',. 'categories': ['Adult Humor', 'Blondes'],. 'uploader': 'Alpha Blue Archives',. 'thumbnail': r're:^https?://.\.jpg$',. 'timestamp': 1417582800,. 'age_limit': 18,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. token = self._download_json(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pornovoisines.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4003
Entropy (8bit):	4.608171637912937
Encrypted:	false
SSDEEP:	96:Rke0u4bXBmCXO8aGAXEmOy1M4ANBT1IwoqnYeflCrc09m6NhtN0E8M90:ye34ZHaGkEmOy1cTT1XJam6NEP
MD5:	EC9BF4996041FE29108D1F2CEB6E374E
SHA1:	3F38E4FA90CF98006A39AB9AC61A5C67D1A6177F
SHA-256:	AF9DCE016E98332B9D37A9C312E4F6E421528A2FA6622EA8069C6B978795C4D1
SHA-512:	96F026B34538D1305DF11A34712177D8B474F6AAA5A62E7489AE15702251C9F305992FC3E425B4AA10AF2AD92D21C093D213A9739E45F83DDB687782D25D239F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. float_or_none,. unified_strdate,.)...class PornoVoisinesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pornovoisines\.com/videos/show/(?P<id>\d+)/(?P<display_id>[^/.]+)'.. _TEST = {. 'url': 'http://www.pornovoisines.com/videos/show/919/recherche-appartement.html',. 'md5': '6f8aca6a058592ab49fe701c8ba8317b',. 'info_dict': {. 'id': '919',. 'display_id': 'recherche-appartement',. 'ext': 'mp4',. 'title': 'Recherche appartement',. 'description': 'md5:fe10cb92ae2dd3ed94bb4080d11ff493',. 'thumbnail': r're:^https?://.*\.jpg$',. 'upload_date': '20140925',. 'duration': 120,. 'view_count': int,. 'average_rating': float,. 'categories': ['D.butante', 'D.butantes', 'Sc.nario', 'Sodomie'],.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pornoxo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	4.813665904509695
Encrypted:	false
SSDEEP:	48:PuU4ACeD/Y6bPzgq+adfFGlkZb/XAd5dC5PLX8W+c9UM:3zCeD/Y6bPzz+apVigPbX9UM
MD5:	772BA956218064AB0F90E16518D71900
SHA1:	0CDD7F65BAF5FCE9C854C93DE588C2BEA92AB1B9
SHA-256:	A66409543F54DBB3A39B5212DD5798101604FDFA094B5EEB52BA6D81DA3AE9A1
SHA-512:	BB0C14840AEE33AE564B9ECDF65235909998632273FEB29C13CA51AD5FE5297D4BF73EB8B3D6CFFDE176331F94CE6D91CDAE2B52DB38714CB2D95552E31194CB
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. str_to_int,.)...class PornoXOIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pornoxo\.com/videos/(?P<id>\d+)/(?P<display_id>[^/]+)\.html'. _TEST = {. 'url': 'http://www.pornoxo.com/videos/7564/striptease-from-sexy-secretary.html',. 'md5': '582f28ecbaa9e6e24cb90f50f524ce87',. 'info_dict': {. 'id': '7564',. 'ext': 'flv',. 'title': 'Striptease From Sexy Secretary!',. 'display_id': 'striptease-from-sexy-secretary',. 'description': 'md5:0ee35252b685b3883f4a1d38332f9980',. 'categories': list, # NSFW. 'thumbnail': r're:https?://.*\.jpg$',. 'age_limit': 18,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id, display_id = mobj.groups().. webpage = self._download_webpage(url, video_id). vid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\presstv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	4.800779868816139
Encrypted:	false
SSDEEP:	48:+uvWyeOfrZDD4adfFkZVAhSZK4JKJKwAK4JyasfTbaZK1eVZVWeiaHwHUHs6N1tu:rreOTZDD4aGISLiX4c/aMMij6N1tN0z
MD5:	F278C34141C82ACE965000D2392CC89E
SHA1:	9F4069496CA2906422BDA07CE0F3F712D8578664
SHA-256:	7075C85D7E17204597F13424FB0B1F707BB6BC184FD68666F393DBE41868CDF9
SHA-512:	12D8351CAC651793B878F54F4242F1C58F0DA05AF929343B7735339CEA85A99015186165EE4B866C638DE54B3A0E34E0BE84884924DE57674CAC511F9A132982
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import remove_start...class PressTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?presstv\.ir/[^/]+/(?P<y>\d+)/(?P<m>\d+)/(?P<d>\d+)/(?P<id>\d+)/(?P<display_id>[^/]+)?'.. _TEST = {. 'url': 'http://www.presstv.ir/Detail/2016/04/09/459911/Australian-sewerage-treatment-facility-/',. 'md5': '5d7e3195a447cb13e9267e931d8dd5a5',. 'info_dict': {. 'id': '459911',. 'display_id': 'Australian-sewerage-treatment-facility-',. 'ext': 'mp4',. 'title': 'Organic mattresses used to clean waste water',. 'upload_date': '20160409',. 'thumbnail': r're:^https?://.*\.jpg',. 'description': 'md5:20002e654bbafb6908395a5c0cfcd125'. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = mobj.group('id'). display_id = mobj.group

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\primesharetv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1853
Entropy (8bit):	4.826779939073006
Encrypted:	false
SSDEEP:	48:PuhrE7rWXK/PytjXhk73Bii2xeQsw3Ar9GBwmIvGX1Xui4v8:YrE7rWX6PytaN2xetw3+9SIvMH4v8
MD5:	125DDD8B1DF42F588BC8A14587E4E620
SHA1:	02D35AC1F3C73D20967E42D3231E69DF723BFCA7
SHA-256:	FB0B744F39898AF120EFFFFF273AA0D9A12A500555761F0538B8C7DB0F938BF5
SHA-512:	C68BC75B668A9087CA6D6A78707FF213C91D3CDCDAE59D9A9D3812A662384A32839242DB192D9B383EB1FC2B189D920D0C459CDE8EAB7A9251B7C630D99203B6
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. sanitized_Request,. urlencode_postdata,.)...class PrimeShareTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?primeshare\.tv/download/(?P<id>[\da-zA-Z]+)'.. _TEST = {. 'url': 'http://primeshare.tv/download/238790B611',. 'md5': 'b92d9bf5461137c36228009f31533fbc',. 'info_dict': {. 'id': '238790B611',. 'ext': 'mp4',. 'title': 'Public Domain - 1960s Commercial - Crest Toothpaste-YKsuFona',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. if '>File not exist<' in webpage:. raise ExtractorError('Video %s does not exist' % video_id, expected=True).. fields = self._hidden_inputs(webpage).. headers = {. 'Referer': url,. 'Content-Type': 'application/x-www-f

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\promptfile.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2425
Entropy (8bit):	4.895452531826163
Encrypted:	false
SSDEEP:	48:+uvWOJEhb9NZXgajXjlkzhcHe3jByOY71hMsC9wJTBBlpydVWrXF0ZeXaYaPZyzq:KOJEhb9NZXgaqNcHH17PMH9uTTydgx0b
MD5:	0C618B8D3D92D07775D946B58CD145E5
SHA1:	3409FE4F2D32F1C6DED020093D775B7398BBEFF3
SHA-256:	4862577F97C35D8934F6E9EAB11BBC45B7378DD2037ACB935B972BF6E7F49666
SHA-512:	1C19F6B556140A84C38520488E26761FE5F61584375B8B9D3EB9A1117D7640EA5142277C1494CF2B6D6C2C70D37929A7120A37C13DC18395FF121F82333FA741
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. ExtractorError,. urlencode_postdata,.)...class PromptFileIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?promptfile\.com/l/(?P<id>[0-9A-Z\-]+)'. _TEST = {. 'url': 'http://www.promptfile.com/l/86D1CE8462-576CAAE416',. 'md5': '5a7e285a26e0d66d9a263fae91bc92ce',. 'info_dict': {. 'id': '86D1CE8462-576CAAE416',. 'ext': 'mp4',. 'title': 'oceans.mp4',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. if re.search(r'<div.+id="not_found_msg".+>(?!We are).+</div>[^-]', webpage) is not None:. raise ExtractorError('Video %s does not exist' % video_id,. expected=True).. chash = self._

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\prosiebensat1.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	21388
Entropy (8bit):	4.531477239810912
Encrypted:	false
SSDEEP:	384:FE5uSoNObHHaixOCoS8ctXu6XzTy6NQfVw3U2iwAY/gkWmEq7FBwKtRBWIAnl8Le:FE5uSoNObH6ixOCoSZe6DTy8H9JRYQoj
MD5:	B901F2937FD6B5A9FE892925252CF8A9
SHA1:	40443106D58BFA93F6D827EF6B20AAFD5D2F3E64
SHA-256:	CC1502C80E981AA2DB365CD8263BB82F5EC98158835D5455BF10C550F00E7D79
SHA-512:	67760A796699E4F615E747A63CCDD5E298B3343429131A1E1F1E03FAFDF2598B04139D748D125E51B80EC772B68CD51CC273C57917B92728722824CC5918AAFC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from hashlib import sha1.from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. determine_ext,. float_or_none,. int_or_none,. unified_strdate,.)...class ProSiebenSat1BaseIE(InfoExtractor):. _GEO_COUNTRIES = ['DE']. _ACCESS_ID = None. _SUPPORTED_PROTOCOLS = 'dash:clear,hls:clear,progressive:clear'. _V4_BASE_URL = 'https://vas-v4.p7s1video.net/4.0/get'.. def _extract_video_info(self, url, clip_id):. client_location = url.. video = self._download_json(. 'http://vas.sim-technik.de/vas/live/v2/videos',. clip_id, 'Downloading videos JSON', query={. 'access_token': self._TOKEN,. 'client_location': client_location,. 'client_name': self._CLIENT_NAME,. 'ids': clip_id,. })[0].. if video.get('is_protected') is True:. raise Extra

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\puhutv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8725
Entropy (8bit):	4.385432804710717
Encrypted:	false
SSDEEP:	192:95A68lHj9qdBXJuAt1OW3KYEIyTIgPiQblSGORmu6NGV6ChEzpoTkNE:95ArHj9qdBN1OW6syTIgKglTY56NGU4t
MD5:	E06B45F1E991706DEC789809B51C21E5
SHA1:	A9C806B47803EA95300AF37ADC1011E5C0034AA8
SHA-256:	428A6485882371A11ECF676610B0F80C1CD715D0C48233DA75ECB147B068855C
SHA-512:	483FF80D573B63C64BCD080ED34772D3E5B10B6045B3CE02EF5B941D02BB0F841AFD30372E0D2746FA5F625A50AE65C46A5A43D29E4BA8A6F4FDDD57890C4DFE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. parse_resolution,. str_or_none,. try_get,. unified_timestamp,. url_or_none,. urljoin,.)...class PuhuTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?puhutv\.com/(?P<id>[^/?#&]+)-izle'. IE_NAME = 'puhutv'. _TESTS = [{. # film. 'url': 'https://puhutv.com/sut-kardesler-izle',. 'md5': 'fbd8f2d8e7681f8bcd51b592475a6ae7',. 'info_dict': {. 'id': '5085',. 'display_id': 'sut-kardesler',. 'ext': 'mp4',. 'title': 'S.t Karde.ler',. 'description': 'md5:405fd024df916ca16731114eb18e511a',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 4832.44,. 'creator': 'Arzu Film',. 'timestamp': 1469778212,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\puls4.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2295
Entropy (8bit):	4.971542759685967
Encrypted:	false
SSDEEP:	48:+uIt88PfzR+HXUWAF4x1uTeXx1uTIivIE0KnJXj/BpB9aeuxCfW+ETVNlWf4:FqzaXJAF4xgixgEiGKnzuxQW+EhN1
MD5:	33C503EBB911775BD6D2ADE086883B7B
SHA1:	C5F7F8E94A371AC15E95D77DEACC4F5BC0EAB46C
SHA-256:	495FE664B551C13DFB28941ACDB69E6484610F77ED42F29C93F60BBBCF2ED8CE
SHA-512:	7F512C3AEE9F1AFEC1568A8DF7E86A3C28CD5117756F125602C652B3769FF1B85EB0B09E65EC392E505D43927B7CCD7CAEB39EC202B9F3A0A3CE5520E8888F64
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .prosiebensat1 import ProSiebenSat1BaseIE.from ..utils import (. unified_strdate,. parse_duration,. compat_str,.)...class Puls4IE(ProSiebenSat1BaseIE):. _VALID_URL = r'https?://(?:www\.)?puls4\.com/(?P<id>[^?#&]+)'. _TESTS = [{. 'url': 'http://www.puls4.com/2-minuten-2-millionen/staffel-3/videos/2min2miotalk/Tobias-Homberger-von-myclubs-im-2min2miotalk-118118',. 'md5': 'fd3c6b0903ac72c9d004f04bc6bb3e03',. 'info_dict': {. 'id': '118118',. 'ext': 'flv',. 'title': 'Tobias Homberger von myclubs im #2min2miotalk',. 'description': 'md5:f9def7c5e8745d6026d8885487d91955',. 'upload_date': '20160830',. 'uploader': 'PULS_4',. },. }, {. 'url': 'http://www.puls4.com/pro-und-contra/wer-wird-prasident/Ganze-Folgen/Wer-wird-Praesident.-Norbert-Hofer',. 'only_matching': True,. }, {. 'url': 'http://www.puls4.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\pyvideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2764
Entropy (8bit):	4.450690127064308
Encrypted:	false
SSDEEP:	48:PuAJiKcUfQdRd9ngJq4L4JW4fdfFjXvB8cHEjPDrDafV2u3xN6kbVQBHzlOw7WV+:LJiKZQdRd9nGxL4Y4fzEjPPOfV2u3xNU
MD5:	6EC9C723C05CAF8C56318C445E77FEB8
SHA1:	7DC083200995373E6EEB7F423609D9EBC764A9B2
SHA-256:	DB6DBFF24BB3524484F722971651416A4EA4C3882917D9F7D57E229B25634B42
SHA-512:	AF6099FFC53D057BCA53CFB2501DA02AAECC105B295B4F054BAAC0B4D3BCC88F47F63E2117AAB3287B964F37CCDB8B8DA7529FCFD40DA330BF198177EB0A7522
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import int_or_none...class PyvideoIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?pyvideo\.org/(?P<category>[^/]+)/(?P<id>[^/?#&.]+)'.. _TESTS = [{. 'url': 'http://pyvideo.org/pycon-us-2013/become-a-logging-expert-in-30-minutes.html',. 'info_dict': {. 'id': 'become-a-logging-expert-in-30-minutes',. },. 'playlist_count': 2,. }, {. 'url': 'http://pyvideo.org/pygotham-2012/gloriajw-spotifywitherikbernhardsson182m4v.html',. 'md5': '5fe1c7e0a8aa5570330784c847ff6d12',. 'info_dict': {. 'id': '2542',. 'ext': 'm4v',. 'title': 'Gloriajw-SpotifyWithErikBernhardsson182.m4v',. },. }].. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). category = mobj.group('category'). video_id = mobj.group('id').. entri

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\qqmusic.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	13646
Entropy (8bit):	5.07143618173297
Encrypted:	false
SSDEEP:	384:Fbi4fJ3wM4VTwTU6NUnTlQZq6MUZIogeTQaY6M:DJ3FyTwTU8UnRx6MU2ec6M
MD5:	D1136FAD1994DBA07C10220AAAF4452B
SHA1:	BB9758F9754BAA87483B9332A47E85BDA8E4EA88
SHA-256:	18967696D4D5F72F1CCBE1112EF92D8BDC3F4AD9E8B3E282CE8AF2C82B21353F
SHA-512:	8430BBEEE9E6C082AE24316641A989DEB7E0B65F16F2CAD8A84F6B17E13586830743567EF11C109C25A06973DB5C2A437508AC60F344B381EB426CFA0A0B92F2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import random.import re.import time..from .common import InfoExtractor.from ..utils import (. clean_html,. ExtractorError,. strip_jsonp,. unescapeHTML,.)...class QQMusicIE(InfoExtractor):. IE_NAME = 'qqmusic'. IE_DESC = 'QQ..'. _VALID_URL = r'https?://y\.qq\.com/n/yqq/song/(?P<id>[0-9A-Za-z]+)\.html'. _TESTS = [{. 'url': 'https://y.qq.com/n/yqq/song/004295Et37taLD.html',. 'md5': '5f1e6cea39e182857da7ffc5ef5e6bb8',. 'info_dict': {. 'id': '004295Et37taLD',. 'ext': 'mp3',. 'title': '.....',. 'release_date': '20141227',. 'creator': '...',. 'description': 'md5:d85afb3051952ecc50a1ee8a286d1eac',. 'thumbnail': r're:^https?://.*\.jpg$',. }. }, {. 'note': 'There is no mp3-320 version of this song.',. 'url': 'https://y.qq.com/n/yqq/song/004MsGEo3DdNxV.html',. 'md5': 'fa

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\r7.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (524)
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.925377962396441
Encrypted:	false
SSDEEP:	96:5yN7szo/AXjkK8Rmvs0fFw64gOM3eAXYkNBxqrWBToU77Nl4ft/8sE6NyfL+s/Se:5yN7sU/48R2siFwtgOM3dooxqryTPN6+
MD5:	01DA7C541A7E92911F84CFB71BBAD071
SHA1:	D24D23515BA56F70B72FEDF41ABF8DEB5673F761
SHA-256:	1CDEF85E695CCB631D2AC73D44F38BF7712B37D61B2C8609730CEED31D848A22
SHA-512:	B61D880E09D7F3573C3777FDB1AAAA8AE7B1A804FB28D4541775ECD54E7AA693061AA2C3B78DF4838FF7A3A238871E37FE9189AAB7534D110A945820B75890F3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import int_or_none...class R7IE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. (?:[a-zA-Z]+)\.r7\.com(?:/[^/]+)+/idmedia/\|. noticias\.r7\.com(?:/[^/]+)+/[^/]+-\|. player\.r7\.com/video/i/. ). (?P<id>[\da-f]{24}). '''. _TESTS = [{. 'url': 'http://videos.r7.com/policiais-humilham-suspeito-a-beira-da-morte-morre-com-dignidade-/idmedia/54e7050b0cf2ff57e0279389.html',. 'md5': '403c4e393617e8e8ddc748978ee8efde',. 'info_dict': {. 'id': '54e7050b0cf2ff57e0279389',. 'ext': 'mp4',. 'title': 'Policiais humilham suspeito . beira da morte: "Morre com dignidade"',. 'description': 'md5:01812008664be76a6479aa58ec865b72',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\radiobremen.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2431
Entropy (8bit):	4.879629621397853
Encrypted:	false
SSDEEP:	48:wu6STQFHSffsUgqGvQELyzjXQnI2X8X3GcC9gKYJYdGzaHDVGgQ8c26N1/YJ:YS8FyffzzOBLasISX99YZCDk8V6N1/q
MD5:	61C8914F811CF96E816E3824D9F166DC
SHA1:	5CF28D4066B1344E75B2926EA3C33F4FC8284041
SHA-256:	CBB6942EB3BCD870BB508BEB8A628BB7EE345D596F4C47044DB247A246E4BA00
SHA-512:	8A0BB1B3962E3780DC95D733AE9B480D65C2D213B7690F16D22985706091573B77CD3F3D284749C8E456E4E36E627BBBA0A5CD36CF0203DF90F54CEB3245DA0B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8..from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import parse_duration...class RadioBremenIE(InfoExtractor):. _VALID_URL = r'http?://(?:www\.)?radiobremen\.de/mediathek/(?:index\.html)?\?id=(?P<id>[0-9]+)'. IE_NAME = 'radiobremen'.. _TEST = {. 'url': 'http://www.radiobremen.de/mediathek/?id=141876',. 'info_dict': {. 'id': '141876',. 'ext': 'mp4',. 'duration': 178,. 'width': 512,. 'title': 'Druck auf Patrick .zt.rk',. 'thumbnail': r're:https?://.*\.jpg$',. 'description': 'Gegen den SPD-B.rgerschaftsabgeordneten Patrick .zt.rk wird wegen Beihilfe zum gewerbsm..igen Betrug ermittelt. Am Donnerstagabend sollte er dem Vorstand des SPD-Unterbezirks Bremerhaven dazu Rede und Antwort stehen.',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. meta_url = 'http://www.radiobre

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\radiocanada.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6349
Entropy (8bit):	4.5557446447381835
Encrypted:	false
SSDEEP:	192:Ta5xh1rj+b0rYUx020M3k23594dYnTfv22K26p36NYZ1ddA/cqN:G/vrj0XL20M3TAdYnTQ36NSrdAjN
MD5:	A858578C17E66E9551AC46BEF10869DC
SHA1:	57CF6156D6A1576D97AC1C408DFE44D0A01635D1
SHA-256:	0B04609581C81D6248D1B21EE558595FC3B2B352F0B343CC924E1ED3F41E8392
SHA-512:	576D35BFD382FB59ECFDC231A8041AB3E6D7F949BEA739A71660F16A614522BD156DF35CFC746DF96E0CB294245DB854B28483EF241596BFABDF21B1E63D1E8D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. unified_strdate,.)...class RadioCanadaIE(InfoExtractor):. IE_NAME = 'radiocanada'. _VALID_URL = r'(?:radiocanada:\|https?://ici\.radio-canada\.ca/widgets/mediaconsole/)(?P<app_code>[^:/]+)[:/](?P<id>[0-9]+)'. _TESTS = [. {. 'url': 'http://ici.radio-canada.ca/widgets/mediaconsole/medianet/7184272',. 'info_dict': {. 'id': '7184272',. 'ext': 'mp4',. 'title': 'Le parcours du tireur capt. sur vid.o',. 'description': 'Images des cam.ras de surveillance fournies par la GRC montrant le parcours du tireur d\'Ottawa',. 'upload_date': '20141023',. },. 'params': {. # m3u8 download. 'skip_download': True,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\radiode.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1820
Entropy (8bit):	4.7185703392710385
Encrypted:	false
SSDEEP:	48:PugtUPci2qJOXNqa7Xjl42sBKEkR8Uq7C8ErureOErbrNrjaf7SXrs9IBTSAt0+L:jtUP3Osaf+kR8U38Ei6OEHBf07crs9Ij
MD5:	22C6C79F82E5CB23B7635432FD98ACC0
SHA1:	0158FEBCD203C974BBCBEE5CEE5E5D9B1D1F70DA
SHA-256:	5344542AE4409AD456AF763384268C9FA7136668DFEE4E5B00541E307580302B
SHA-512:	952D06F2B4C094C158C7C759F607F6A2AB8965F5110882C81868722DD6218068D9355E74787808CA203256EBC931F31B1E5292399CD907E3E0AFFD89AEC8D0D9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class RadioDeIE(InfoExtractor):. IE_NAME = 'radio.de'. _VALID_URL = r'https?://(?P<id>.+?)\.(?:radio\.(?:de\|at\|fr\|pt\|es\|pl\|it)\|rad\.io)'. _TEST = {. 'url': 'http://ndr2.radio.de/',. 'info_dict': {. 'id': 'ndr2',. 'ext': 'mp3',. 'title': 're:^NDR 2 [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': 'md5:591c49c702db1a33751625ebfb67f273',. 'thumbnail': r're:^https?://.\.png',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. radio_id = self._match_id(url). webpage = self._download_webpage(url, radio_id). jscode = self._search_regex(. r"'components/station/stationService':\s\{\s'?station'?:\s(\{.?\s\}),\n",. webpage, 'broadcast').. broadcast = self._parse_json(jscode, radio

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\radiofrance.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2089
Entropy (8bit):	4.694446177416249
Encrypted:	false
SSDEEP:	48:+uvl/ATog2DvjlwfF3kbXlCXLAXYh23WXhJRSp9mp3jxQBT06NK9:DSTog2vjlZZAvh23ISp9mpzSBT06Nu
MD5:	77133CA626CE35B8F22C79FCD1299B26
SHA1:	9B47168C1977D418866ACE03C0C80E07CF4450AA
SHA-256:	24C7441F6B9C7EFC36362279F3E1DC5CE1268E06C02148A587A3B5409AD3178A
SHA-512:	84B8095C1421590BD17784978F0D527C504579F9B20E55FE484A33645090DD56C00C7CD18F363796F19B3A8E6963FBE44FED4A7C978E7BDEEE52E3069470478B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class RadioFranceIE(InfoExtractor):. _VALID_URL = r'^https?://maison\.radiofrance\.fr/radiovisions/(?P<id>[^?#]+)'. IE_NAME = 'radiofrance'.. _TEST = {. 'url': 'http://maison.radiofrance.fr/radiovisions/one-one',. 'md5': 'bdbb28ace95ed0e04faab32ba3160daf',. 'info_dict': {. 'id': 'one-one',. 'ext': 'ogg',. 'title': 'One to one',. 'description': "Plut.t que d'imaginer la radio de demain comme technologie ou comme cr.ation de contenu, je veux montrer que quelles que soient ses .volutions, j'ai l'intime conviction que la radio continuera d'.tre un grand m.dia de proximit. pour les auditeurs.",. 'uploader': 'Thomas Hercou.t',. },. }.. def _real_extract(self, url):. m = re.match(self._VALID_URL, url). video_id = m.group('id').. webpage = self._download_webpage(url,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\radiojavan.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2761
Entropy (8bit):	4.612141670996685
Encrypted:	false
SSDEEP:	48:PurnrphC79lloajXjBJYDZxygckiGMzXyfuWBTXVmeVUezlKZOSfYZ+XtN0gly7L:GnrnC79voaUDZxyg3iGMzXyfuWBTcoIq
MD5:	64021E4DAD9394149B12EBA23608D2B2
SHA1:	40E5C0818C8B13865388DFC77AFCAD71599FAB76
SHA-256:	DF62EACD2E25249A6D83783092DC677A32A228B4080C7700F8447429D5F05098
SHA-512:	26B2C5A013C17E8A0A9D2447AC2144A42109CF923B789143560EFE6750EA62E052854D227840CC1E9F425D46DD8407627B2049EA482D1290B482470135E89A90
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_resolution,. str_to_int,. unified_strdate,. urlencode_postdata,. urljoin,.)...class RadioJavanIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?radiojavan\.com/videos/video/(?P<id>[^/]+)/?'. _TEST = {. 'url': 'http://www.radiojavan.com/videos/video/chaartaar-ashoobam',. 'md5': 'e85208ffa3ca8b83534fca9fe19af95b',. 'info_dict': {. 'id': 'chaartaar-ashoobam',. 'ext': 'mp4',. 'title': 'Chaartaar - Ashoobam',. 'thumbnail': r're:^https?://.*\.jpe?g$',. 'upload_date': '20150215',. 'view_count': int,. 'like_count': int,. 'dislike_count': int,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. download_host = self._download_json(. 'https://www.radiojavan.com/videos/video_host', video_id,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rai.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18471
Entropy (8bit):	4.708639692577113
Encrypted:	false
SSDEEP:	384:kSSQyLgPvS6bwLtuOWji9ucb8V6NYuqeAO/SvF+i/FOuLyLoXL27nvOfOdIkyzn4:oj0y6bOWji9Xb8V8aFLykXRKuTgDzksd
MD5:	485516C32A5FB521728C039D6057464B
SHA1:	F78E3A112236C42D13E3C44435EB7C64ECF671B1
SHA-256:	E7F032E40B9A28C54FC0A882B63B58AED47720E46D2585A5397B7A24B3B318CF
SHA-512:	1BA200C7951F158B736CFC62510D3759C6BBACBB2F125F2F04E09F5E935F420D1A25ADCF41D72E207E677AEEA731997A10199E46524CAB0A7519AA6AD857BD59
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_urlparse,. compat_str,.).from ..utils import (. ExtractorError,. determine_ext,. find_xpath_attr,. fix_xml_ampersands,. GeoRestrictedError,. int_or_none,. parse_duration,. strip_or_none,. try_get,. unescapeHTML,. unified_strdate,. unified_timestamp,. update_url_query,. urljoin,. xpath_text,.)...class RaiBaseIE(InfoExtractor):. _UUID_RE = r'[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}'. _GEO_COUNTRIES = ['IT']. _GEO_BYPASS = False.. def _extract_relinker_info(self, relinker_url, video_id):. if not re.match(r'https?://', relinker_url):. return {'formats': [{'url': relinker_url}]}.. formats = []. geoprotection = None. is_live = None. duration = None.. for platform in ('mon', 'flash', 'native'):. relinker = self._download_xml(.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\raywenderlich.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6169
Entropy (8bit):	4.409613398479906
Encrypted:	false
SSDEEP:	96:7chYhD8SSHMxHVCJtor1YL8cbYlxZ/pgSVBDtXtvwQppLb4ZRuQUngN6cuK5yRYl:j8rsnrhx5pg/SL8iTq8yrYV97c
MD5:	FC0E9039044FEE8A0AA42205F82D847C
SHA1:	728021A97C1BB6DE077063F9FADF7A7B28A91791
SHA-256:	45841C68FA63D229B575BC9CF90B04DB1869D65C4A5E06A59AA82F7064BD4F21
SHA-512:	2BF1632095BAB5388987F82E9AA26ED69A5C3FD59EBFFCE333C97824025D142D57B32E1A7857363A1019ADDEE5715D88CFD22BF8E9076371AE4D15419555CC09
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .vimeo import VimeoIE.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. merge_dicts,. try_get,. unescapeHTML,. unified_timestamp,. urljoin,.)...class RayWenderlichIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://. (?:. videos\.raywenderlich\.com/courses\|. (?:www\.)?raywenderlich\.com. )/. (?P<course_id>[^/]+)/lessons/(?P<id>\d+). '''.. _TESTS = [{. 'url': 'https://www.raywenderlich.com/3530-testing-in-ios/lessons/1',. 'info_dict': {. 'id': '248377018',. 'ext': 'mp4',. 'title': 'Introduction',. 'description': 'md5:804d031b3efa9fcb49777d512d74f722',. 'timestamp': 1513906277,. 'upload_date': '20171

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rbmaradio.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2406
Entropy (8bit):	4.796070748253367
Encrypted:	false
SSDEEP:	48:Puef1FGKRxKNWN+/JSHIdfFk9El1NuX+HAxxqszknaXxaTyjbef23NlIcAt/8cSL:jFGKRwWN+/QIyioxxGnAaTyjby23NlIk
MD5:	2BC6E6EF84ADFE7CD5F076B750AF99F4
SHA1:	3C5789A3B1D18BACCCD93CEDBC53360DAA11A0BC
SHA-256:	2FA3EB6A72C1D35CFAA26154A2D80E094C9F67174EE505726B82851CB9D46346
SHA-512:	B7A289564CAE2D0D779F055D4136505FE547B9B5A4583A651E4D574D5817375E5A23DB6A0DC63CE632E5F014B84E7A5CC303200B7C53A123B675EE751ACB6F50
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. clean_html,. int_or_none,. unified_timestamp,. update_url_query,.)...class RBMARadioIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:rbmaradio\|redbullradio)\.com/shows/(?P<show_id>[^/]+)/episodes/(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'https://www.rbmaradio.com/shows/main-stage/episodes/ford-lopatin-live-at-primavera-sound-2011',. 'md5': '6bc6f9bcb18994b4c983bc3bf4384d95',. 'info_dict': {. 'id': 'ford-lopatin-live-at-primavera-sound-2011',. 'ext': 'mp3',. 'title': 'Main Stage - Ford & Lopatin at Primavera Sound',. 'description': 'md5:d41d8cd98f00b204e9800998ecf8427e',. 'thumbnail': r're:^https?://.*\.jpg',. 'duration': 2452,. 'timestamp': 1307103164,. 'upload_date': '20110603',. },. }.. def _real_extract

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rds.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2800
Entropy (8bit):	4.909048621952197
Encrypted:	false
SSDEEP:	48:+ug/QY7V4fVXcc3vXccl00v141vv3tfJoXhhIwW5z6gvVE5XBfymuVyPVKx9yAtj:cQYJaVMuvMEjd41vv9fJam1fu5Ry5VEm
MD5:	16B5F3BB9F3F32708B8FC936E2DB86D3
SHA1:	58E79FB65482EEFA6FC8F83AAB6CED004D50FE95
SHA-256:	9473EDB5768873EF0DA7A0A3E7633C734B5FA2F3788B279DD4A29B3E803879CC
SHA-512:	0087BD2653205F0A8EFD6ACD0E78F8EBFEC8264D3516CE382D624BBDC07BE3EB0BA771017DEE0CDC1DBE446BD5AB77A25E2A024B60AD1D04311F1D653A7586BC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. parse_duration,. parse_iso8601,. js_to_json,.).from ..compat import compat_str...class RDSIE(InfoExtractor):. IE_DESC = 'RDS.ca'. _VALID_URL = r'https?://(?:www\.)?rds\.ca/vid(?:[e.]\|%C3%A9)os/(?:[^/]+/)*(?P<id>[^/]+)-\d+\.\d+'.. _TESTS = [{. 'url': 'http://www.rds.ca/videos/football/nfl/fowler-jr-prend-la-direction-de-jacksonville-3.1132799',. 'info_dict': {. 'id': '604333',. 'display_id': 'fowler-jr-prend-la-direction-de-jacksonville',. 'ext': 'flv',. 'title': 'Fowler Jr. prend la direction de Jacksonville',. 'description': 'Dante Fowler Jr. est le troisi.me choix du rep.chage 2015 de la NFL. ',. 'timestamp': 1430397346,. 'upload_date': '20150430',. 'duration': 154.354,. 'age_limit': 0,. }. }, {. 'url': 'http://www.rds.ca/v

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\redbulltv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4890
Entropy (8bit):	4.9209302197789215
Encrypted:	false
SSDEEP:	96:v+LU7aJuNsftlXluorpyNOefU0BcQtZUGmaKd97hBTZN64B2pTX3rS6NOyZQL/fU:GI7aINoXPrsNOk9lUGjKd97vTlB+26Nh
MD5:	55EA6E1C7C32215AE3554ED699207AC6
SHA1:	F008266CBD1ADD860ABA656414FEB4996CBF27A7
SHA-256:	98A78933198D7D9995E4B0586AD0E43AAB8BB3D20B7B3A9F2F90A966B92C91D6
SHA-512:	06EF292B1096FC4D0DF656EABDDA37809BA67EA2F4D046438273F9F24426D501BAE8BA350974281FB2585DEC332E07F2E585AB789FECE32F8E0D5DB401EE7F3E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. float_or_none,. ExtractorError,.)...class RedBullTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?redbull(?:\.tv\|\.com(?:/[^/]+)?(?:/tv)?)(?:/events/[^/]+)?/(?:videos?\|live)/(?P<id>AP-\w+)'. _TESTS = [{. # film. 'url': 'https://www.redbull.tv/video/AP-1Q6XCDTAN1W11',. 'md5': 'fb0445b98aa4394e504b413d98031d1f',. 'info_dict': {. 'id': 'AP-1Q6XCDTAN1W11',. 'ext': 'mp4',. 'title': 'ABC of... WRC - ABC of... S1E6',. 'description': 'md5:5c7ed8f4015c8492ecf64b6ab31e7d31',. 'duration': 1582.04,. },. }, {. # episode. 'url': 'https://www.redbull.tv/video/AP-1PMHKJFCW1W11',. 'info_dict': {. 'id': 'AP-1PMHKJFCW1W11',. 'ext': 'mp4',. 'title': 'Grime - Hashtags S2E4',. 'descri

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\reddit.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4208
Entropy (8bit):	4.687140208425004
Encrypted:	false
SSDEEP:	96:JOc7AXTdvlroZcHBTr6NztQrSN7xdX9rjagS1hHDraS6SezaJkfX9IBo/ird:JOuYTdvlroZchTr6NRQrSZ9fS1hHHaSn
MD5:	14C57918DCD8A5A78255FB9EE7C0E7A0
SHA1:	3DA18BB760BA048ECE6C959E9D3C81AC19205602
SHA-256:	1198B2E9807C1E0A576737BAE2D40B5AB7E8D633F80BA31EE177AF50013020CD
SHA-512:	EE7AAFD5B57D20FDD973341CD755939B6867835EA40C870774634BD90EEC17386D33BAE47278D8CED2FFF53B2CA4766F2891EF85CD2355EA07F748217D9DE1C9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. float_or_none,. url_or_none,.)...class RedditIE(InfoExtractor):. _VALID_URL = r'https?://v\.redd\.it/(?P<id>[^/?#&]+)'. _TEST = {. # from https://www.reddit.com/r/videos/comments/6rrwyj/that_small_heart_attack/. 'url': 'https://v.redd.it/zv89llsvexdz',. 'md5': '0a070c53eba7ec4534d95a5a1259e253',. 'info_dict': {. 'id': 'zv89llsvexdz',. 'ext': 'mp4',. 'title': 'zv89llsvexdz',. },. 'params': {. 'format': 'bestvideo',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url).. formats = self._extract_m3u8_formats(. 'https://v.redd.it/%s/HLSPlaylist.m3u8' % video_id, video_id,. 'mp4', entry_protocol='m3u8_native', m3u8_id='hls', fatal=False).. formats.extend(self._extract_mpd_formats

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\redtube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4489
Entropy (8bit):	4.621998385855776
Encrypted:	false
SSDEEP:	96:VW9QNLd6va8cylZo20HoFivEJF/HJ8BTegY/MKEBfA9ZtN0E8R6ND:sMkv9ZoZHwcE/pUT1BysR6ND
MD5:	B1184ED4A4AF333E69ECDCC0DB77CDC0
SHA1:	FF217EC5DA3D711569B6ED628B9884B6473A527B
SHA-256:	BBF18E138C5DBF421172F55621B8875CFB476ECF7FCD3F46AB07394B69F9AE5A
SHA-512:	97E91107995AB4DC518B464ABA822FC3D50215E78C25DD2982C82934E66509F8FDB9A0A403A95889DB09E056BFBAE62C34894E38B34A33164157B2A8F48D1ACF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none,. merge_dicts,. str_to_int,. unified_strdate,. url_or_none,.)...class RedTubeIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\.\|de.)?redtube\.com/\|embed\.redtube\.com/\?.*?\bid=)(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.redtube.com/66418',. 'md5': 'fc08071233725f26b8f014dba9590005',. 'info_dict': {. 'id': '66418',. 'ext': 'mp4',. 'title': 'Sucked on a toilet',. 'upload_date': '20110811',. 'duration': 596,. 'view_count': int,. 'age_limit': 18,. }. }, {. 'url': 'http://embed.redtube.com/?bgcolor=000000&id=1443286',. 'only_matching': True,. }].. @staticmethod. def _extract_urls(webpage):. return re.findall(. r'<iframe[^>]+?src=["\'](?P<url>(?:https?:)?//embed\.redtube\.co

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\regiotv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (346)
Category:	dropped
Size (bytes):	2261
Entropy (8bit):	5.030497986852434
Encrypted:	false
SSDEEP:	48:+uIhfM7eN7CvRtfjXhkuBAvQEVSuvl8PgW7wkM9wToHRKU0QVGMAAtc:0pM7eN7CvffatvQab9dKPIHtc
MD5:	345A692209044A295038A651B9ACAAE0
SHA1:	20DBDC5811772C6E0042625D808B425C32B2AA10
SHA-256:	440E9541E72C0A0CB3D63006842B0F74F967A652F1FF5391621DE1EA62088256
SHA-512:	4825E79EA68CA4A77A86E6E7BD8799CBBA0D48A41A6F3A906F932DC18EC73C59B4B4B69BAEFF414B88135BF15C89B2D833DF79AB69BC931662613B3AFED92DAB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor..from ..utils import (. sanitized_Request,. xpath_text,. xpath_with_ns,.)...class RegioTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?regio-tv\.de/video/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://www.regio-tv.de/video/395808.html',. 'info_dict': {. 'id': '395808',. 'ext': 'mp4',. 'title': 'Wir in Ludwigsburg',. 'description': 'Mit unseren zuckers..en Adventskindern, au.erdem besuchen wir die Abendsterne!',. }. }, {. 'url': 'http://www.regio-tv.de/video/395808',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. key = self._search_regex(. r'key\s:\s(["\'])(?P<key>.+?)\1', webpage, 'key', group='key'). title = self._og_search_title(webpage).. SO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rentv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4156
Entropy (8bit):	5.095850204253975
Encrypted:	false
SSDEEP:	96:tO4U5X1CNvof7M23aa6aLOG3vNBTuxz/NC6NWLG7oND4LoqImCrAfJsDFMkf:cVz8ve7P3aeLOG3vTTui6N65D4LoqTz+
MD5:	AA95D08F6F92581F2A47A4BC92CB1E39
SHA1:	EE0F14D67CFEE3204AB1BAFAB67562E028891504
SHA-256:	4307C87D5930617CAF65098127CC72263C73E7927DFC50177EE73DE14FA6EC49
SHA-512:	0E01128B9AFE59829D9AA7D986935C6082CEEFE4F345C74D1450AA393ACBF646CC2C6CD4B0975D57FAD017C372BCA4A3838A48C7002CFF4D3B16A6F499E3EFEC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. determine_ext,. int_or_none,. url_or_none,.)...class RENTVIE(InfoExtractor):. _VALID_URL = r'(?:rentv:\|https?://(?:www\.)?ren\.tv/(?:player\|video/epizod)/)(?P<id>\d+)'. _TESTS = [{. 'url': 'http://ren.tv/video/epizod/118577',. 'md5': 'd91851bf9af73c0ad9b2cdf76c127fbb',. 'info_dict': {. 'id': '118577',. 'ext': 'mp4',. 'title': '.............. ..........: "........ ....... .......... XXI ...."',. 'timestamp': 1472230800,. 'upload_date': '20160826',. }. }, {. 'url': 'http://ren.tv/player/118577',. 'only_matching': True,. }, {. 'url': 'rentv:118577',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\restudy.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	4.668208560940972
Encrypted:	false
SSDEEP:	24:zi8lFvPC6fqFSU/7Yl2ydHe4D1qHPiA0NSgtfeIXhgtdhDcHLhDCuqgNYaqUjWdo:+u1zf8t7C1R1qviFNBtfjXhkdVuVlqgD
MD5:	AC2421C539964FA5BCEEAD23FF95A136
SHA1:	1D8A8E357FEEE2BEF9961278BF05A8DC9F11E652
SHA-256:	31DC50E2A83BDAFAC1CD290198FF1FD61D115A52B0A269859B765447740E8069
SHA-512:	2FD08115EB9ABF4E1D5B85B05E7D8AFDC5570856DE76012F0A495CFE2F0746098F1D9C50C45A4C47B8BE6C18B064EF28930EF207A6AE8772C3CE2D91126CF77E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class RestudyIE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:www\|portal)\.)?restudy\.dk/video/[^/]+/id/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://www.restudy.dk/video/play/id/1637',. 'info_dict': {. 'id': '1637',. 'ext': 'flv',. 'title': 'Leiden-frosteffekt',. 'description': 'Denne video er et eksperiment med flydende kv.lstof.',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }, {. 'url': 'https://portal.restudy.dk/video/leiden-frosteffekt/id/1637',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. title = self._og_search_title(webpage).strip(). description = self._og_search_description(webpage).strip().. formats = self

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\reuters.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2438
Entropy (8bit):	4.636007481881004
Encrypted:	false
SSDEEP:	48:+u4AFQ9vDyFJqrajXjlROxZnTayhRxnBG8KBXZ4tABOI4Akn0WWZmBTNlPw8F46u:EAIbUJqraHgdTay/xnBG3rOITW1BTNlQ
MD5:	F3B8638222F9DA191F394A7FD2CE89EC
SHA1:	0F54C3C08BFFC09766DE9CE4381512A64C19F26C
SHA-256:	4438440F891FE69745B701697FEE6ADC27368AFF16D9EBE0B5F8C797B5BCFF25
SHA-512:	C8F6D1A6C636F98511F04F28091A58489DA339B6546AA565ADFC293D06C16EEC909311177401AC469FEE11FC636C4D554A99F50576F77D8B055CF2D830671514
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. js_to_json,. int_or_none,. unescapeHTML,.)...class ReutersIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?reuters\.com/.?\?.?videoId=(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.reuters.com/video/2016/05/20/san-francisco-police-chief-resigns?videoId=368575562',. 'md5': '8015113643a0b12838f160b0b81cc2ee',. 'info_dict': {. 'id': '368575562',. 'ext': 'mp4',. 'title': 'San Francisco police chief resigns',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(. 'http://www.reuters.com/assets/iframe/yovideo?videoId=%s' % video_id, video_id). video_data = js_to_json(self._search_regex(. r'(?s)Reuters\.yovideo\.drawPlayer$({.*?})$;',. webpage, 'video data')).. def get_j

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\reverbnation.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1627
Entropy (8bit):	4.686370645619891
Encrypted:	false
SSDEEP:	24:1R8lFvFoG9jfw/p1cZCU/LFluL86fXXtBBpxW12/rXlDpi32l4ifPiTvNcNyL5lM:PuwwfEZ0246fXXtBBpxWs/rVkJ7M
MD5:	6543CA2EDD48D95D57673631DDC4649D
SHA1:	5AEC993F85AD0D07878E603D124E74E54A01267E
SHA-256:	F4D497C6A285196CD3711924EEF8344832FEEB3EDEDEC06932A818A12519AF8F
SHA-512:	5272F1DA3E64FFFB8631CD00AFAC6E07B607B6E61D03751567A192780B8D15826D7A55F9E725814541D341F0AB53C1CA63B7C5EA3DAC95BF7EA82DC8C09F8B96
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. qualities,. str_or_none,.)...class ReverbNationIE(InfoExtractor):. _VALID_URL = r'^https?://(?:www\.)?reverbnation\.com/.?/song/(?P<id>\d+).?$'. _TESTS = [{. 'url': 'http://www.reverbnation.com/alkilados/song/16965047-mona-lisa',. 'md5': 'c0aaf339bcee189495fdf5a8c8ba8645',. 'info_dict': {. 'id': '16965047',. 'ext': 'mp3',. 'title': 'MONA LISA',. 'uploader': 'ALKILADOS',. 'uploader_id': '216429',. 'thumbnail': r're:^https?://.*\.jpg',. },. }].. def _real_extract(self, url):. song_id = self._match_id(url).. api_res = self._download_json(. 'https://api.reverbnation.com/song/%s' % song_id,. song_id,. note='Downloading information of song %s' % song_id. ).. THUMBNAILS = ('thumbnail', 'image'). quality = qualities(TH

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\revision3.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6717
Entropy (8bit):	4.543051955670404
Encrypted:	false
SSDEEP:	192:lq949SfGYiN9sgO+24TE6NXm7JmPacU8xmv:lG49SKtO+24TE6NXmtmXU8xk
MD5:	15A880DDE99C58737E5D779786A16BFF
SHA1:	0177E099260016B08C37C5E217DAE5B73EF8C48E
SHA-256:	C896634FCABA3168D69F725CA18B41CCAD9E50A737F6AE58A8622965B8B0A827
SHA-512:	629E18735CE16C074A3D39FF0F6E90B02A95C1A3772F0059CE6E03EC4BBA2F4D9593629194958C463E6C0846097C41545A7E48A64443FC22DDAD110BDB7CCC78
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_iso8601,. unescapeHTML,. qualities,.)...class Revision3EmbedIE(InfoExtractor):. IE_NAME = 'revision3:embed'. _VALID_URL = r'(?:revision3:(?:(?P<playlist_type>[^:]+):)?\|https?://(?:(?:(?:www\|embed)\.)?(?:revision3\|animalist)\|(?:(?:api\|embed)\.)?seekernetwork)\.com/player/embed\?videoId=)(?P<playlist_id>\d+)'. _TEST = {. 'url': 'http://api.seekernetwork.com/player/embed?videoId=67558',. 'md5': '83bcd157cab89ad7318dd7b8c9cf1306',. 'info_dict': {. 'id': '67558',. 'ext': 'mp4',. 'title': 'The Pros & Cons Of Zoos',. 'description': 'Zoos are often depicted as a terrible place for animals to live, but is there any truth to this?',. 'uploader_id': 'dnews',. 'uploader': 'DNews',. }. }. _API_KEY = 'ba9c7

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rice.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4580
Entropy (8bit):	4.596733685863675
Encrypted:	false
SSDEEP:	96:kSw5q73nintvnOg5x/zoa5mOZm20IuGXpOwXrkOkPJSDrBTe1itDNRF6Ng:kSws73itvOgLfVjPtZOYmcDdTX6Ng
MD5:	986BF3E4ABC7F9C7EC5C3C83476A917F
SHA1:	A4E93177850BC1ECBDEF1DAF6C43B36D87B87A7B
SHA-256:	7555A806B670725FD555FB37CEC0754556F9D265916EB0B7F65D4448B94987DD
SHA-512:	4BE20D60B5CB4AA37DE0AA9A37682305833FDEBCDE254872C57C944144305F02BEDC27FA30ABB859001BCD63EA7B677937DE7A53ED3218EF485AFA95A844BE84
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_parse_qs.from ..utils import (. xpath_text,. xpath_element,. int_or_none,. parse_iso8601,. ExtractorError,.)...class RICEIE(InfoExtractor):. _VALID_URL = r'https?://mediahub\.rice\.edu/app/[Pp]ortal/video\.aspx\?(?P<query>.+)'. _TEST = {. 'url': 'https://mediahub.rice.edu/app/Portal/video.aspx?PortalID=25ffd62c-3d01-4b29-8c70-7c94270efb3e&DestinationID=66bc9434-03bd-4725-b47e-c659d8d809db&ContentID=YEWIvbhb40aqdjMD1ALSqw',. 'md5': '9b83b4a2eead4912dc3b7fac7c449b6a',. 'info_dict': {. 'id': 'YEWIvbhb40aqdjMD1ALSqw',. 'ext': 'mp4',. 'title': 'Active Learning in Archeology',. 'upload_date': '20140616',. 'timestamp': 1402926346,. }. }. _NS = 'http://schemas.datacontract.org/2004/07/ensembleVideo.Data.Service.Contracts.Models.Player.Config'.. def _real_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rmcdecouverte.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2017
Entropy (8bit):	5.0133036634516355
Encrypted:	false
SSDEEP:	48:+uGfiBdYfDUdxsbKPNUPlODgU/Sb55dfFfVdIhLFCXIOGgBWY7YoFtT:ClWxsbKPDY95b2LEIZPYztT
MD5:	387664FD1CF50438A721650F51803334
SHA1:	EF4A6277E695A180DE8E319D90960F8F648AC8DD
SHA-256:	A53F391BF1C40FA2C8372A2D22B7A70F0EB2A88653B2854855197E8214A4E61E
SHA-512:	B67FB4EE1825F9FCB95D22007A52252467C88ACCDBEDC976AEECCED43FD8711F08C81C3995AC8C8DCE80C2CDC8D7962EE99F45529CA256026E2677073E1DF145
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .brightcove import BrightcoveLegacyIE.from ..compat import (. compat_parse_qs,. compat_urlparse,.).from ..utils import smuggle_url...class RMCDecouverteIE(InfoExtractor):. _VALID_URL = r'https?://rmcdecouverte\.bfmtv\.com/(?:(?:[^/]+/)*program_(?P<id>\d+)\|(?P<live_id>mediaplayer-direct))'.. _TESTS = [{. 'url': 'https://rmcdecouverte.bfmtv.com/wheeler-dealers-occasions-a-saisir/program_2566/',. 'info_dict': {. 'id': '5983675500001',. 'ext': 'mp4',. 'title': 'CORVETTE',. 'description': 'md5:c1e8295521e45ffebf635d6a7658f506',. 'uploader_id': '1969646226001',. 'upload_date': '20181226',. 'timestamp': 1545861635,. },. 'params': {. 'skip_download': True,. },. 'skip': 'only available for a week',. }, {. # live, geo restricted, bypassable.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ro220.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	4.860110414173715
Encrypted:	false
SSDEEP:	24:1R8lFvbBcuKa6uhwUA+4P/LdlejGglqxqpaeIXhgtmGBnttMhDcehDCehDU5aBxn:PuzfKhuhz/4nLCGxqpajXhk/nttMVzVd
MD5:	2802024D21B3CC69437C21ACC30527F3
SHA1:	2978F6AB20F6AC56419B7DF875D537753493399E
SHA-256:	ECCA7664EBBB69B05B3FECEDF41B7C92E9A3FC52F1789C4169214EBF90BAFC16
SHA-512:	423727B6134065AE1B2828905E1751D0427001523FC9747A24C00A6F3EF264E311375FE369234248F87DB77E13DB15D1C0252AD7D5016A62891DD89A679E99B4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urllib_parse_unquote...class Ro220IE(InfoExtractor):. IE_NAME = '220.ro'. _VALID_URL = r'(?x)(?:https?://)?(?:www\.)?220\.ro/(?P<category>[^/]+)/(?P<shorttitle>[^/]+)/(?P<id>[^/]+)'. _TEST = {. 'url': 'http://www.220.ro/sport/Luati-Le-Banii-Sez-4-Ep-1/LYV6doKo7f/',. 'md5': '03af18b73a07b4088753930db7a34add',. 'info_dict': {. 'id': 'LYV6doKo7f',. 'ext': 'mp4',. 'title': 'Luati-le Banii sez 4 ep 1',. 'description': r're:^Iata-ne reveniti dupa o binemeritata vacanta\. +Va astept si pe Facebook cu pareri si comentarii.$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). url = compat_urllib_parse_unquote(self._search_regex(. r'(?s)clip\s:\s{.?url\s:\s*\'([^\']+)\'', webpage, 'url')). title =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rockstargames.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2248
Entropy (8bit):	4.618322615402058
Encrypted:	false
SSDEEP:	48:+uoJofz1Xjd92bD6X/ztvgLtfjXXBAtW18LLDMyDfQ9OPMTmq8DfBTWDqxRqBcvA:MJKz1Xjd9mD6X/ztvghfq016gyfPa8jK
MD5:	EF69311409B61FB6033E54EF24843A0B
SHA1:	F52ECEDFA313DFD78B5F5B2800905F64407251D5
SHA-256:	015DC480704BA27465496A9BCC6EB4408029C1E155B81DBF7CAAC982817F5F55
SHA-512:	0E1EB5EC085F95E17E721E46105F705989664CC160130EA17A45D9D31CDF4ED705E1227109543179AE45CC5031E0937B65DDF8A32A6B2090752919619E329F75
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_iso8601,.)...class RockstarGamesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rockstargames\.com/videos(?:/video/\|#?/?\?.\bvideo=)(?P<id>\d+)'. _TESTS = [{. 'url': 'https://www.rockstargames.com/videos/video/11544/',. 'md5': '03b5caa6e357a4bd50e3143fc03e5733',. 'info_dict': {. 'id': '11544',. 'ext': 'mp4',. 'title': 'Further Adventures in Finance and Felony Trailer',. 'description': 'md5:6d31f55f30cb101b5476c4a379e324a3',. 'thumbnail': r're:^https?://.\.jpg$',. 'timestamp': 1464876000,. 'upload_date': '20160602',. }. }, {. 'url': 'http://www.rockstargames.com/videos#/?video=48',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. video = self._download

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\roosterteeth.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5781
Entropy (8bit):	4.678496260325426
Encrypted:	false
SSDEEP:	96:3XbXqCf4xCcUL00VtucOYNiOhtvephGfJsrMu5dshBTUdhGcFVh686NR9:blPtL02tCYk09egJMfdsvTIxt6Nz
MD5:	14E53367E81A7DB51DB30E2FA6C1369D
SHA1:	E115AB12FFF2DFBA32B597322598A395A1CEE1BA
SHA-256:	FF2F026D1DE50AEECE29A8CA342598B63A8778660B0FDFB4516321DD584FD4C9
SHA-512:	D06835764006A862599A1E22B46CBA9895898F12E3CE5922091C8B1281374AC3D0C244A1FE5F19A478CD52B9F2154EBE4C4D71CD4B6C5D3F93C60395426C4CCE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. ExtractorError,. int_or_none,. str_or_none,. urlencode_postdata,.)...class RoosterTeethIE(InfoExtractor):. _VALID_URL = r'https?://(?:.+?\.)?roosterteeth\.com/episode/(?P<id>[^/?#&]+)'. _LOGIN_URL = 'https://roosterteeth.com/login'. _NETRC_MACHINE = 'roosterteeth'. _TESTS = [{. 'url': 'http://roosterteeth.com/episode/million-dollars-but-season-2-million-dollars-but-the-game-announcement',. 'md5': 'e2bd7764732d785ef797700a2489f212',. 'info_dict': {. 'id': '9156',. 'display_id': 'million-dollars-but-season-2-million-dollars-but-the-game-announcement',. 'ext': 'mp4',. 'title': 'Million Dollars, But... The Game Announcement',. 'description': 'md5:168a54b40e228e79f4ddb141e89fe4f5',. 'thumbnail': r

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rottentomatoes.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	4.858136988026474
Encrypted:	false
SSDEEP:	24:1R8lFvQGmDOw8tV/X1Ldl5k8e7QCVeIXjlgthZBx+tnVw5FHwI8W5DhmXblDDc4:PuSitPX1L68eXVjXjlkhZBGnVw3b8W52
MD5:	57FEA2570FB58190EB10AA23FEC2996B
SHA1:	47991A2F256761302A132770DF4F333B76F1DD4B
SHA-256:	133ED8F58CEB2F5A8DD618DEDAB3207CFF7EC7E0707917EDE522151AF5298F33
SHA-512:	46AF63AE577F27D9424FABB28654922529E1C39507350C6F88AA31D3DF6E1796EA84CB6357F8BD12DA6A9181533E9997C6D6246E73CB4DB4424ADCC4781E8EBC
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .internetvideoarchive import InternetVideoArchiveIE...class RottenTomatoesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rottentomatoes\.com/m/[^/]+/trailers/(?P<id>\d+)'.. _TEST = {. 'url': 'http://www.rottentomatoes.com/m/toy_story_3/trailers/11028566/',. 'info_dict': {. 'id': '11028566',. 'ext': 'mp4',. 'title': 'Toy Story 3',. 'description': 'From the creators of the beloved TOY STORY films, comes a story that will reunite the gang in a whole new way.',. 'thumbnail': r're:^https?://.*\.jpg$',. },. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). iva_id = self._search_regex(r'publishedid=(\d+)', webpage, 'internet video archive id').. return {. '_type': 'url_transparent',. 'url': 'http://video.in

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\roxwel.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1970
Entropy (8bit):	4.642009071913589
Encrypted:	false
SSDEEP:	48:PuKdqQP0U2cO0iN0R1qadfFQVFSKhYYrCsOId0SSP9WBs:n4QPV2/0iN02aCduIqSSFWBs
MD5:	B963221E24579D4981FE40872E4FC2E6
SHA1:	74BADDECA3A59F390B3FDDEA567D8F209D395CE2
SHA-256:	D478BD820C0802675F3352DCDAFE27453C3EC6EEF76914BC1E1B3CF22713B660
SHA-512:	E77D2A5B71CCA9B9C3985DFBF0FC723997705DA664771F91B5B9467EFAD9BDED855DB0792456D961B3059E34BBD4FD22B7BBDA7366DBD7D7F58DC8D322788AC8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import unified_strdate, determine_ext...class RoxwelIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?roxwel\.com/player/(?P<filename>.+?)(\.\|\?\|$)'.. _TEST = {. 'url': 'http://www.roxwel.com/player/passionpittakeawalklive.html',. 'info_dict': {. 'id': 'passionpittakeawalklive',. 'ext': 'flv',. 'title': 'Take A Walk (live)',. 'uploader': 'Passion Pit',. 'uploader_id': 'passionpit',. 'upload_date': '20120928',. 'description': 'Passion Pit performs "Take A Walk\" live at The Backyard in Austin, Texas. ',. },. 'params': {. # rtmp download. 'skip_download': True,. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). filename = mobj.group('filename'). info_url = 'http://www.roxwel.com/api/videos/%s' %

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rozhlas.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	5.03556703485529
Encrypted:	false
SSDEEP:	48:+udIYlfy18qSvyu3tfeXhFvXa3pXDXFYhgEK18cQ8c3M:RIay18qSvyu9fmi5X+eEK1818kM
MD5:	E7A22789AB028781CCBFFE9B97766B92
SHA1:	C918D36D1E060506A0047C039941B6F8F44DBA1F
SHA-256:	1A32317A4C02EBEE9EE6E7A1AD3D85F5BAA622952BE34E1512878D3184D67824
SHA-512:	431D891D9F29215FE3B12121998333469DAD85A073E4B85126DE7C4C3B994733C94D2B127E91925B830FECA58FCC148BD487A6C978CF354CADD81CBA643D4A35
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. remove_start,.)...class RozhlasIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?prehravac\.rozhlas\.cz/audio/(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'http://prehravac.rozhlas.cz/audio/3421320',. 'md5': '504c902dbc9e9a1fd50326eccf02a7e2',. 'info_dict': {. 'id': '3421320',. 'ext': 'mp3',. 'title': 'Echo Pavla Klus.ka (30.06.2015 21:00)',. 'description': 'Osmdes.tiny Terryho Rileyho jsou skv.lou p..le.itost. prolet.t se elektronick.mi i akustick.mi d.ly zakladatatele minimalismu, kter. je aktivn. u. p.es pades.t let'. }. }, {. 'url': 'http://prehravac.rozhlas.cz/audio/3421320/embed',. 'only_matching': True,. }].. def _real_extract(self, url):. audio_id = self._match_id(url).. webpage = self._download_webpage(. 'http

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rtbf.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5558
Entropy (8bit):	4.614158567797813
Encrypted:	false
SSDEEP:	96:kUz7EnAd4kYJ3AyKyPyfzCzYzoQcz/yn21ROgTE1OcrcosUmKoYkHnBTch9e6NeA:TnEAd4dAXw8GMErO1OcrcosUmKoYETKL
MD5:	BF744BB038D2705691EBA74302285FC2
SHA1:	7216B09EDF7657986CDC20A0C2329A9A4E2A0B95
SHA-256:	F2454CEB98932F16B768A7D0879A57B9A595FE4675EC9D764DAF2E75C8FA4DE5
SHA-512:	F29FA531CC38392152AAA9F3A484ABE66B03DBCD2519A6B1B9CF24C8569B0C3AB3971BAC73B0A9A372125C19935B4BA0EE89F9E861880A05B42EBA9D349A1855
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. strip_or_none,.)...class RTBFIE(InfoExtractor):. _VALID_URL = r'''(?x). https?://(?:www\.)?rtbf\.be/. (?:. video/[^?]+\?.\bid=\|. ouftivi/(?:[^/]+/)[^?]+\?.\bvideoId=\|. auvio/[^/]+\?.\b(?P<live>l)?id=. )(?P<id>\d+)'''. _TESTS = [{. 'url': 'https://www.rtbf.be/video/detail_les-diables-au-coeur-episode-2?id=1921274',. 'md5': '8c876a1cceeb6cf31b476461ade72384',. 'info_dict': {. 'id': '1921274',. 'ext': 'mp4',. 'title': 'Les Diables au coeur (.pisode 2)',. 'description': '(du 25/04/2014)',. 'duration': 3099.54,. 'upload_date': '20140425',. 'timestamp': 1398456300,. }. }, {. # geo restricted. 'url': 'http://www.rtbf.be/ouftivi/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rte.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6289
Entropy (8bit):	4.633539714924295
Encrypted:	false
SSDEEP:	192:iHNxWgpTqOkETSiMcieTbe0XZZnvSqXedyD9:eNxWgp+OkPiDieTbeMZZnvPXedyD9
MD5:	34960F94A8376DFCAB3FF8E9FA624B95
SHA1:	F2DEBEE369D9C6273171E95271C09251342D8A97
SHA-256:	B59CE36BFD2C7814DE22E3433B0A1514BDBFF1E2A9A68CF339020B5A77EDBCE0
SHA-512:	7099E3D6E7559EB69E42F593A4ABE7ED28F3FE7B110A251132A095CD46EF41FC8068AFB9AA8C77D2DD78F33BE7EE7C914FD7519D6825C636A53F9DCA7C5B4A00
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_HTTPError.from ..utils import (. float_or_none,. parse_iso8601,. str_or_none,. try_get,. unescapeHTML,. url_or_none,. ExtractorError,.)...class RteBaseIE(InfoExtractor):. def _real_extract(self, url):. item_id = self._match_id(url).. info_dict = {}. formats = [].. ENDPOINTS = (. 'https://feeds.rasset.ie/rteavgen/player/playlist?type=iptv&format=json&showId=',. 'http://www.rte.ie/rteavgen/getplaylist/?type=web&format=json&id=',. ).. for num, ep_url in enumerate(ENDPOINTS, start=1):. try:. data = self._download_json(ep_url + item_id, item_id). except ExtractorError as ee:. if num < len(ENDPOINTS) or formats:. continue. if isinstance(ee.cause, compat_HTTPError) and ee.cause.code == 404:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rtl2.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7406
Entropy (8bit):	4.806934294203906
Encrypted:	false
SSDEEP:	192:kpg72PYeA6MDJLdKTP6NgTXruf3e9dzKTuHL6NyRIOMygv:kpgxl6MDpdKTP6NgTX6P+d+Tur6NyyVB
MD5:	BAF19C6407F29D2CBCB6018545DE47C4
SHA1:	08829D1F74F3317FC7971873681B6ED70376C0E2
SHA-256:	78971FA76390D83C9A10E933801E760152A7980C1C3C25BF52D5EC75AE110A49
SHA-512:	4AF2B00D58A70C0DE72B78717AEBEBB3DFC2506F37EF0310C3098F1B4EB76DBE7CA9CF2A0770650BDC0462B11C701DD2350819D78D9B7ED3CFC7AE77D2BDD56A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..aes import aes_cbc_decrypt.from ..compat import (. compat_b64decode,. compat_ord,. compat_str,.).from ..utils import (. bytes_to_intlist,. ExtractorError,. intlist_to_bytes,. int_or_none,. strip_or_none,.)...class RTL2IE(InfoExtractor):. IE_NAME = 'rtl2'. _VALID_URL = r'https?://(?:www\.)?rtl2\.de/sendung/[^/]+/(?:video/(?P<vico_id>\d+)[^/]+/(?P<vivi_id>\d+)-\|folge/)(?P<id>[^/?#]+)'. _TESTS = [{. 'url': 'http://www.rtl2.de/sendung/grip-das-motormagazin/folge/folge-203-0',. 'info_dict': {. 'id': 'folge-203-0',. 'ext': 'f4v',. 'title': 'GRIP sucht den Sommerk.nig',. 'description': 'md5:e3adbb940fd3c6e76fa341b8748b562f'. },. 'params': {. # rtmp download. 'skip_download': True,. },. 'expected_warnings': ['Unable to download f4m manifest', 'Fai

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rtlnl.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.941775822932339
Encrypted:	false
SSDEEP:	96:LHk8zmbTzHagt0dWM7g3uzPW+HVs+BTrlU6ETU8eKdE8fUuqKwdGBTeka8x6N0ES:jkOMzHkWXuzPW+Hq+s6ET/eKdEqUuqHA
MD5:	53F14190B03D7D91F855C2AF0F44FA0E
SHA1:	5CC05F18F4AF358CDB10015E827141CAAC0BEA75
SHA-256:	6403B69D919F35F5B0079B410D88C205B454D94E48EFD68F8FC7A1B7D9150248
SHA-512:	78BD5A7501E69AB192B2CD862ADAD895DA47BE62D5790882AD708A708ADFBA29A58CF9654993D78094B3EA73EA5E3932DB21B1993DFD187966A52A7F78466E86
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_duration,.)...class RtlNlIE(InfoExtractor):. IE_NAME = 'rtl.nl'. IE_DESC = 'rtl.nl and rtlxl.nl'. _VALID_URL = r'''(?x). https?://(?:(?:www\|static)\.)?. (?:. rtlxl\.nl/[^\#]*\#!/[^/]+/\|. rtl\.nl/(?:(?:system/videoplayer/(?:[^/]+/)+(?:video_)?embed\.html\|embed)\b.+?\buuid=\|video/). ). (?P<id>[0-9a-f-]+)'''.. _TESTS = [{. 'url': 'http://www.rtlxl.nl/#!/rtl-nieuws-132237/82b1aad1-4a14-3d7b-b554-b0aed1b2c416',. 'md5': '473d1946c1fdd050b2c0161a4b13c373',. 'info_dict': {. 'id': '82b1aad1-4a14-3d7b-b554-b0aed1b2c416',. 'ext': 'mp4',. 'title': 'RTL Nieuws',. 'description': 'md5:d41d8cd98f00b204e9800998ecf8427e',. 'timestamp': 1461951000,. 'upload_date': '20160429',. 'duration': 1167.96,. },.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rtp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2248
Entropy (8bit):	4.625555436049224
Encrypted:	false
SSDEEP:	48:+uhWO008VGfumvdaxYbptfjXhkbY/wnvvapW8GRqGm48YdqBTraYjb86NQKyf:YOd/umvdmYbXfaTvv38GRdmpYdqBTrXu
MD5:	D15F91723013330A5D3B4C32DA816326
SHA1:	D68390D5FC140D306ECF009CDD28EFFE65D15348
SHA-256:	4153BA21795C190687C7B4C1F89FD236C2D91972F95DF0AB5C69FD0F97476234
SHA-512:	E6F6211FD066CB3147A761D1156ABD3BDA66E93445FFDD430A47A66F2D633BBACEDB2039F8AE7C31FE72C69E3564D93DB20A49D7CA3CE3AD4C66DA0E95DD969E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. js_to_json,.)...class RTPIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rtp\.pt/play/p(?P<program_id>[0-9]+)/(?P<id>[^/?#]+)/?'. _TESTS = [{. 'url': 'http://www.rtp.pt/play/p405/e174042/paixoes-cruzadas',. 'md5': 'e736ce0c665e459ddb818546220b4ef8',. 'info_dict': {. 'id': 'e174042',. 'ext': 'mp3',. 'title': 'Paix.es Cruzadas',. 'description': 'As paix.es musicais de Ant.nio Cartaxo e Ant.nio Macedo',. 'thumbnail': r're:^https?://.*\.jpg',. },. }, {. 'url': 'http://www.rtp.pt/play/p831/a-quimica-das-coisas',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id). title = self._html_search_meta(. 'twitter:title', webp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rts.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9150
Entropy (8bit):	4.445757981179268
Encrypted:	false
SSDEEP:	192:bITUjQ/KMA22cwMPS6y3m0JJZlOHRQ1sxi3O4d1H47TsTC6NTa:bITUjQCMA22cwIAJJHODxi3O4H47TsTo
MD5:	001B399FAA3F1A9A35A935A3C6BC1679
SHA1:	15C1D5A581EA55F55A04A64BFB52770F148260BC
SHA-256:	9B8CEA47FBFD4FCF25E3B725375C0F3BFCDAAB2A0FAA48E2AF3CF7FD3F03EFAB
SHA-512:	0323D3E3DDB3A1F55D2D3FA3CF27171904B06E1C3A0B63CB39729F9F0427ED568125DAC7EB0ED165264ADDB9C0364EF78F35C678FB22A66260B314ED19521397
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .srgssr import SRGSSRIE.from ..compat import compat_str.from ..utils import (. int_or_none,. parse_duration,. parse_iso8601,. unescapeHTML,. determine_ext,.)...class RTSIE(SRGSSRIE):. IE_DESC = 'RTS.ch'. _VALID_URL = r'rts:(?P<rts_id>\d+)\|https?://(?:.+?\.)?rts\.ch/(?:[^/]+/){2,}(?P<id>[0-9]+)-(?P<display_id>.+?)\.html'.. _TESTS = [. {. 'url': 'http://www.rts.ch/archives/tv/divers/3449373-les-enfants-terribles.html',. 'md5': 'ff7f8450a90cf58dacb64e29707b4a8e',. 'info_dict': {. 'id': '3449373',. 'display_id': 'les-enfants-terribles',. 'ext': 'mp4',. 'duration': 1488,. 'title': 'Les Enfants Terribles',. 'description': 'France Pommier et sa soeur Luce Feral, les deux filles de ce groupe de 5.',. 'uploader': 'Divers',. 'upload_date': '19

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rtve.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	10066
Entropy (8bit):	4.81219604303769
Encrypted:	false
SSDEEP:	192:DhUUED1FY3ypJTMpK5UqMDie6VD+WlAUJ7O11oi13sTY6Ne2+5jA983ifNNCDV1a:CvY3sJTMpcUqGiNh+OO1qi13sTY6Ne2X
MD5:	DE7D5463492E8276EE3309D80D72FB54
SHA1:	85E3EDB2151F5F46024C5A91E15088B9C3FCF19B
SHA-256:	F79A2CBF661207D17FE7048B4A6F46F8820FE2A359366E884D6F1BA30544F119
SHA-512:	487B493E542001354B34ABED203F527457EBBCD30AFA3C60D6EDD2E552C3F04A5654B7928568CF5F429EC8603AF8F148A9A880F75EE7E81DD29315A8DC3A2832
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import re.import time..from .common import InfoExtractor.from ..compat import (. compat_b64decode,. compat_struct_unpack,.).from ..utils import (. determine_ext,. ExtractorError,. float_or_none,. remove_end,. remove_start,. sanitized_Request,. std_headers,.)...def _decrypt_url(png):. encrypted_data = compat_b64decode(png). text_index = encrypted_data.find(b'tEXt'). text_chunk = encrypted_data[text_index - 4:]. length = compat_struct_unpack('!I', text_chunk[:4])[0]. # Use bytearray to get integers when iterating in both python 2.x and 3.x. data = bytearray(text_chunk[8:8 + length]). data = [chr(b) for b in data if b != 0]. hash_index = data.index('#'). alphabet_data = data[:hash_index]. url_data = data[hash_index + 1:]. if url_data[0] == 'H' and url_data[3] == '%':. # remove useless HQ%% at the start. url_data = url_data[4:].. alphabet = [].

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rtvnh.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	4.595753703155703
Encrypted:	false
SSDEEP:	48:+u6Y76wL4qQCxKajXXRjdepAsqgNCMtTUb5HOj+Drif3BT/T6Nq:+Y76wL4qQCxKatjdMAsBCMtTM5HOj+HQ
MD5:	3A6095C4E3BC4B257E0272EDF254ED78
SHA1:	F388FA8C283BB9C4C89E5D8655495EDF5A2E9009
SHA-256:	5A5F148E1284A8245D0849DD8B9CEEB92E7FB75F04FF702D387D331C3536E033
SHA-512:	C452744ECFC2397551903830823A5AA2FC208BDB9945513FBA76FA85395534FBC3D750CC283841B7741E9D870371D8A985D9C96B12BDFE2A2EA8E384ED351B26
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import ExtractorError...class RTVNHIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rtvnh\.nl/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.rtvnh.nl/video/131946',. 'md5': 'cdbec9f44550763c8afc96050fa747dc',. 'info_dict': {. 'id': '131946',. 'ext': 'mp4',. 'title': 'Grote zoektocht in zee bij Zandvoort naar vermiste vrouw',. 'thumbnail': r're:^https?:.*\.jpg$'. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. meta = self._parse_json(self._download_webpage(. 'http://www.rtvnh.nl/video/json?m=' + video_id, video_id), video_id).. status = meta.get('status'). if status != 200:. raise ExtractorError(. '%s returned error code %d' % (self.IE_NAME, status), expected=True).. formats = []. rtmp_forma

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rtvs.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1476
Entropy (8bit):	4.926123218003364
Encrypted:	false
SSDEEP:	24:zi8lFvS1Gm1YEwVhq/BFlEth/xHNqH1EwlHET/Ddlnqrh0gXHNqVfeIXhgtbQ7sI:+uQ1D1YEE6KtPNqVEhLD79uNqVfjXhkM
MD5:	33E8763FB550007B3DB12FBC1059744B
SHA1:	DA8CE47F7AAEF44218EE01C60040C2B90A27DC7C
SHA-256:	69488F800217FE7F87754BF86FEE8E573F16ABE5AF2D75C2A9898282099173D4
SHA-512:	C0A552F1BD1AC283AE4CEF58BC333FF3A9C1CC89F270B53DB9C87ED8753D9B9302D815CBE3871EC204760E0AB82099442B25083DEB81E1DE3E2E9A19F77726C9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class RTVSIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?rtvs\.sk/(?:radio\|televizia)/archiv/\d+/(?P<id>\d+)'. _TESTS = [{. # radio archive. 'url': 'http://www.rtvs.sk/radio/archiv/11224/414872',. 'md5': '134d5d6debdeddf8a5d761cbc9edacb8',. 'info_dict': {. 'id': '414872',. 'ext': 'mp3',. 'title': 'Ostrov pokladov 1 .as..mp3'. },. 'params': {. 'skip_download': True,. }. }, {. # tv archive. 'url': 'http://www.rtvs.sk/televizia/archiv/8249/63118',. 'md5': '85e2c55cf988403b70cac24f5c086dc6',. 'info_dict': {. 'id': '63118',. 'ext': 'mp4',. 'title': 'Amaro D.ives - N.. de.',. 'description': 'Galave.er pri pr.le.itosti Medzin.rodn.ho d.a R.mov.'. },. 'params': {. 'skip_download': True,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rudo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	4.9759178886261735
Encrypted:	false
SSDEEP:	48:+ubXc47ab3u5EBcxi0y7RnjXhkJIwnU4y3bIWWC:vp7GqEBcxm1naJ3U4yrvWC
MD5:	3C5BF5BA17CF030539B71B27AB41745F
SHA1:	C949139CEC46DA1F252025D3F2198864FD3EDCAB
SHA-256:	2E29EF630639530615A4B6B2EA05FA69120BE3DAE52B3A45C420AE1E33E3AB67
SHA-512:	BB72DBBA94491A77A7F9A444A5CAAD48B4A8B9CEC83CE68D47F5B1C57265CC32B9F5BD2BE261CDE091CDCEF8E87EA7643ED21224D55F666707AA551C0C15404F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. js_to_json,. get_element_by_class,. unified_strdate,.)...class RudoIE(InfoExtractor):. _VALID_URL = r'https?://rudo\.video/vod/(?P<id>[0-9a-zA-Z]+)'.. _TEST = {. 'url': 'http://rudo.video/vod/oTzw0MGnyG',. 'md5': '2a03a5b32dd90a04c83b6d391cf7b415',. 'info_dict': {. 'id': 'oTzw0MGnyG',. 'ext': 'mp4',. 'title': 'Comentario Tom.s Mosciatti',. 'upload_date': '20160617',. },. }.. @classmethod. def _extract_url(cls, webpage):. mobj = re.search(. r'<iframe[^>]+src=(?P<q1>[\'"])(?P<url>(?:https?:)?//rudo\.video/vod/[0-9a-zA-Z]+)(?P=q1)',. webpage). if mobj:. return mobj.group('url').. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id, encoding='iso-8859

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ruhd.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	4.997003272421197
Encrypted:	false
SSDEEP:	48:+uSsjEcBOmpNgajXjlkQX5GXBWXCXn3NeXKiZsoAAtc:maEcBOmpNgaqGYQI3NJiZsoHtc
MD5:	A0058CAA32D7A7D4F05F24D034553791
SHA1:	02CD3BD624DF337D1B60F4F4B92B994030822CC7
SHA-256:	95D1D40428F3E6106415111BE871E091867B880D2C6E52C1D4EC491CFFA7F880
SHA-512:	D4C36DD9C96FDB893C96C99610BE483FB96FE1E883D237531E809C4423DF5EE08846A61D6BE23071FDA4590FFFE045CDAC786BCF24C050811E819334918E4BAF
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class RUHDIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ruhd\.ru/play\.php\?vid=(?P<id>\d+)'. _TEST = {. 'url': 'http://www.ruhd.ru/play.php?vid=207',. 'md5': 'd1a9ec4edf8598e3fbd92bb16072ba83',. 'info_dict': {. 'id': '207',. 'ext': 'divx',. 'title': '... .......',. 'description': '........ ...)',. 'thumbnail': r're:^http://.*\.jpg$',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. video_url = self._html_search_regex(. r'<param name="src" value="([^"]+)"', webpage, 'video url'). title = self._html_search_regex(. r'<title>([^<]+)   RUHD\.ru - ..... ........ ........ .1 . ......!</title>',. webpage, 'tit

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ruleporn.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1514
Entropy (8bit):	4.872904617441403
Encrypted:	false
SSDEEP:	24:1R8lQLGM5vw3BdN//xkHbAFdlXtu8TOAwVUG1vaJoXhhdIBneKmtaBeRGGOyvJKG:PuQL1vircbSh81vaJoXhh6BnpoaBeRTR
MD5:	B2EA31AB313C421212C6A0213CC4B042
SHA1:	532560992F36F093FDC516A12E74B3EE1217984D
SHA-256:	3F2FEC640C345A9BDEFDED232FD13B4BD58C03CB9D0AEA1466BF075F7D4E02C6
SHA-512:	522455EA93313F7BC644A1B106790E9566EC416E75F0779EAAC2360CFB4E47085A0D3D604C9E9BFBA019C0681831D492756E5E6073E4C860475D1D5162135BA8
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .nuevo import NuevoBaseIE...class RulePornIE(NuevoBaseIE):. _VALID_URL = r'https?://(?:www\.)?ruleporn\.com/(?:[^/?#&]+/)*(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'http://ruleporn.com/brunette-nympho-chick-takes-her-boyfriend-in-every-angle/',. 'md5': '86861ebc624a1097c7c10eaf06d7d505',. 'info_dict': {. 'id': '48212',. 'display_id': 'brunette-nympho-chick-takes-her-boyfriend-in-every-angle',. 'ext': 'mp4',. 'title': 'Brunette Nympho Chick Takes Her Boyfriend In Every Angle',. 'description': 'md5:6d28be231b981fff1981deaaa03a04d5',. 'age_limit': 18,. 'duration': 635.1,. }. }.. def _real_extract(self, url):. display_id = self._match_id(url).. webpage = self._download_webpage(url, display_id).. video_id = self._search_regex(. r'lovehomeporn\.com/embed/(\d+)', webpage, 'video id').. title = self.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rutube.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	11470
Entropy (8bit):	4.9985669121899745
Encrypted:	false
SSDEEP:	192:ikDJzRnl1qoynLOr7irVCTs6860j4u5qd6QdJkJ5fb0GOUMKjfJJ2ILRTZep6Njt:VDznl1qoyLOr7irVCTs6860j4u5qd6QY
MD5:	DF671F8B3718FDA5615F822344FCE687
SHA1:	09BBEB52ED67C84CB9AE768B3110B0980069E4C5
SHA-256:	484DB6DC8967B0A29F5691307EC26853405D3ADBB305E43698B0DFE4FDA0DDD1
SHA-512:	E0273D033DB19CE90CE6B2D018497ED1CB0BA87D6088943FC2C517B4881C7D2B5A5EC8F8FB2D2DCACC0494AE291E988E4D1495B1A3B1FAFBEF3DC5560B7ACC8D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.import itertools..from .common import InfoExtractor.from ..compat import (. compat_str,. compat_parse_qs,. compat_urllib_parse_urlparse,.).from ..utils import (. determine_ext,. bool_or_none,. int_or_none,. try_get,. unified_timestamp,. url_or_none,.)...class RutubeBaseIE(InfoExtractor):. def _download_api_info(self, video_id, query=None):. if not query:. query = {}. query['format'] = 'json'. return self._download_json(. 'http://rutube.ru/api/video/%s/' % video_id,. video_id, 'Downloading video JSON',. 'Unable to download video JSON', query=query).. @staticmethod. def _extract_info(video, video_id=None, require_title=True):. title = video['title'] if require_title else video.get('title').. age_limit = video.get('is_adult'). if age_limit is not None:. age_limit = 18 if age_limit is True els

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\rutv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	8064
Entropy (8bit):	4.630708339153749
Encrypted:	false
SSDEEP:	192:pZx/bGGgN9XMPdyscwkmAwl3ZIi/G4etXu8/TRbONbykNTiV6Ng:7ZqGg3MPdysTkmAwl3ZnOFF/hON9NTi5
MD5:	A9BEC20982649567C70F766B8092FB57
SHA1:	90F971CC0EBB4158574096433CF7A9A6D2498ECE
SHA-256:	609CF6ABC4AC8E243CBD71A7B8045A3D91D10695D60D75C7C69B285147C7BA1D
SHA-512:	04A1377A28EA47ED1C2F0D51969B8AE4A84B2FAE3D9FF1E9F3201E5534869FF3F5CB2B8DCC428F219A6E89A68C4AF20AF83C618266A0449C957CB9712128F430
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. int_or_none.)...class RUTVIE(InfoExtractor):. IE_DESC = 'RUTV.RU'. _VALID_URL = r'''(?x). https?://. (?:test)?player\.(?:rutv\.ru\|vgtrk\.com)/. (?P<path>. flash\d+v/container\.swf\?id=\|. iframe/(?P<type>swf\|video\|live)/id/\|. index/iframe/cast_id/. ). (?P<id>\d+). '''.. _TESTS = [. {. 'url': 'http://player.rutv.ru/flash2v/container.swf?id=774471&sid=kultura&fbv=true&isPlay=true&ssl=false&i=560&acc_video_id=episode_id/972347/video_id/978186/brand_id/31724',. 'info_dict': {. 'id': '774471',. 'ext': 'mp4',. 'title': '........ .. ... .....

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ruutu.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	6395
Entropy (8bit):	4.270440106129039
Encrypted:	false
SSDEEP:	192:O6THomppVOVqHzKrAWQ6Hkvj7MYTrOFdiFSAoFThZ6JmNTwi6Ng:pTHompOVqHWrAWMj7MY3OFdiFSAoFThx
MD5:	5504AC143948235C19B43BFAAAA6F95B
SHA1:	0E5F6BF83B04209886172D5DB060A7CD65803D21
SHA-256:	C43E13E0AC2E984CFCCEC2703753769576EB28829E8AB6034C27CF51D772ECD5
SHA-512:	A4C30E1C7F530A4BC92E50F547C6B72155C0461C9B23BD7D0F19DE1093782110E0A863B6CCF5D3F9E130034D764EE0633CF69730F1D460C88ACBEFF47D73895F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_urllib_parse_urlparse.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. xpath_attr,. xpath_text,.)...class RuutuIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?(?:ruutu\|supla)\.fi/(?:video\|supla)/(?P<id>\d+)'. _TESTS = [. {. 'url': 'http://www.ruutu.fi/video/2058907',. 'md5': 'ab2093f39be1ca8581963451b3c0234f',. 'info_dict': {. 'id': '2058907',. 'ext': 'mp4',. 'title': 'Oletko aina halunnut tiet.. mit. tapahtuu vain hetki ennen l.hetyst.? - Nyt se selvisi!',. 'description': 'md5:cfc6ccf0e57a814360df464a91ff67d6',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 114,. 'age_limit': 0,. },. },. {. 'url': 'http://www.ruutu.fi/video/2057306'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ruv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3359
Entropy (8bit):	4.772934535029396
Encrypted:	false
SSDEEP:	96:YOfhq5+MnX/+7TVIVfX7u1HhHGIMfJa7mPsbm7dG39G2gRv6kC1t06Ng:t4rcJT1HhHGI6Jas7dG39GtcQ6Ng
MD5:	4FCEF9F897B2F3B06AC14F4C8E6E2D39
SHA1:	AF7BFAEE296A392D9A52712FB1C1AE7EDD506B18
SHA-256:	CC4FFC4C03030CACA7A6326DE7A82C77EE87EDDD707F2DC74328218DEFEB06E7
SHA-512:	7E04D0F68102F6A985DAE72540DFB8064EA16644261B25FBF9BD97C9926CD4560F5D73B1F78EFA5BEF19B5D9978E104EB16846C2A8BFE53973B8DDAA2AB1D5CD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. determine_ext,. unified_timestamp,.)...class RuvIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ruv\.is/(?:sarpurinn/[^/]+\|node)/(?P<id>[^/]+(?:/\d+)?)'. _TESTS = [{. # m3u8. 'url': 'http://ruv.is/sarpurinn/ruv-aukaras/fh-valur/20170516',. 'md5': '66347652f4e13e71936817102acc1724',. 'info_dict': {. 'id': '1144499',. 'display_id': 'fh-valur/20170516',. 'ext': 'mp4',. 'title': 'FH - Valur',. 'description': 'Bein .tsending fr. 3. leik FH og Vals . .rslitum Ol.sdeildar karla . handbolta.',. 'timestamp': 1494963600,. 'upload_date': '20170516',. },. }, {. # mp3. 'url': 'http://ruv.is/sarpurinn/ras-2/morgunutvarpid/20170619',. 'md5': '395ea250c8a13e5fdb39d4670ef85378',. 'info_dict': {. 'id': '1153630',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\safari.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	4.825519505513922
Encrypted:	false
SSDEEP:	192:c9n3s9dssNzyJFsz9zg67HhyJnGVFppdOW/NEHzdQj6eJ1:7OsNzyJFsz9zP7H+mFpmW/NEHze
MD5:	D58EEA7DAF4055C5CFAC99D4D1F3C49C
SHA1:	DC53E1659FFA90ED2B43C1BAEAB117F9C796C627
SHA-256:	79D11C1CB9CE7D2E03E3947BD243AC86F8EC3AAAB2A670259B9D453E2B3E0DAE
SHA-512:	CAFAE0DD046C73F8A2F8AC56260900AC334E913220CEF76B944E33E91F2041D8C1A190B22B5A75D0824161A3C46D7059ED551A297323E02DBEAD56DE86D026F7
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import re..from .common import InfoExtractor..from ..compat import (. compat_parse_qs,. compat_str,. compat_urlparse,.).from ..utils import (. ExtractorError,. update_url_query,.)...class SafariBaseIE(InfoExtractor):. _LOGIN_URL = 'https://learning.oreilly.com/accounts/login/'. _NETRC_MACHINE = 'safari'.. _API_BASE = 'https://learning.oreilly.com/api/v1'. _API_FORMAT = 'json'.. LOGGED_IN = False.. def _real_initialize(self):. self._login().. def _login(self):. username, password = self._get_login_info(). if username is None:. return.. _, urlh = self._download_webpage_handle(. 'https://learning.oreilly.com/accounts/login-check/', None,. 'Downloading login page').. def is_logged(urlh):. return 'learning.oreilly.com/home/' in compat_str(urlh.geturl()).. if is_logged(urlh):. self.LOGGED_IN =

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\sapo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4496
Entropy (8bit):	4.635741739896868
Encrypted:	false
SSDEEP:	96:qQt+B1WTQbfverUPmII56ksczypeszpo1ZqdEaCOoGG3GYJdj2aCDJVGIwSAkBT6:bt+BMkv5OV56Gy5Foxe7aA5wShTwt6Ng
MD5:	FD198BA70CB24E4693237F1E139DC3F0
SHA1:	5AB5B468F546A238B5551326098BD9DC1EC116D7
SHA-256:	11F813910694AF88172DF0F1DC199CE57EF94292D14929A54B5D481E4F776E4D
SHA-512:	CEC0E64DBE3F8A3B1D50F3BA96066D01E85CF52E5552515F06F93FFECB10B1854C45F6A0BA6A1491D1DAD1AD4274D73C95A21F26A1F2FA9D73D9F54CC3C7E0F1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_duration,. unified_strdate,.)...class SapoIE(InfoExtractor):. IE_DESC = 'SAPO V.deos'. _VALID_URL = r'https?://(?:(?:v2\|www)\.)?videos\.sapo\.(?:pt\|cv\|ao\|mz\|tl)/(?P<id>[\da-zA-Z]{20})'.. _TESTS = [. {. 'url': 'http://videos.sapo.pt/UBz95kOtiWYUMTA5Ghfi',. 'md5': '79ee523f6ecb9233ac25075dee0eda83',. 'note': 'SD video',. 'info_dict': {. 'id': 'UBz95kOtiWYUMTA5Ghfi',. 'ext': 'mp4',. 'title': 'Benfica - Marcas na Hit.ria',. 'description': 'md5:c9082000a128c3fd57bf0299e1367f22',. 'duration': 264,. 'uploader': 'tiago_1988',. 'upload_date': '20080229',. 'categories': ['benfica', 'cabral', 'desporto', 'futebol', 'geovanni', 'hooijdonk', 'joao', 'karel', 'lisboa', 'miccoli'],.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\savefrom.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1081
Entropy (8bit):	4.96746081382743
Encrypted:	false
SSDEEP:	24:zi8lvveOlewXEtQHJmNw/Pdlnx8JYft8a6PHrqadfFss5Qw:+ueOAcE8uwP7xB6vWadfFB5Qw
MD5:	0254CF3F0C5897542BEEA4526D5F36F7
SHA1:	CDDAEBD4DA34631E5B68C3F7491D416C000247A8
SHA-256:	45DEF56907B1621A142A02B4D25954A6BD4377C35972640CD5C5D4201716529C
SHA-512:	79AA28F39D3E36D7DAF2FDA5B4A863F5555A00C04C03F52BE6AC279A3A2B08A7909BD8CF33FE93389E24B6C9827A176AAE81F08E7C452F6F781A005D5F422C01
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import os.path.import re..from .common import InfoExtractor...class SaveFromIE(InfoExtractor):. IE_NAME = 'savefrom.net'. _VALID_URL = r'https?://[^.]+\.savefrom\.net/\#url=(?P<url>.)$'.. _TEST = {. 'url': 'http://en.savefrom.net/#url=http://youtube.com/watch?v=UlVRAPW2WJY&utm_source=youtube.com&utm_medium=short_domains&utm_campaign=ssyoutube.com',. 'info_dict': {. 'id': 'UlVRAPW2WJY',. 'ext': 'mp4',. 'title': 'About Team Radical MMA \| MMA Fighting',. 'upload_date': '20120816',. 'uploader': 'Howcast',. 'uploader_id': 'Howcast',. 'description': r're:(?s). Hi, my name is Rene Dreifuss\. And I\'m here to show you some MMA.*',. },. 'params': {. 'skip_download': True. }. }.. def _real_extract(self, url):. mobj = re.match(self._VALID_URL, url). video_id = os.path.splitext(url.split('/

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\sbs.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2717
Entropy (8bit):	4.828686940847195
Encrypted:	false
SSDEEP:	48:+uK5eGLCMDqjtL3NZBie23X1tfjXjmBycninxUfV9PaplYpwF:G5pLC6qjtL3NXie2HTfbaUSfVxaLF
MD5:	8A68A9988B02290D2678E2DE195E15A9
SHA1:	DFCAA2DAB45F1E45FBD86084B037074906666D18
SHA-256:	2C3DD787DB24A70F721EC33C9B16ADE11B703DC10A67EE52131256BD840A7D63
SHA-512:	E21A8D2C3443BB93B3D597DA3A44E5A95DD28FE500B83E39FE32A32D4A22D1F6665A19A5187F3B6C805319ED93C3176576E2869D07BDAF4EA0F446010662E895
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. smuggle_url,. ExtractorError,.)...class SBSIE(InfoExtractor):. IE_DESC = 'sbs.com.au'. _VALID_URL = r'https?://(?:www\.)?sbs\.com\.au/(?:ondemand\|news)/video/(?:single/)?(?P<id>[0-9]+)'.. _TESTS = [{. # Original URL is handled by the generic IE which finds the iframe:. # http://www.sbs.com.au/thefeed/blog/2014/08/21/dingo-conservation. 'url': 'http://www.sbs.com.au/ondemand/video/single/320403011771/?source=drupal&vertical=thefeed',. 'md5': '3150cf278965eeabb5b4cea1c963fe0a',. 'info_dict': {. 'id': '320403011771',. 'ext': 'mp4',. 'title': 'Dingo Conservation (The Feed)',. 'description': 'md5:f250a9856fca50d22dec0b5b8015f8a5',. 'thumbnail': r're:http://.*\.jpg',. 'duration': 308,. 'timestamp': 1408613220,. 'upload_date': '20140821',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\screencast.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	4.721732721674062
Encrypted:	false
SSDEEP:	96:i0/7AbgAmvbKn6KFmvbBnXv279bmvb4+mvO0fqSpipAmKyE8OA9QZ9Htc:iU7AbevbKMvbtv2hKvb4vOiq0kA1I
MD5:	FD192CAF230496E27928E9AB147E004B
SHA1:	3B2F20F9CF3D12AC0987C90AC615FD115B9D6026
SHA-256:	D6E5712B2D7D9388A1702417AD6D1C82355ACEADDD42E65035F5B281FE5986F5
SHA-512:	F4B7DA62B8686DEF6CF6685C0E7BD9C3FD9932E65FF9E77B060837739E64D61196BC97CF90E41F10B0A70EE6BA147CB85A7D3680841A7CD6A6524B0AE00B95CB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_urllib_request,.).from ..utils import (. ExtractorError,.)...class ScreencastIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?screencast\.com/t/(?P<id>[a-zA-Z0-9]+)'. _TESTS = [{. 'url': 'http://www.screencast.com/t/3ZEjQXlT',. 'md5': '917df1c13798a3e96211dd1561fded83',. 'info_dict': {. 'id': '3ZEjQXlT',. 'ext': 'm4v',. 'title': 'Color Measurement with Ocean Optics Spectrometers',. 'description': 'md5:240369cde69d8bed61349a199c5fb153',. 'thumbnail': r're:^https?://.*\.(?:gif\|jpg)$',. }. }, {. 'url': 'http://www.screencast.com/t/V2uXehPJa1ZI',. 'md5': 'e8e4b375a7660a9e7e35c33973410d34',. 'info_dict': {. 'id': 'V2uXehPJa1ZI',. 'ext': 'mov',. 'title': 'The Amadeus Spectrometer',. 'de

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\screencastomatic.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	4.9059531528285625
Encrypted:	false
SSDEEP:	24:zi8lFvS2sKghw7dp3/EdlGwsQCfckJmg8aeIXjlgtyVuXn9zE/jaoxNlDDc3HDcA:+uTsKghOfEywsXU8mdajXjlkauX5uj7q
MD5:	D66E0C3CF6B022185F7F830E579F9411
SHA1:	2EEB16ED55A043D5E6756C4B05BE7DC2D0EFE077
SHA-256:	AC827CB6B349032F9D51DBC08D3CAB1DE76490F032FE6F1F61441B2A0DD3D3A1
SHA-512:	10E29CD35E496DAF9DC2B63FCE9863AB1489FB4DB36A66DCDE18C1357C7DB5EB391E3AFDCE3B2532FCB9D7B5428B7B1C2A4BBBDCB7B5E24D6CD498CC3F4FB0B3
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import js_to_json...class ScreencastOMaticIE(InfoExtractor):. _VALID_URL = r'https?://screencast-o-matic\.com/watch/(?P<id>[0-9a-zA-Z]+)'. _TEST = {. 'url': 'http://screencast-o-matic.com/watch/c2lD3BeOPl',. 'md5': '483583cb80d92588f15ccbedd90f0c18',. 'info_dict': {. 'id': 'c2lD3BeOPl',. 'ext': 'mp4',. 'title': 'Welcome to 3-4 Philosophy @ DECV!',. 'thumbnail': r're:^https?://.\.jpg$',. 'description': 'as the title says! also: some general info re 1) VCE philosophy and 2) distance learning.',. 'duration': 369.163,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. jwplayer_data = self._parse_json(. self._search_regex(. r"(?s)jwplayer$'mp4Player'$.setup\((\{.?\}

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\scrippsnetworks.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3705
Entropy (8bit):	4.783626567278515
Encrypted:	false
SSDEEP:	96:nhdkY7fwNUMN2bXjDF+xdyXddlhEHpFGzflZtG1Xn:hR7QGXPFkd4ddlyHPcNZ8Xn
MD5:	5E8B267AAB6D0F078D7902F79EDACE41
SHA1:	4B134AEF879AB8006C809019DC6C23C30F79C919
SHA-256:	F5B2C53D41F683B466CCBB06518A2A1424824CAE8BD2382826033780318B0561
SHA-512:	D98DEBBCF86BD0578A4E4851BB1D4FBD63AF15A6BD30750E2357D8D246E4AFDFA999E0984678DF411AEE728C65604D62F15821F852B5E0AFB1BB1F3D255E62F9
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import hashlib.import re..from .aws import AWSIE.from .anvato import AnvatoIE.from ..utils import (. smuggle_url,. urlencode_postdata,. xpath_text,.)...class ScrippsNetworksWatchIE(AWSIE):. IE_NAME = 'scrippsnetworks:watch'. _VALID_URL = r'''(?x). https?://. watch\.. (?P<site>geniuskitchen)\.com/. (?:. player\.[A-Z0-9]+\.html\#\|. show/(?:[^/]+/){2}\|. player/. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://watch.geniuskitchen.com/player/3787617/Ample-Hills-Ice-Cream-Bike/',. 'info_dict': {. 'id': '4194875',. 'ext': 'mp4',. 'title': 'Ample Hills Ice Cream Bike',. 'description': 'Courtney Rada churns up a signature

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\seeker.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.760331876675233
Encrypted:	false
SSDEEP:	48:+uGf6BmF0VVoc1vPVfn+9byeu6LvnsfJnfFI7hb4Ac4NSXM6ILFMiPP:6mmSV31vPVfn+9byetvsfJib4p4NSXMx
MD5:	195013B71CBE43A1FEB96B7F90ACB7C3
SHA1:	A99B3B7E2E8B180BECE5DF617F01C2459EB50A2B
SHA-256:	A10077016286C40C272EA823889ED8578E62188A0D8E1D0DC4D19D8E5925820C
SHA-512:	4D59E34F1D3E937016D3074CA13BAF7E338CB7E5B5A29F812947187A84047B744F856262608A87431C5F265B6B613CADAE76934FBF33AFE8ECC9E1881B109EE1
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class SeekerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?seeker\.com/(?P<display_id>.*)-(?P<article_id>\d+)\.html'. _TESTS = [{. # player.loadRevision3Item. 'url': 'http://www.seeker.com/should-trump-be-required-to-release-his-tax-returns-1833805621.html',. 'md5': '30c1dc4030cc715cf05b423d0947ac18',. 'info_dict': {. 'id': '76243',. 'ext': 'webm',. 'title': 'Should Trump Be Required To Release His Tax Returns?',. 'description': 'Donald Trump has been secretive about his "big," "beautiful" tax returns. So what can we learn if he decides to release them?',. 'uploader': 'Seeker Daily',. 'uploader_id': 'seekerdaily',. }. }, {. 'url': 'http://www.seeker.com/changes-expected-at-zoos-following-recent-gorilla-lion-shootings-1834116536.html',. 'playlist': [.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\senateisvp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6275
Entropy (8bit):	4.88080561685403
Encrypted:	false
SSDEEP:	192:zQnCf3Fr2ErRvRIXd18b1XhAvZKphPNtCRjY7Ft6T06Ng:zQUVJrR5IXd1Ax4AphPqRjY7Ft6T06Ng
MD5:	9A35B6BC808BDBFBF09D17EA9D58023F
SHA1:	008FF5369367BC01C021A66005D21C001959F586
SHA-256:	42C60BEC38AC678602216C53322B7347F5AFA7A159525F3786E360AD78F2741B
SHA-512:	C293866196F7402CC656DCA3617610F7EA65D396B938D93B3EBBF71D363BB2E879B8DCD696CAC31AA87520CD39E27DC7B4E4D907BF36CEF2A681AED81A407F51
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re.from .common import InfoExtractor.from ..utils import (. ExtractorError,. unsmuggle_url,.).from ..compat import (. compat_parse_qs,. compat_urlparse,.)...class SenateISVPIE(InfoExtractor):. _COMM_MAP = [. ['ag', '76440', 'http://ag-f.akamaihd.net'],. ['aging', '76442', 'http://aging-f.akamaihd.net'],. ['approps', '76441', 'http://approps-f.akamaihd.net'],. ['armed', '76445', 'http://armed-f.akamaihd.net'],. ['banking', '76446', 'http://banking-f.akamaihd.net'],. ['budget', '76447', 'http://budget-f.akamaihd.net'],. ['cecc', '76486', 'http://srs-f.akamaihd.net'],. ['commerce', '80177', 'http://commerce1-f.akamaihd.net'],. ['csce', '75229', 'http://srs-f.akamaihd.net'],. ['dpc', '76590', 'http://dpc-f.akamaihd.net'],. ['energy', '76448', 'http://energy-f.akamaihd.net'],. ['epw', '76478', 'http://epw-f.akamaihd.net'],.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\sendtonews.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3833
Entropy (8bit):	4.61722281506882
Encrypted:	false
SSDEEP:	96:Pw/7KQdbV4/XAcmPzzxHr5sx/SO65UB0gzHry7KYBebtfYHPwetVxB:o/7Kn/XtDSx2rpYeMB
MD5:	C574A5B4568689064C277F64CAC3ED9A
SHA1:	3BEDABDE962F53FEAD65427D0AD6618AA63F1F8C
SHA-256:	F8E13194A033F73EF723611043B2D2DC9C42BA56BC70FF98621870B6A9D0C737
SHA-512:	0C6827A566D0E1C3503D20B1ACCCBAE7BB602961AC78F3A71655A7612EED634C58A5C58B3D824F43E7DB8FEA712712483A4CFDC47AB41A50D937DB8F08CED282
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. float_or_none,. parse_iso8601,. update_url_query,. int_or_none,. determine_protocol,. unescapeHTML,.)...class SendtoNewsIE(InfoExtractor):. _VALID_URL = r'https?://embed\.sendtonews\.com/player2/embedplayer\.php\?.*\bSC=(?P<id>[0-9A-Za-z-]+)'.. _TEST = {. # From http://cleveland.cbslocal.com/2016/05/16/indians-score-season-high-15-runs-in-blowout-win-over-reds-rapid-reaction/. 'url': 'http://embed.sendtonews.com/player2/embedplayer.php?SC=GxfCe0Zo7D-175909-5588&type=single&autoplay=on&sound=YES',. 'info_dict': {. 'id': 'GxfCe0Zo7D-175909-5588'. },. 'playlist_count': 8,. # test the first video only to prevent lengthy tests. 'playlist': [{. 'info_dict': {. 'id': '240385',. 'ext': 'mp4',. 'title': 'Indians introduce Encarnacion'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\servingsys.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2359
Entropy (8bit):	4.562360585691066
Encrypted:	false
SSDEEP:	48:PuRWIO61OAqZM6xYfRoAXFwMNs0p62XjtuSyDB3GK4Xa5vQaWSm:g1OfAqZDYfnXFwMudG/xym
MD5:	86C081A4FA5ABED7952B482C7E3C714E
SHA1:	A776968DAC0577F12AA7FD0843ED64DA964194AF
SHA-256:	9CAB6AA43ACB3DC88C47B22403051891045675ECFAF1F8087A4FD5FBCA12C225
SHA-512:	88AE762C64BF6A29BA7D224AC4CD2FF8763D8B75B1663CCAA4E3A3503CF4E2342C6379EA1B032253DC7F9568728A7FF147ED143CF0C7253F42BFE1D0D5CD830E
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,.)...class ServingSysIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^.]+\.)?serving-sys\.com/BurstingPipe/adServer\.bs\?.*?&pli=(?P<id>[0-9]+)'.. _TEST = {. 'url': 'http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=is&c=23&pl=VAST&pli=5349193&PluID=0&pos=7135&ord=[timestamp]&cim=1?',. 'info_dict': {. 'id': '5349193',. 'title': 'AdAPPter_Hyundai_demo',. },. 'playlist': [{. 'md5': 'baed851342df6846eb8677a60a011a0f',. 'info_dict': {. 'id': '29955898',. 'ext': 'flv',. 'title': 'AdAPPter_Hyundai_demo (1)',. 'duration': 74,. 'tbr': 1378,. 'width': 640,. 'height': 400,. },. }, {. 'md5': '979b4da2655c4bc2d81aeb915a8c5014',. 'info_dict': {. 'id'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\servus.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2084
Entropy (8bit):	5.106347235184866
Encrypted:	false
SSDEEP:	48:+ut+IPf8GFnZkrsZcvWXjX1atfjXhMkdBw2imvYwG0VCeVU5qG4bkYhBTSAt46Ng:RhH8GFnOoZcv+L14ftHvN4Hd4b7hBTNu
MD5:	F2769A6EF6B9CACC22287D13399D1CBA
SHA1:	EECE33F63C9B08B71D8EBC6C466997B5575561CE
SHA-256:	49A876A4A3E6F8B7E90D786F91CFDB3B20A4CB41B45628CA140A254ECCFF7B9A
SHA-512:	A3A07C5C90E21C6776EEF416E36527A51AF7A2E452DC7BF7088222BD6F642654FC007442F43579F76A1BE987EB80517B4906F0080F550807725B5F7E080A21AD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor...class ServusIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?servus\.com/(?:(?:at\|de)/p/[^/]+\|tv/videos)/(?P<id>[aA]{2}-\w+\|\d+-\d+)'. _TESTS = [{. 'url': 'https://www.servus.com/de/p/Die-Gr%C3%BCnen-aus-Sicht-des-Volkes/AA-1T6VBU5PW1W12/',. 'md5': '3e1dd16775aa8d5cbef23628cfffc1f4',. 'info_dict': {. 'id': 'AA-1T6VBU5PW1W12',. 'ext': 'mp4',. 'title': 'Die Gr.nen aus Sicht des Volkes',. 'description': 'md5:1247204d85783afe3682644398ff2ec4',. 'thumbnail': r're:^https?://.*\.jpg',. }. }, {. 'url': 'https://www.servus.com/at/p/Wie-das-Leben-beginnt/1309984137314-381415152/',. 'only_matching': True,. }, {. 'url': 'https://www.servus.com/tv/videos/aa-1t6vbu5pw1w12/',. 'only_matching': True,. }, {. 'url': 'https://www.servus.com/tv/videos/1380889096408-1

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\sevenplus.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2923
Entropy (8bit):	4.555647426159368
Encrypted:	false
SSDEEP:	48:+uzGJuyNfI4K0JRafFqVqv4tfYWfFIYBvHFhxSAiOnY0Owu6BnR2gjsmyHB0GxLf:WJxI4K0JcfFqUvefpl2AfYwtjshh0GEw
MD5:	8D345A19D1124C82E4B3B0CA40114D67
SHA1:	DA65DD0C50FA3E85F0A5025C4B99CBA75F27C74F
SHA-256:	BE9DE0249CA302CDFDC66AEE9A75C903AE84A693738270B82081AE0835352BDB
SHA-512:	90001F2CD019BF04085D4A200FBB87353F40F0D48C8944210B2143D02F115AC0E88E4A4304777C97FC33B717F8CEED078C39B4A25171D5BF4251463831F7D062
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .brightcove import BrightcoveNewIE.from ..compat import compat_str.from ..utils import (. try_get,. update_url_query,.)...class SevenPlusIE(BrightcoveNewIE):. IE_NAME = '7plus'. _VALID_URL = r'https?://(?:www\.)?7plus\.com\.au/(?P<path>[^?]+\?.*?\bepisode-id=(?P<id>[^&#]+))'. _TESTS = [{. 'url': 'https://7plus.com.au/MTYS?episode-id=MTYS7-003',. 'info_dict': {. 'id': 'MTYS7-003',. 'ext': 'mp4',. 'title': 'S7 E3 - Wind Surf',. 'description': 'md5:29c6a69f21accda7601278f81b46483d',. 'uploader_id': '5303576322001',. 'upload_date': '20171201',. 'timestamp': 1512106377,. 'series': 'Mighty Ships',. 'season_number': 7,. 'episode_number': 3,. 'episode': 'Wind Surf',. },. 'params': {. 'format': 'bestvideo',. 'skip_download': True,. }

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\sexu.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2000
Entropy (8bit):	4.637499393863701
Encrypted:	false
SSDEEP:	48:Pu0BZggicnnNlJ0gq+ajXjlkEsuXXqp4ZaQShv5BTXXAhyKJ6cqqbAtZ9e6Ne:DZgg/nfqz+aqno7kBTSXJY5tZ9e6Ne
MD5:	AEBE15E2E19E5F18BF20DF6928F07D99
SHA1:	426B68614F316191973242624DADBAD32F631FF9
SHA-256:	34F1FCFC49DB7C642642BE50F875E7E0E28240AA81BC77B03531FE02D176F15C
SHA-512:	BE7C033C31FA6B1D1985412B43097795630765C6F21AD9FCDD738384C648660F428B8EBE28422E8CF54218183A11D60809E67C5D24FA1AC90617A799E638AE9C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor...class SexuIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?sexu\.com/(?P<id>\d+)'. _TEST = {. 'url': 'http://sexu.com/961791/',. 'md5': 'ff615aca9691053c94f8f10d96cd7884',. 'info_dict': {. 'id': '961791',. 'ext': 'mp4',. 'title': 'md5:4d05a19a5fc049a63dbbaf05fb71d91b',. 'description': 'md5:2b75327061310a3afb3fbd7d09e2e403',. 'categories': list, # NSFW. 'thumbnail': r're:https?://.\.jpg$',. 'age_limit': 18,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. jwvideo = self._parse_json(. self._search_regex(r'\.setup$\s({.+?})\s*$;', webpage, 'jwvideo'),. video_id).. sources = jwvideo['sources'].. formats = [{. 'url': source['file'].replace('\\', ''),.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\seznamzpravy.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with very long lines (1345)
Category:	dropped
Size (bytes):	7911
Entropy (8bit):	5.2386856775982915
Encrypted:	false
SSDEEP:	192:zv67GpeKDvLYfrT59apcX+S6SisvxbLepoTFHOqcMTsv9/VnAh6N5QGCjvbJ:xpLDvLYTT59apcX+S6Sisvxb6poTtOqX
MD5:	C2699542EDE2F125C035643F4E942286
SHA1:	CD070084BBCA5D3FF69627E77E77277B8CA82F64
SHA-256:	FB6D4A6E311FE2A768816BCF02434FF7F95144AE46DD0C64789C25BDB4D5AF9D
SHA-512:	28B407A4AC0C320F0F6483A4725DA91B3AC4FF5329593439922D9EF4C977D249B4252F5DDF82F010496238CB6CE466BB22420E6F8ABB183F95734ECFC502E840
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_str,. compat_urllib_parse_urlparse,.).from ..utils import (. urljoin,. int_or_none,. parse_codecs,. try_get,.)...def _raw_id(src_url):. return compat_urllib_parse_urlparse(src_url).path.split('/')[-1]...class SeznamZpravyIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?seznamzpravy\.cz/iframe/player\?.*\bsrc='. _TESTS = [{. 'url': 'https://www.seznamzpravy.cz/iframe/player?duration=241&serviceSlug=zpravy&src=https%3A%2F%2Fv39-a.sdn.szn.cz%2Fv_39%2Fvmd%2F5999c902ea707c67d8e267a9%3Ffl%3Dmdk%2C432f65a0%7C&itemType=video&autoPlay=false&title=Sv%C4%9Bt%20bez%20obalu%3A%20%C4%8Ce%C5%A1t%C3%AD%20voj%C3%A1ci%20na%20mis%C3%ADch%20(kr%C3%A1tk%C3%A1%20verze)&series=Sv%C4%9Bt%20bez%20obalu&serviceName=Seznam%20Zpr%C3%A1vy&poster=%2F%2Fd39-a.sdn.szn.cz%2Fd_39%2Fc_img_F_I%2FR5puJ.jpeg%3Ffl%3Dcro%2C0%2C0%2C1920

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\shahid.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	7959
Entropy (8bit):	4.814931539334507
Encrypted:	false
SSDEEP:	192:trF3U2HScIjv7kty0spdLnTYtOdkSa5n6N+Sy8evq9g:trF3U2Hjg7kFspdLnTYtOdkVn6N+a8d
MD5:	07830724633FDBD38190BB6D9B5077D3
SHA1:	5FF116E54E1CEF1174F5DDAC2C1B519F8078BB49
SHA-256:	B1D1D027ED9BCFEA8A9C4CC52908455F4C74FAD1DBA9ED5F6453776CAA4C9BC5
SHA-512:	2C77C116B2FE31E1307EB03883B0AD1D4E0F84FB95A669903C45E4E0C425D4E85AD8E25A310CA78C47ABEBABE2F530FC71EF98C9F44713ED3367CFDC94602192
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import json.import math.import re..from .aws import AWSIE.from ..compat import compat_HTTPError.from ..utils import (. clean_html,. ExtractorError,. InAdvancePagedList,. int_or_none,. parse_iso8601,. str_or_none,. urlencode_postdata,.)...class ShahidBaseIE(AWSIE):. _AWS_PROXY_HOST = 'api2.shahid.net'. _AWS_API_KEY = '2RRtuMHx95aNI1Kvtn2rChEuwsCogUd4samGPjLh'.. def _handle_error(self, e):. fail_data = self._parse_json(. e.cause.read().decode('utf-8'), None, fatal=False). if fail_data:. faults = fail_data.get('faults', []). faults_message = ', '.join([clean_html(fault['userMessage']) for fault in faults if fault.get('userMessage')]). if faults_message:. raise ExtractorError(faults_message, expected=True).. def _call_api(self, path, video_id, request=None):. query = {}. if request:. query['request'] = js

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\shared.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4047
Entropy (8bit):	4.7959679052340585
Encrypted:	false
SSDEEP:	96:JO8j23rDVUqcv8Z3ZmHDbh9Wxy/mkKsm0K3UoOhavOaYQDbV5cU:Q8j233ZJmjbhVIs480bVmU
MD5:	317392B1A70BF1C2D1E1600FB9E4570C
SHA1:	FCC120F73E6CE9C12BAA85F502C09B9D528A3DB5
SHA-256:	C0883F33E7B69959DD46552E92C811117F7BD8C5E86314E4306C80B25B23B3E4
SHA-512:	B00A8CC69A2AA4E9950E28085B5B5BD5A4AEBFB01E5D05CB36116F1D927335FAFAC5BF56985348BAC8FEEBBD48CDB725968974F829D762F9971F7A996B0AE924
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_b64decode.from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. KNOWN_EXTENSIONS,. parse_filesize,. url_or_none,. urlencode_postdata,.)...class SharedBaseIE(InfoExtractor):. def _real_extract(self, url):. video_id = self._match_id(url).. webpage, urlh = self._download_webpage_handle(url, video_id).. if self._FILE_NOT_FOUND in webpage:. raise ExtractorError(. 'Video %s does not exist' % video_id, expected=True).. video_url = self._extract_video_url(webpage, video_id, url).. title = self._extract_title(webpage). filesize = int_or_none(self._extract_filesize(webpage)).. return {. 'id': video_id,. 'url': video_url,. 'ext': 'mp4',. 'filesize': filesize,. 'title': title,. }.. def _extract_title(self, webpage):.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\showroomlive.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3127
Entropy (8bit):	4.404613425360773
Encrypted:	false
SSDEEP:	96:4Ogoi3aX+ndt45dhac3zB4YZnBT6O9TJ6Nl:0oL5d13zB4YZBTRn6Nl
MD5:	46D8E96FBA25A14DF6D41009454AC824
SHA1:	3EC2E93C583B45F80360EEBAF13A05470153FF3F
SHA-256:	A69E1FD057E0F0DDA6199F49722CD07377168A9EB9FF63CEFC5D68AD229388AA
SHA-512:	F4B2FEF52BA7809A769BCB4A2553A13DC4F93CA07843DB19C6A543029E4AA3434DBEBB8520248ACDE10FC2BF204E0A57B6C2BE62FF3322EF1DDF6A71283CD0AB
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. urljoin,.)...class ShowRoomLiveIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?showroom-live\.com/(?!onlive\|timetable\|event\|campaign\|news\|ranking\|room)(?P<id>[^/?#&]+)'. _TEST = {. 'url': 'https://www.showroom-live.com/48_Nana_Okada',. 'only_matching': True,. }.. def _real_extract(self, url):. broadcaster_id = self._match_id(url).. webpage = self._download_webpage(url, broadcaster_id).. room_id = self._search_regex(. (r'SrGlobal\.roomId\s=\s(\d+)',. r'(?:profile\|room)\?room_id\=(\d+)'), webpage, 'room_id').. room = self._download_json(. urljoin(url, '/api/room/profile?room_id=%s' % room_id),. broadcaster_id).. is_live = room.get('is_onlive'). if is_live is not True:. raise

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\sina.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4321
Entropy (8bit):	4.560798616238806
Encrypted:	false
SSDEEP:	96:a8EfaoHN5kjXUbXGAMpggAABYEVsSXBTNh6/6NQ:a8X8N5gyWAMueTVsSxT46NQ
MD5:	9A20619DAF9A088F467DCC611AF06113
SHA1:	958C74BFA1AA7F330B4DFEDB61F19528FE41BB66
SHA-256:	42D19321B09226B49D869D91DBE99B42FCB164954A9DFC62EB96BD1A82FE60DF
SHA-512:	B1C116FE640D88F122FDDCD522555349614289EBFD82E7F6EFD08FF7ED489B3B199D7399B4774F96600A82E01038572BB06FD689EC9C460CA3474B25B9057CDC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. HEADRequest,. ExtractorError,. int_or_none,. update_url_query,. qualities,. get_element_by_attribute,. clean_html,.)...class SinaIE(InfoExtractor):. _VALID_URL = r'''(?x)https?://(?:.?\.)?video\.sina\.com\.cn/. (?:. (?:view/\|.\#)(?P<video_id>\d+)\|. .+?/(?P<pseudo_id>[^/?#]+)(?:\.s?html)\|. # This is used by external sites like Weibo. api/sinawebApi/outplay.php/(?P<token>.+?)\.swf. ). '''.. _TESTS = [. {. 'url': 'http://video.sina.com.cn/news/spj/topvideoes20160504/?opsubject_id=top1#250576622',. 'md5': 'd38433e2fc886007729735650ae4b3e9',. 'info_dict': {. 'id': '250576622',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\sixplay.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	4.432738310028167
Encrypted:	false
SSDEEP:	96:hO4CVkIHpccCfWFUJYF+2XFxC5yJv6v8nyd+Jz6oF8vvOOLJ2ABTCFoNgns6No:IZKMpccwWuJYF5gycvd+Jz6oavvOOLJ5
MD5:	34A174218219AFF0D895141E9509862A
SHA1:	25D944ED9692AAB2E7D0F342438E87A6B5E348A8
SHA-256:	F0206262E8181BE802295BFE03CEFFD06A465928F66A4ABD25E39E85F06C98AE
SHA-512:	43DC609E5F42A49E9B79C1CB46C2F4B9FD3C0C4DD1271C671AAF20854565C6924F567455FB81BED6E3E58393CB5D82398498CA01F3BE872D3D3BC6473A6E0172
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_parse_qs,. compat_str,. compat_urllib_parse_urlparse,.).from ..utils import (. determine_ext,. int_or_none,. try_get,. qualities,.)...class SixPlayIE(InfoExtractor):. IE_NAME = '6play'. _VALID_URL = r'(?:6play:\|https?://(?:www\.)?(?P<domain>6play\.fr\|rtlplay\.be\|play\.rtl\.hr\|rtlmost\.hu)/.+?-c_)(?P<id>[0-9]+)'. _TESTS = [{. 'url': 'https://www.6play.fr/minute-par-minute-p_9533/le-but-qui-a-marque-lhistoire-du-football-francais-c_12041051',. 'md5': '31fcd112637baa0c2ab92c4fcd8baf27',. 'info_dict': {. 'id': '12041051',. 'ext': 'mp4',. 'title': 'Le but qui a marqu. l\'histoire du football fran.ais !',. 'description': 'md5:b59e7e841d646ef1eb42a7868eb6a851',. },. }, {. 'url': 'https://www.rtlplay.be/rtl-info-13h-p_8551/les-titres-du-rtlinfo-13h-c_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\sky.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2639
Entropy (8bit):	4.906385449589408
Encrypted:	false
SSDEEP:	48:+ulLjXjlkeTB97Za3ZT6tTiPy6Fd7Yna7ChdL3NI9lJJhZln+u2A:hLqwBNCZ2tGPHXcaI53C9lJ/n+/A
MD5:	1AC690B6E52272DECB4EC22902385B70
SHA1:	7024577AFE6F010E6AD471EE7E949CB42A757D54
SHA-256:	60B83B1CA16A10380AB5EE4C450D3DE1BAA91CC13690D9B6A8BF958A47779578
SHA-512:	D7772EA7EE6B37E6BBC7BE7A2BC0521E4534EEA4258C339B8DEB740E09EFD2733A23E5884E5848034B385783FEB07861CF9582BD04D96BCCBD7A544C7066C603
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. extract_attributes,. smuggle_url,. strip_or_none,. urljoin,.)...class SkyBaseIE(InfoExtractor):. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id). video_data = extract_attributes(self._search_regex(. r'(<div.+?class="[^"]sdc-article-video__media-ooyala[^"]"[^>]+>)',. webpage, 'video data')).. video_url = 'ooyala:%s' % video_data['data-video-id']. if video_data.get('data-token-required') == 'true':. token_fetch_options = self._parse_json(video_data.get(. 'data-token-fetch-options', '{}'), video_id, fatal=False) or {}. token_fetch_url = token_fetch_options.get('url'). if token_fetch_url:. embed_token = self._download_webpage(urljoin(. url, token_fetch_url), vide

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\skylinewebcams.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	4.847597353053954
Encrypted:	false
SSDEEP:	24:zi8lFvIHGlzaCZY/jE4dlwikT8BXHNqaeIXhgtBBfqLhUPGhDcehDWqUdlsSpK:+ugrCZYjE4sTKXNqajXhkBBIOGVzVWqf
MD5:	520DD5C8DC5B671E3C4BCCE2429CF163
SHA1:	014DEF5BFA35735BF830EEC364C5E925FC330B1B
SHA-256:	3FAE365D8BAE03BC0162CEC34100B878B3621B14C2035DC014A926228FE2BB6E
SHA-512:	4D4441097BF26BB69869AC85FB1BCD5AEADC6F097556AA967C73A8166D61BE74642CEB9F5D8A13454EDCDF7AB6976175C50E0B70B8E92F6E897DFDC74EC0EBEC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class SkylineWebcamsIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?skylinewebcams\.com/[^/]+/webcam/(?:[^/]+/)+(?P<id>[^/]+)\.html'. _TEST = {. 'url': 'https://www.skylinewebcams.com/it/webcam/italia/lazio/roma/scalinata-piazza-di-spagna-barcaccia.html',. 'info_dict': {. 'id': 'scalinata-piazza-di-spagna-barcaccia',. 'ext': 'mp4',. 'title': 're:^Live Webcam Scalinata di Piazza di Spagna - La Barcaccia [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. 'description': 'Roma, veduta sulla Scalinata di Piazza di Spagna e sulla Barcaccia',. 'is_live': True,. },. 'params': {. 'skip_download': True,. }. }.. def _real_extract(self, url):. video_id = self._match_id(url).. webpage = self._download_webpage(url, video_id).. stream_url = self._search_regex(. r

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tv5mondeplus.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3020
Entropy (8bit):	4.673002562051286
Encrypted:	false
SSDEEP:	48:+uEWOwCKocz/jzd8BhPIULtSi01JoXjlhlbYOyl7fuqtcTMd0LO0YtBTtHjN3a6G:TONKog/XGhPltSiqJslbSNDtcgd0LOfC
MD5:	B6D2E72C4548034F8553C6BC8A37FB52
SHA1:	603F94677DA465ABBEF6ABD1DB756CA4E8F2DFFA
SHA-256:	A1F9601A815361D109C078B6BF267077AFC5F77533553B19C09F1F0BEFDEDAA9
SHA-512:	EB9F6938EB06CD494205A6F006CF02C753EFF53658B87189793644806AA6FCAC565AA139AF8CA46A24EC307E10BD715B2E456F15B8976C2C227D1298F5671D11
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. extract_attributes,. get_element_by_class,. int_or_none,. parse_duration,. parse_iso8601,.)...class TV5MondePlusIE(InfoExtractor):. IE_DESC = 'TV5MONDE+'. _VALID_URL = r'https?://(?:www\.)?tv5mondeplus\.com/toutes-les-videos/[^/]+/(?P<id>[^/?#]+)'. _TEST = {. 'url': 'http://www.tv5mondeplus.com/toutes-les-videos/documentaire/tdah-mon-amour-tele-quebec-tdah-mon-amour-ep001-enfants',. 'md5': '12130fc199f020673138a83466542ec6',. 'info_dict': {. 'id': 'tdah-mon-amour-tele-quebec-tdah-mon-amour-ep001-enfants',. 'ext': 'mp4',. 'title': 'Tdah, mon amour - Enfants',. 'description': 'md5:230e3aca23115afcf8006d1bece6df74',. 'upload_date': '20170401',. 'timestamp': 1491022860,. }. }. _GEO_BYPASS = False.. def _real_extract(se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tva.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1894
Entropy (8bit):	4.75852148720034
Encrypted:	false
SSDEEP:	48:+uj2wqHLFWrD1qii/WS5jXjMBDl74VzEKR8oxJr4sD/TE:X2wqHLFWrgilS52lVoxJr4szTE
MD5:	419EA0836984EAB1E7FD260E73D09ADA
SHA1:	2AC8BAA4E3BC8DBBA3011FC7235EC140A0A2B920
SHA-256:	1630A290AB4D32B667C3AA0A6ED7BCC66884EED86EAAF31545BF87D0EEA911BB
SHA-512:	D6AFF57FCF66CCBB09D154D76C328EDCA509D1B80091319A1F42C5A120FF495EB4879C8E95DB2E4978EFCBA7404FC0CFDABE355307E4A7F7F11E2EAE88318F1F
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. float_or_none,. smuggle_url,.)...class TVAIE(InfoExtractor):. _VALID_URL = r'https?://videos\.tva\.ca/details/_(?P<id>\d+)'. _TEST = {. 'url': 'https://videos.tva.ca/details/_5596811470001',. 'info_dict': {. 'id': '5596811470001',. 'ext': 'mp4',. 'title': 'Un extrait de l\'.pisode du dimanche 8 octobre 2017 !',. 'uploader_id': '5481942443001',. 'upload_date': '20171003',. 'timestamp': 1507064617,. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/5481942443001/default_default/index.html?videoId=%s'.. def _real_extract(self, url):. video_id = self._match_id(url). video_data = self._download_json(. 'https://videos.tva.ca/proxy/item/_' + vi

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvanouvelles.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2401
Entropy (8bit):	5.1195636458074985
Encrypted:	false
SSDEEP:	48:+uyY7wOrMDy7i/SmU5tXjlLmE95OoJCgIejShLhfJoXhhIqnAlVNVWCbH:WY7wbDy7PmU57mmPCgIm6JadAJ7
MD5:	166B9EAD07F3A70C3E68DCECFBCDDE0B
SHA1:	B6CC612CF89CCE935D41C214DFDD49EF7C5326C3
SHA-256:	7FBB384ECA5FD9BFF419E508E242B0A85C9D50DC0A85C39CB3D650C59E8D857F
SHA-512:	43695EAF9C0D08F694F5F19F90BCA7F9F2796B94EC76CA961A46245143F93BD95D65CF2CC27E9FBDAF40C7114BE860FD8AC341C9A563B39E9495A85ECEBA1D7A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from .brightcove import BrightcoveNewIE...class TVANouvellesIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?tvanouvelles\.ca/videos/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.tvanouvelles.ca/videos/5117035533001',. 'info_dict': {. 'id': '5117035533001',. 'ext': 'mp4',. 'title': 'L.industrie du taxi d.nonce l.entente entre Qu.bec et Uber: explications',. 'description': 'md5:479653b7c8cf115747bf5118066bd8b3',. 'uploader_id': '1741764581',. 'timestamp': 1473352030,. 'upload_date': '20160908',. },. 'add_ie': ['BrightcoveNew'],. }. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/1741764581/default_default/index.html?videoId=%s'.. def _real_extract(self, url):. brightcove_id = self._match_id(url). return self.url_result(. self.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvc.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3910
Entropy (8bit):	4.982185985447009
Encrypted:	false
SSDEEP:	96:eRSvcNbgXjnxp8nXi5cDaGmBTKjiUgNs6NezpNb2ZXjoQn7QXjFduikxXj8Cfk3:oSvcBCKXiW+fTKD6N0pB1Q7OEjSwc
MD5:	435FD89AA18630A790CE48D87AF0C789
SHA1:	DC53856C0F3C1DC27C8D52D6ACC5690923D963D7
SHA-256:	38108ECA50FD6D511BD16F23C80753D39B8F39A6672D451918C0173997E85187
SHA-512:	673291CE728FF9FC7325E5AFD37C80E40FD0573D9F7441AFE48A522FDAE9591416657CCD7A25B5CD781C5E2F9AD7D743FBA7846C121015F4998B9D10672618D2
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,.)...class TVCIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?tvc\.ru/video/iframe/id/(?P<id>\d+)'. _TEST = {. 'url': 'http://www.tvc.ru/video/iframe/id/74622/isPlay/false/id_stat/channel/?acc_video_id=/channel/brand/id/17/show/episodes/episode_id/39702',. 'md5': 'bbc5ff531d1e90e856f60fc4b3afd708',. 'info_dict': {. 'id': '74622',. 'ext': 'mp4',. 'title': '........ ".......". .... .. 22.05.2015 14:30',. 'thumbnail': r're:^https?://.*\.jpg$',. 'duration': 1122,. },. }.. @classmethod. def _extract_url(cls, webpage):. mobj = re.search(. r'<iframe[^>]+?src=(["\'])(?P<url>(?:http:)?//(?:www\.)?tvc\.ru/video/iframe/id/[^"]+)\1', webpage). if mobj:. return mobj.group('url').. def

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvigle.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4229
Entropy (8bit):	4.725492290147779
Encrypted:	false
SSDEEP:	96:P3GRtVXVqXkzgwJPBRj6G5+8TYHrJqagyZGu2mEBV6/BTLt/8Z6Ng:/aEkbJ7j6G5TYLVzGu2pETmZ6Ng
MD5:	34807E602EDBF3A27DF873990E70D6EB
SHA1:	8F4026548A24ED275213020F2B18D8298DA9725C
SHA-256:	7B8C84A058FAAB9C4A46AB51FF58C2450FC8829BE1490E31B6651619791C3668
SHA-512:	530EEAE6B80D8AE163994B14BE1F4A62B351AB1658AA545990970DA650FCD4BB4B49289D3BF9F946B8F5FE0257955AEE8C8B4A27AA79F2B18046DAE99ED55265
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. ExtractorError,. float_or_none,. int_or_none,. parse_age_limit,.)...class TvigleIE(InfoExtractor):. IE_NAME = 'tvigle'. IE_DESC = '........-........... Tvigle.ru'. _VALID_URL = r'https?://(?:www\.)?(?:tvigle\.ru/(?:[^/]+/)+(?P<display_id>[^/]+)/$\|cloud\.tvigle\.ru/video/(?P<id>\d+))'.. _GEO_BYPASS = False. _GEO_COUNTRIES = ['RU'].. _TESTS = [. {. 'url': 'http://www.tvigle.ru/video/sokrat/',. 'md5': '36514aed3657d4f70b4b2cef8eb520cd',. 'info_dict': {. 'id': '1848932',. 'display_id': 'sokrat',. 'ext': 'flv',. 'title': '......',. 'description': 'md5:d6b92ffb7217b4b8ebad2e7665253c17',. 'duration': 6586,. 'age_limit': 12,. },. 'skip': 'georestricted'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvland.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	5.114780571646612
Encrypted:	false
SSDEEP:	24:zi8llDzDxKVG3lT3KdPxCGlHKbtKt7a34/tjlt4eI5ZPtKNy/Dodl/MVpmAZ3HN/:+ul/lS4lTmPcGlHStuRI/t1sYVIkN2qz
MD5:	B426403B3AE3877E010DC6A983F44B36
SHA1:	9F32C2A5937BF081453D741A2B0E11B4DB7C4061
SHA-256:	7C06FFC2038789BBA738742D133BF6CF5C0C4A60C394C016F77D34171D203BE6
SHA-512:	861248036465948841003AD363F35AFA68D4869EB4EB88EF6FC1F16D40EAC59D1899813C32D5D827A7AB62FB49E238A37E15ECCD7F54FB89899F966085D06A74
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .spike import ParamountNetworkIE...class TVLandIE(ParamountNetworkIE):. IE_NAME = 'tvland.com'. _VALID_URL = r'https?://(?:www\.)?tvland\.com/(?:video-clips\|(?:full-)?episodes)/(?P<id>[^/?#.]+)'. _FEED_URL = 'http://www.tvland.com/feeds/mrss/'. _TESTS = [{. # Geo-restricted. Without a proxy metadata are still there. With a. # proxy it redirects to http://m.tvland.com/app/. 'url': 'https://www.tvland.com/episodes/s04pzf/everybody-loves-raymond-the-dog-season-1-ep-19',. 'info_dict': {. 'description': 'md5:84928e7a8ad6649371fbf5da5e1ad75a',. 'title': 'The Dog',. },. 'playlist_mincount': 5,. }, {. 'url': 'https://www.tvland.com/video-clips/4n87f2/younger-a-first-look-at-younger-season-6',. 'md5': 'e2c6389401cf485df26c79c247b08713',. 'info_dict': {. 'id': '891f7d3c-5b5b-4753-b879-b7ba1a601757',. 'ext': 'mp4',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvn24.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2954
Entropy (8bit):	4.941630070325161
Encrypted:	false
SSDEEP:	48:+udbV7fWH6mXudgp4gQUvLjObXGXXfs4jxELXECMtfjXhkdVSwOHP6oEf3/p1YTv:5pjWamXudSfvLyzGnF0EBfavW6ok3/pK
MD5:	5567C9419A6BB4036403244B16BD2315
SHA1:	2A57A048489062BF1146D2B6A7033763F7E05285
SHA-256:	7C2BB25051BC17775195E899CE888B2C67198D470F0932A08AE9527620B104E1
SHA-512:	BD876EE81159F3A6783B5992426C5DACD6A3A019E738C9F1BBFE99787912E5F1D98FD7F76885C49115D2AD1F6821A8F6AA654EA2098F4C08323CCF539C3ACBA8
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. unescapeHTML,.)...class TVN24IE(InfoExtractor):. _VALID_URL = r'https?://(?:(?:[^/]+)\.)?tvn24(?:bis)?\.pl/(?:[^/]+/)(?P<id>[^/]+)'. _TESTS = [{. 'url': 'http://www.tvn24.pl/wiadomosci-z-kraju,3/oredzie-artura-andrusa,702428.html',. 'md5': 'fbdec753d7bc29d96036808275f2130c',. 'info_dict': {. 'id': '1584444',. 'ext': 'mp4',. 'title': '".wi.ta maj. by. weso.e, dlatego, ludziska, wszyscy pod jemio.."',. 'description': 'Wyj.tkowe or.dzie Artura Andrusa, jednego z go.ci "Szk.a kontaktowego".',. 'thumbnail': 're:https?://.[.]jpeg',. }. }, {. 'url': 'http://fakty.tvn24.pl/ogladaj-online,60/53-konferencja-bezpieczenstwa-w-monachium,716431.html',. 'only_matching': True,. }, {. 'url': 'http://sport.tvn24.pl/pilka-nozna,105/ligue-1-kamil-

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvnet.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4942
Entropy (8bit):	4.720323793449986
Encrypted:	false
SSDEEP:	96:6Eo6nvs4AP2/Fb4lpdGVRsxFb4wDpwB46kWTn6a6kopMfa6sr6iJQJOs+7BTjdH1:Po6vqjpdGHSpA4gT6aOp6azr6iYOs+tb
MD5:	B16172F79B66D583CD7ADD3A4EE6F5FC
SHA1:	86F9719B66AF1A2E43D00DD56AA95FC7F87A9C58
SHA-256:	6202A7081294493AE7F8F15109BF55A1D16B9E1EA2FA4C643AEE77BDEA627508
SHA-512:	0092DDB2E0E9CA9B1EA07031E0E00C0F567D54E2586C64BE0990EACA5D6E65E1CF0B452F904C62CA54465819C4D56B3F2DE3C27B9283A86A3652001F2FF4A69B
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. unescapeHTML,. url_or_none,.)...class TVNetIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+)\.tvnet\.gov\.vn/[^/]+/(?:\d+/)?(?P<id>\d+)(?:/\|$)'. _TESTS = [{. # video. 'url': 'http://de.tvnet.gov.vn/video/109788/vtv1---bac-tuyet-tai-lao-cai-va-ha-giang/tin-nong-24h',. 'md5': 'b4d7abe0252c9b47774760b7519c7558',. 'info_dict': {. 'id': '109788',. 'ext': 'mp4',. 'title': 'VTV1 - B.c tuy.t t.i L.o Cai v. H. Giang',. 'thumbnail': r're:(?i)https?://.*\.(?:jpg\|png)',. 'is_live': False,. 'view_count': int,. },. }, {. # audio. 'url': 'http://vn.tvnet.gov.vn/radio/27017/vov1---ban-tin-chieu-10062018/doi-song-va-xa-hoi',. 'md5': 'b5875ce9b0a2eecde029216d0e6db2ae',. 'info_dict': {. 'id': '27017'

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvnoe.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.8762301935981505
Encrypted:	false
SSDEEP:	24:zi8lFvWqcO1GEsw6Bznv/crlEbuFf1aeIXjlgtpBDuX9tIVCx/rayxPxlV00L2SP:+uLXsTTcWCFdajXjlkpBDuXbwA/rbPzZ
MD5:	D7D04F62C67601D57B9573541860027B
SHA1:	EE35A47B5859715DADB861EC78BCE67491BEF81A
SHA-256:	E74C3A248A0B6FF3E78CA07566D0B64CAB1E36AA32C35E7D9FD8B5A4807C938A
SHA-512:	A48E81C8E1F5FC34D3D0C6F1D84791F3468F48184D9222C4C99B22EF2017ACAD6C5FB28FEA6E248B3F2929DA5FC6875D9E16AA0C68E3D5D85C4C125A42922A4D
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. get_element_by_class,. js_to_json,.)...class TVNoeIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?tvnoe\.cz/video/(?P<id>[0-9]+)'. _TEST = {. 'url': 'http://www.tvnoe.cz/video/10362',. 'md5': 'aee983f279aab96ec45ab6e2abb3c2ca',. 'info_dict': {. 'id': '10362',. 'ext': 'mp4',. 'series': 'No.n. univerzita',. 'title': 'prof. Tom.. Hal.k, Th.D. - N.vrat n.bo.enstv. a st.et civilizac.',. 'description': 'md5:f337bae384e1a531a52c55ebc50fff41',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpage(url, video_id).. iframe_url = self._search_regex(. r'<iframe[^>]+src="([^"]+)"', webpage, 'iframe URL').. ifs_page = self._download_webpage(iframe_url, video_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvnow.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18470
Entropy (8bit):	4.662997868826779
Encrypted:	false
SSDEEP:	384:EWh12Ps2GO2TauTg+26NWMkG1T0vrE5Dh19wkKckW/Wo1rgbw13Ms6Oq+Q2uT0U8:EWh12Ps2GO2TauTV28NVl9wkJPv13Ms5
MD5:	D5FFDB088BD5719F8188EF3571656EC7
SHA1:	9BEE01B07DA119243C7FEF2B7925264612EED63B
SHA-256:	D0D3E4DB4083EB43A095E7E2EEB48B6DC323E856992F2483A15B2A25DDA04530
SHA-512:	5A3B6D46F23EA9135518B8842EDDCBA15750C91502C50C37E25E0182A29DB9B1CAE926A72A2AB4318DF00B745C0DF4CAE6B67B912807CCB1401FD1C6EFEEF845
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_str.from ..utils import (. ExtractorError,. int_or_none,. parse_iso8601,. parse_duration,. str_or_none,. update_url_query,. urljoin,.)...class TVNowBaseIE(InfoExtractor):. _VIDEO_FIELDS = (. 'id', 'title', 'free', 'geoblocked', 'articleLong', 'articleShort',. 'broadcastStartDate', 'isDrm', 'duration', 'season', 'episode',. 'manifest.dashclear', 'manifest.hlsclear', 'manifest.smoothclear',. 'format.title', 'format.defaultImage169Format', 'format.defaultImage169Logo').. def _call_api(self, path, video_id, query):. return self._download_json(. 'https://api.tvnow.de/v3/' + path, video_id, query=query).. def _extract_video(self, info, display_id):. video_id = compat_str(info['id']). title = info['title'].. paths = []. for manifest_url in (info.get('manifest') o

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	9417
Entropy (8bit):	4.852825293035197
Encrypted:	false
SSDEEP:	192:+2+sR4SlQbTsuaFwACoMUD5lP0N5xDMvoWsaixdohLo6zzG1INRZTk6NdVoiN1xm:jJR4SlQbTsTFwAClUD5lMN5xDMvoWsaK
MD5:	4325ADC5FC8925C6E02B48ABD9F5F3CE
SHA1:	8C6FE5C9816FA48D1846893207796FF422EBAF88
SHA-256:	0CEF7CCBCBB53C362F95F8FCFFBF39A79A1167966B5AA00A53343778C83C0EC1
SHA-512:	E5562C4F43523DBB375A331BEB6380B452FAFA7A2EA36B4115E127EAD480E2E1E1E9011E7B32570DE487861FF75A296BA840FCF4966075FF381CF1859EEDF83C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re..from .common import InfoExtractor.from ..utils import (. clean_html,. determine_ext,. ExtractorError,. get_element_by_attribute,. orderedSet,.)...class TVPIE(InfoExtractor):. IE_NAME = 'tvp'. IE_DESC = 'Telewizja Polska'. _VALID_URL = r'https?://[^/]+\.tvp\.(?:pl\|info)/(?:video/(?:[^,\s],)\|(?:(?!\d+/)[^/]+/)*)(?P<id>\d+)'.. _TESTS = [{. 'url': 'https://vod.tvp.pl/video/czas-honoru,i-seria-odc-13,194536',. 'md5': 'a21eb0aa862f25414430f15fdfb9e76c',. 'info_dict': {. 'id': '194536',. 'ext': 'mp4',. 'title': 'Czas honoru, odc. 13 . W.adek',. 'description': 'md5:437f48b93558370b031740546b696e24',. },. }, {. 'url': 'http://www.tvp.pl/there-can-be-anything-so-i-shortened-it/17916176',. 'md5': 'b0005b542e5b4de643a9690326ab1257',. 'info_dict': {. 'id': '17916176',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvplay.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	20722
Entropy (8bit):	4.488414715022578
Encrypted:	false
SSDEEP:	384:JrHt9punJle4a5BQN5RIpZDcEM5VpcgCK3SiwwOlfmHVMTy6N++h/crMcssh3kNY:5ycgCK3SiwwOleHVMTy8ossh3kNBVBsv
MD5:	F14D920CA55700E43C6890FC01C15DFF
SHA1:	E43FBDF29089D3B75CE4DBD4AF5B790D7DDF0FB6
SHA-256:	E87E7C31F78E9CB58D2A877A6DE258A815B0F2060E556D56F9C104D811E43AE3
SHA-512:	271475318F60F32492099EEB46C3A8336DC18EC5170B8D54E6EB730CB84E5B8F866F7E9023B953EBA7F3D01F3F7571BB27BD1254FA631892EEC3DFAA8CC93579
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,. compat_urlparse,.).from ..utils import (. determine_ext,. ExtractorError,. int_or_none,. parse_iso8601,. qualities,. smuggle_url,. try_get,. unsmuggle_url,. update_url_query,. url_or_none,.)...class TVPlayIE(InfoExtractor):. IE_NAME = 'mtg'. IE_DESC = 'MTG services'. _VALID_URL = r'''(?x). (?:. mtg:\|. https?://. (?:www\.)?. (?:. tvplay(?:\.skaties)?\.lv(?:/parraides)?\|. (?:tv3play\|play\.tv3)\.lt(?:/programos)?\|. tv3play(?:\.tv3)?\.ee/sisu\|. (?:tv(?:3\|6\|8\|10)play\|viafree)\.se/program\|. (?:(?:tv3play\|viasat4play\|tv6p

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tvplayer.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2826
Entropy (8bit):	4.582019896042155
Encrypted:	false
SSDEEP:	48:+uny4rxygrD1qaJoXjlhlgsLh7BrwPBYUJLwBAgz3yI5NxouVYjhrqGQBTq6NYK:jy4rxnrgaJshLhVwKwL5gz3fVYjldQBT
MD5:	14E26C2E70F698ABE70B57F7F9EB735D
SHA1:	78F1148184C1E5AE20B9DA279BF90DF38B10F51D
SHA-256:	56C71D8BC00498627FF3558BA4AE059D14D20A9EA91366F8C8C0EBFA60CD2B79
SHA-512:	832D6A115A9D80DBB4D994D396C409FD3C4AD3745998CB2AC253144D66EBA319D1C6EE33C40EA458D57CA8E5D33F733EA0634373301D4770E9377E403FA72A56
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_str,.).from ..utils import (. extract_attributes,. try_get,. urlencode_postdata,. ExtractorError,.)...class TVPlayerIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?tvplayer\.com/watch/(?P<id>[^/?#]+)'. _TEST = {. 'url': 'http://tvplayer.com/watch/bbcone',. 'info_dict': {. 'id': '89',. 'ext': 'mp4',. 'title': r're:^BBC One [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}$',. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }.. def _real_extract(self, url):. display_id = self._match_id(url). webpage = self._download_webpage(url, display_id).. current_channel = extract_attributes(self._search_regex(. r'(<div[^>]+class="[^"]current-channel[^"]"[^>]*>)',. webpage, 'channel ele

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\tweakers.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	4.492749924054443
Encrypted:	false
SSDEEP:	48:PuZWOf5roSHarvwajXjMBdaO2HtZaDkkbdksTxBTKxFNNty6Ng:LO9ZHarvwaTGDkYdkMBTKxFNNty6Ng
MD5:	C9B75D9331953E2D31B33AF2817852DA
SHA1:	EF8EADF0323879944EC05E20F576211BE935EE30
SHA-256:	BE00EB95354E33680386ACF3DA5809337D4C2D4DD5CEC58E2DB43275D26A7D4D
SHA-512:	9C2906582A2E3AF293CB93C7ADB25F237110FD0CC6A1231EFCEF33F248096B97A290880D87DF9C95BD25FCDAEA5377ADBB5BDF71DA2D384C5FB990F7D8716BBA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. determine_ext,. mimetype2ext,.)...class TweakersIE(InfoExtractor):. _VALID_URL = r'https?://tweakers\.net/video/(?P<id>\d+)'. _TEST = {. 'url': 'https://tweakers.net/video/9926/new-nintendo-3ds-xl-op-alle-fronten-beter.html',. 'md5': 'fe73e417c093a788e0160c4025f88b15',. 'info_dict': {. 'id': '9926',. 'ext': 'mp4',. 'title': 'New Nintendo 3DS XL - Op alle fronten beter',. 'description': 'md5:3789b21fed9c0219e9bcaacd43fab280',. 'thumbnail': r're:^https?://.*\.jpe?g$',. 'duration': 386,. 'uploader_id': 's7JeEm',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). video_data = self._download_json(. 'https://tweakers.net/video/s1playlist/%s/1920/1080/playlist.json' % video_id,. video_id)['items'][0]..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\twentyfourvideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.81363673244651
Encrypted:	false
SSDEEP:	96:+sFQQMSgXIYCZ8whTYAfAKjaZ2dKbOQQ2s2s9CxLZWVJNUItN8As6Ng:+sCv5whTYWAKju49CxlHZ6Ng
MD5:	07A052A16A0869703DC4DF31FE060B82
SHA1:	FD8F38B3130E0DAE98957F753147CB0BAE90D6D6
SHA-256:	DE52344122BF6E3ED27017C5D8959D451584982E5E6254A9ED64070BC5E03699
SHA-512:	6BF34A669232FA3E7C7716E12B4697C2A88B6EABABC15420ABC6D8AB416E64B1525905A765311566247105CAAEC84F4CEAACA25DC66C1282F4F37D69122CBE4E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. parse_iso8601,. int_or_none,. xpath_attr,. xpath_element,.)...class TwentyFourVideoIE(InfoExtractor):. IE_NAME = '24video'. _VALID_URL = r'''(?x). https?://. (?P<host>. (?:(?:www\|porno)\.)?24video\.. (?:net\|me\|xxx\|sexy?\|tube\|adult\|site). )/. (?:. video/(?:(?:view\|xml)/)?\|. player/new24_play\.swf\?id=. ). (?P<id>\d+). '''.. _TESTS = [{. 'url': 'http://www.24video.net/video/view/1044982',. 'md5': 'e09fc0901d9eaeedac872f154931deeb',. 'info_dict': {. 'id': '1044982',. 'ext': 'mp4',. 'title': '....... ......... ....',.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\twentymin.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	4.628363949331134
Encrypted:	false
SSDEEP:	48:+uEMFpSCfFZ1KFJ8GigqEFh2dEF0OxZgqdN2FLt8cyaBLxMwjXXBwm1CavWXBTow:fF784zEFhdF0OxZzdoFh8cyaswqmwcWn
MD5:	7BCBC9E4A080CF765E65AF2DE6B9354F
SHA1:	3A5B2AF99B5DAD70BB91FBC26B7C6BF189673EF3
SHA-256:	18E276F3C3B043FA8CE6F5C0B551CFC9B9A5CF1280F214462365A51E0C9E0544
SHA-512:	6E9BE08BF4DC00C8FFD84EE95DFE963F3D90134FAD01491D5A579979CE37F589384F0F99053BE939483F007F78D6EC5069B6C0E0C0F463B5FCFFB1631828B5AE
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. int_or_none,. try_get,.)...class TwentyMinutenIE(InfoExtractor):. IE_NAME = '20min'. _VALID_URL = r'''(?x). https?://. (?:www\.)?20min\.ch/. (?:. videotv/\?.?\bvid=\|. videoplayer/videoplayer\.html\?.?\bvideoId@. ). (?P<id>\d+). '''. _TESTS = [{. 'url': 'http://www.20min.ch/videotv/?vid=469148&cid=2',. 'md5': 'e7264320db31eed8c38364150c12496e',. 'info_dict': {. 'id': '469148',. 'ext': 'mp4',. 'title': '85 000 Franken f.r 15 perfekte Minuten',. 'thumbnail': r're:https?://.\.jpg$',. },. }, {. 'url': 'http://www.20min.ch/videoplayer/videoplayer.html?params=client@twentyDE\|videoId@523629

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\twentythreevideo.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3098
Entropy (8bit):	4.633622597409986
Encrypted:	false
SSDEEP:	96:7K9epBnVOyBEN8aJ6d6vj0zcazjKGXF6Ng:m9MVtaCaJ6d8Pa6w6Ng
MD5:	FCBB875C9B04D9D3F8B8DA09A305FD90
SHA1:	99A1E46A8090044C70E5D403932DBA213D123C8B
SHA-256:	073D8231E9DEF43C058C4B3E083C89F039EE3944526ACBA7E00A986D55298E8B
SHA-512:	1BB0F26E1AF5F6FC6494A115B2CDF860276F225C098008EC3B286F1307F634297F729F998A13CF4F66D0EF7E9DCDB41330EC989445E9A03F0DC2927D3B3E67B9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import int_or_none...class TwentyThreeVideoIE(InfoExtractor):. IE_NAME = '23video'. _VALID_URL = r'https?://video\.(?P<domain>twentythree\.net\|23video\.com\|filmweb\.no)/v\.ihtml/player\.html\?(?P<query>.?\bphoto(?:_\|%5f)id=(?P<id>\d+).)'. _TEST = {. 'url': 'https://video.twentythree.net/v.ihtml/player.html?showDescriptions=0&source=site&photo%5fid=20448876&autoPlay=1',. 'md5': '75fcf216303eb1dae9920d651f85ced4',. 'info_dict': {. 'id': '20448876',. 'ext': 'mp4',. 'title': 'Video Marketing Minute: Personalized Video',. 'timestamp': 1513855354,. 'upload_date': '20171221',. 'uploader_id': '12258964',. 'uploader': 'Rasmus Bysted',. }. }.. def _real_extract(self, url):. domain, query, photo_id = re.match(self._VALID_URL, url).groups(). base_url = 'https://video

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\twitcasting.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2803
Entropy (8bit):	4.738978549118892
Encrypted:	false
SSDEEP:	48:+ulAeURf22SXdN2sQf1mu5J7XdNNsfdfFk9a3lkEXnOvbBxAdW5qGl1kieVZVbdr:ZADZ22SXdosQf55J7XdbsftKiOvkdW58
MD5:	F67D412E27A606F2AF919E21B9161522
SHA1:	29D7282748B90EA23037876E0FD0A5E51858C6A9
SHA-256:	6F772EC218AEEC8858CA3C3C2AA08A9FB822942AE3409DC4FDE8E9220C0CB442
SHA-512:	64916B90AD08621B0F248CB7698C8444EF1D25380A92A99940C1DFB34CCDE5AD644CEB92388F54C259769A0E677FCA5E06D532642C2082A7DBCAE9C58A400479
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import urlencode_postdata..import re...class TwitCastingIE(InfoExtractor):. _VALID_URL = r'https?://(?:[^/]+\.)?twitcasting\.tv/(?P<uploader_id>[^/]+)/movie/(?P<id>\d+)'. _TESTS = [{. 'url': 'https://twitcasting.tv/ivetesangalo/movie/2357609',. 'md5': '745243cad58c4681dc752490f7540d7f',. 'info_dict': {. 'id': '2357609',. 'ext': 'mp4',. 'title': 'Live #2357609',. 'uploader_id': 'ivetesangalo',. 'description': "Moi! I'm live on TwitCasting from my iPhone.",. 'thumbnail': r're:^https?://.*\.jpg$',. },. 'params': {. 'skip_download': True,. },. }, {. 'url': 'https://twitcasting.tv/mttbernardini/movie/3689740',. 'info_dict': {. 'id': '3689740',. 'ext': 'mp4',. 'title': 'Live playing something #3689740',. 'u

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\twitch.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25467
Entropy (8bit):	4.652449888556885
Encrypted:	false
SSDEEP:	768:9gShZTthtTUelxdnEef2l+e4ESUudYl8dK4S3Tt8j7i:CShZTthtTUelxdnEeulAVUudYl8dKF3h
MD5:	F2AAB9182459D334666CF9D555C4339D
SHA1:	1EB63CEA5875D2EFCC0A730FDCD928108E7B2C38
SHA-256:	94A4FDB86D45C55EF902B5E82F9A0C8AA508341BF8F654B5957E8E970207C6CA
SHA-512:	E62D1EA6525FABB933CF11593902E8D386BABE3B0EFD5BD11C90D97FA98A401B18FFBCAA0399B7FAE2512E6A4E928A8D7AE47BCAC75B094FB85B287B4E2619CD
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import itertools.import re.import random.import json..from .common import InfoExtractor.from ..compat import (. compat_kwargs,. compat_parse_qs,. compat_str,. compat_urllib_parse_urlencode,. compat_urllib_parse_urlparse,.).from ..utils import (. clean_html,. ExtractorError,. float_or_none,. int_or_none,. orderedSet,. parse_duration,. parse_iso8601,. qualities,. try_get,. unified_timestamp,. update_url_query,. url_or_none,. urljoin,.)...class TwitchBaseIE(InfoExtractor):. _VALID_URL_BASE = r'https?://(?:(?:www\|go\|m)\.)?twitch\.tv'.. _API_BASE = 'https://api.twitch.tv'. _USHER_BASE = 'https://usher.ttvnw.net'. _LOGIN_FORM_URL = 'https://www.twitch.tv/login'. _LOGIN_POST_URL = 'https://passport.twitch.tv/login'. _CLIENT_ID = 'kimne78kx3ncx6brgo4mv6wki5h1ko'. _NETRC_MACHINE = 'twitch'.. def _handle_error(self, response):. if not isinstance(response,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\twitter.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	23622
Entropy (8bit):	4.811907792779558
Encrypted:	false
SSDEEP:	384:rauu1Onrj12X7jjMeim7UyVOWvoW6w/aE9UC+02i7iOlb2gcYdBPHyC76U+1ZYzI:rauu1OnhyVOWvoW6w/aE9UC+02i7iOlu
MD5:	43DE221222B7CDED45B54893D9E7D6AF
SHA1:	E62B39AEDB15D247EDCC556B8CFBFAAB36183516
SHA-256:	9DB690EA5A0D4D6DF1845EBDF8D553AD7D5F36EDE5BEA925F093A24D735820A0
SHA-512:	1EC9B418BF517024292C252DC83FE96F6B9C66FC372EEFA8304A7284D1E6D02DDD501D5B4D9C489C181E141DCE76C665B442715CB81F1C0A22B491500383BFEA
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import compat_urlparse.from ..utils import (. determine_ext,. dict_get,. ExtractorError,. float_or_none,. int_or_none,. remove_end,. try_get,. xpath_text,.)..from .periscope import PeriscopeIE...class TwitterBaseIE(InfoExtractor):. def _extract_formats_from_vmap_url(self, vmap_url, video_id):. vmap_data = self._download_xml(vmap_url, video_id). video_url = xpath_text(vmap_data, './/MediaFile').strip(). if determine_ext(video_url) == 'm3u8':. return self._extract_m3u8_formats(. video_url, video_id, ext='mp4', m3u8_id='hls',. entry_protocol='m3u8_native'). return [{. 'url': video_url,. }].. @staticmethod. def _search_dimensions_in_video_url(a_format, video_url):. m = re.search(r'/(?P<width>\d+)x(?P<height>\d+)/', video_url). if m:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\udemy.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19413
Entropy (8bit):	4.41428319684233
Encrypted:	false
SSDEEP:	384:pNddIVTfsWfgWeNNStV7tuYaNOVruvd2zgzLAit+Z9cTQV6NV6F0Yg:4VBfYNSzZRaNOVruvd2zgzLAi8Z9cTQ8
MD5:	E5C21C5CE8F71FDA99DF2882B7AFBEB0
SHA1:	6FC7FA0A38309E5975CF94B6125EF67ECB8D3184
SHA-256:	FA1C5361AB1B4BD71D747D25A40A8796C1F26334EC13D5081B3E5CA899B94CF4
SHA-512:	276FF805B74EF482A4E3A25A0A7BCB4EE4810E271921D596BD9BE1890DBF8D6E78A0B1730AB2DCBBF64DD6492ABDAAC11C63A7E16DDC0D6BA6EF074AF95B8B69
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..compat import (. compat_HTTPError,. compat_kwargs,. compat_str,. compat_urllib_request,. compat_urlparse,.).from ..utils import (. determine_ext,. extract_attributes,. ExtractorError,. float_or_none,. int_or_none,. js_to_json,. sanitized_Request,. try_get,. unescapeHTML,. url_or_none,. urlencode_postdata,.)...class UdemyIE(InfoExtractor):. IE_NAME = 'udemy'. _VALID_URL = r'''(?x). https?://. (?:[^/]+\.)?udemy\.com/. (?:. [^#]+\#/lecture/\|. lecture/view/?\?lectureId=\|. [^/]+/learn/v4/t/lecture/. ). (?P<id>\d+). '''. _LOGIN_URL = 'https://www.udemy.com/join/login-popup/?displayType=ajax&showSkipButton=1'. _ORIGIN_URL = 'https://ww

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\udn.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	3575
Entropy (8bit):	4.645532952108251
Encrypted:	false
SSDEEP:	96:KO099dXdrsKspkfqASUSF1YLfpLOl9vily/iYbR11BTg6NJdJ:H0DTsoq3USF1YLxLOlJilNYV1LTg6NR
MD5:	59C4AE7A6EF2B45645024A46F5A9D16A
SHA1:	DD6204488E08DEFD66FA3F5061F378D7A7646E10
SHA-256:	4F19746A94E4B4C1CAEAE55FB560E1D33D793A20271F73F1CF46B7B80FB00605
SHA-512:	C247E4967338DF16EBEBDD5A964E2E69284C7048940F10E7FF409E56E2EC5AEFD6E9F03FF1EC83D838385D4AC7595D891EFAB2574EB8CCE19910999B2E88A532
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. determine_ext,. int_or_none,. js_to_json,.).from ..compat import compat_urlparse...class UDNEmbedIE(InfoExtractor):. IE_DESC = '....'. _PROTOCOL_RELATIVE_VALID_URL = r'//video\.udn\.com/(?:embed\|play)/news/(?P<id>\d+)'. _VALID_URL = r'https?:' + _PROTOCOL_RELATIVE_VALID_URL. _TESTS = [{. 'url': 'http://video.udn.com/embed/news/300040',. 'info_dict': {. 'id': '300040',. 'ext': 'mp4',. 'title': '....... ..."..."',. 'thumbnail': r're:^https?://.*\.jpg$',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'expected_warnings': ['Failed to parse JSON Expecting value'],. }, {. 'url': 'https://video.udn.com/embed/news/300040',. 'only_matching': True,. }, {. # From https://

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\ufctv.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2480
Entropy (8bit):	4.677866579386833
Encrypted:	false
SSDEEP:	48:+uATtWnPy/1qpe2rD1q+pRZBlmbJoXjMMHBoGhnWYqGFJBTK3EYWk6Ng:kWnPC10e2rgmgbJmaGtWYdFJBTK3EYPL
MD5:	FD8CCCEA2EF2DC6013879EBCC712F249
SHA1:	893F42211D5D88D40CCB6853F37E332E11174119
SHA-256:	1A365D86410B1C6630A9EFE21A50B4AFD0078C9AB8F1BB0A3FF1320116B755A9
SHA-512:	67B67DF3ED930CB4CE688D85B6FB84006C2C999986000F9AA209BA8C49B91D16BA1B7D0B3A6D0FA18D8B67C9A58E07DF360EDEBEAFD203A70D7542034A356370
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. ExtractorError,. parse_duration,. parse_iso8601,. urlencode_postdata,.)...class UFCTVIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?ufc\.tv/video/(?P<id>[^/]+)'. _NETRC_MACHINE = 'ufctv'. _TEST = {. 'url': 'https://www.ufc.tv/video/ufc-219-countdown-full-episode',. 'info_dict': {. 'id': '34167',. 'ext': 'mp4',. 'title': 'UFC 219 Countdown: Full Episode',. 'description': 'md5:26d4e8bf4665ae5878842d7050c3c646',. 'timestamp': 1513962360,. 'upload_date': '20171222',. },. 'params': {. # m3u8 download. 'skip_download': True,. }. }.. def _real_initialize(self):. username, password = self._get_login_info(). if username is None:. return.. code = self._download_json(. 'https://www.ufc.tv

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\uktvplay.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.028972935818782
Encrypted:	false
SSDEEP:	24:zi8lFvLyb89aBHx/xD/hrdlBw+XDnQLdZBHTnD1MlsiZ9pw1gNfeIXjlOsZlvUE:+uL98zx9LqhrD16si/Se5jXjlvUE
MD5:	62DED1DC820F51499830996B7F38CF34
SHA1:	F7767D1A992354143C1DD81904BBA80D9D380B5A
SHA-256:	DBD8ACEC73064736B3D71FB75908662131D2BF311041E88B681B13EBD2EB1246
SHA-512:	E53CE37DB9A2125DF95AFF0239113EA7F735457E327D4D318A90C823A037C8F49023EFF0C87BD8107AC7D3D7FFD5DC894FC9B0726BDC500501AB87299F4740E5
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor...class UKTVPlayIE(InfoExtractor):. _VALID_URL = r'https?://uktvplay\.uktv\.co\.uk/.+?\?.*?\bvideo=(?P<id>\d+)'. _TEST = {. 'url': 'https://uktvplay.uktv.co.uk/shows/world-at-war/c/200/watch-online/?video=2117008346001',. 'md5': '',. 'info_dict': {. 'id': '2117008346001',. 'ext': 'mp4',. 'title': 'Pincers',. 'description': 'Pincers',. 'uploader_id': '1242911124001',. 'upload_date': '20130124',. 'timestamp': 1359049267,. },. 'params': {. # m3u8 download. 'skip_download': True,. },. 'expected_warnings': ['Failed to download MPD manifest']. }. BRIGHTCOVE_URL_TEMPLATE = 'http://players.brightcove.net/1242911124001/H1xnMOqP_default/index.html?videoId=%s'.. def _real_extract(self, url):. video_id = self._match_id(url). return se

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\umg.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3414
Entropy (8bit):	4.465043318838093
Encrypted:	false
SSDEEP:	96:8mmo6nfFgJaSic++iDkX+dm+haZzn4geV3ujWkrFfBTSNNwF6Ng:DmjaaPc+Fu+dm+haZzn4n+nrFpT96Ng
MD5:	AF2E0E3C3503A8992A29DE9987E19876
SHA1:	57CFAEB1F604CBF34D95460B7390CC5919C6C778
SHA-256:	8DFB8FD5418FF2CFA79E72C9913A254EC5CC90B690D3A83835AEB3D3F6BF153D
SHA-512:	8BF4F540F74542EDD68F793C95D7B610C266B157DB99999FE8A73DFA0116FF423A59D1F460A6355B550AF8BDA08D5D412106E167E804FDE18CECA5F842F60B1A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. int_or_none,. parse_filesize,. parse_iso8601,.)...class UMGDeIE(InfoExtractor):. IE_NAME = 'umg:de'. IE_DESC = 'Universal Music Deutschland'. _VALID_URL = r'https?://(?:www\.)?universal-music\.de/[^/]+/videos/[^/?#]+-(?P<id>\d+)'. _TEST = {. 'url': 'https://www.universal-music.de/sido/videos/jedes-wort-ist-gold-wert-457803',. 'md5': 'ebd90f48c80dcc82f77251eb1902634f',. 'info_dict': {. 'id': '457803',. 'ext': 'mp4',. 'title': 'Jedes Wort ist Gold wert',. 'timestamp': 1513591800,. 'upload_date': '20171218',. }. }.. def _real_extract(self, url):. video_id = self._match_id(url). video_data = self._download_json(. 'https://api.universal-music.de/graphql',. video_id, query={. 'query': '''{. universalMusic(channel:16) {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\unistra.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2158
Entropy (8bit):	4.661570909766049
Encrypted:	false
SSDEEP:	48:Pu0yKVOuVOXqtiFM+faXUPp6dfFklkqFZbl4b+TMBTXX3CXj+eBhBdAt46Nq:/AuVOXqtyvSXUPp6tIbl4MMBT3Y+uBik
MD5:	A2D8C6B0A157E9B5B031FB5FF93C7823
SHA1:	012EA1945CB8D669CB7D10DE596A440D54A88412
SHA-256:	04B06145DBD0DFDC558B2D341D23211F6095133149765C3D0D74072BC8ADBE09
SHA-512:	6C08FC0BD7BB356EDBFFBBA715801FCE056A5AAF8B3274F4376BE99E9E23F6F8558CE40C74F04DDAAF5C0A937359DF331E8FE34D2AACA2795F841470728324AA
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import qualities...class UnistraIE(InfoExtractor):. _VALID_URL = r'https?://utv\.unistra\.fr/(?:index\|video)\.php\?id_video\=(?P<id>\d+)'.. _TESTS = [. {. 'url': 'http://utv.unistra.fr/video.php?id_video=154',. 'md5': '736f605cfdc96724d55bb543ab3ced24',. 'info_dict': {. 'id': '154',. 'ext': 'mp4',. 'title': 'M!ss Yella',. 'description': 'md5:104892c71bd48e55d70b902736b81bbf',. },. },. {. 'url': 'http://utv.unistra.fr/index.php?id_video=437',. 'md5': '1ddddd6cccaae76f622ce29b8779636d',. 'info_dict': {. 'id': '437',. 'ext': 'mp4',. 'title': 'Prix Louise Weiss 2014',. 'description': 'md5:cc3a8735f079f4fb6b0b570fc10c135a',. },. }. ].. def _real_extr

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\unity.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	5.000802156573237
Encrypted:	false
SSDEEP:	24:1R8lFvKiGnyZfOOzJ/ZadlKAigfT0VhKkHP+q1A3tfeIXjlgtgBLikMSw:Pu0irZfOOFsxr0V0kv+2A3tfjXjlkgBO
MD5:	15D0F3A714B4D6D4909BCD08B0EE0E89
SHA1:	AD701753DB4823DA107EAEAE4C9C400EFC5F26D9
SHA-256:	BC00A22092EF5471F373F3E9DBEA4FD88746CD7CCB8C440ACBEB3771BB005D8F
SHA-512:	6A8D0E26D5CC959DDBFF65A68F2C9AD1117EF3004C2A93F481D69962E925A207EC46E83B74EBCCB31840F6F291D172C436ED6A9C575B8B61B718AA59ECF7A6B4
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import InfoExtractor.from .youtube import YoutubeIE...class UnityIE(InfoExtractor):. _VALID_URL = r'https?://(?:www\.)?unity3d\.com/learn/tutorials/(?:[^/]+/)*(?P<id>[^/?#&]+)'. _TESTS = [{. 'url': 'https://unity3d.com/learn/tutorials/topics/animation/animate-anything-mecanim',. 'info_dict': {. 'id': 'jWuNtik0C8E',. 'ext': 'mp4',. 'title': 'Live Training 22nd September 2014 - Animate Anything',. 'description': 'md5:e54913114bd45a554c56cdde7669636e',. 'duration': 2893,. 'uploader': 'Unity',. 'uploader_id': 'Unity3D',. 'upload_date': '20140926',. }. }, {. 'url': 'https://unity3d.com/learn/tutorials/projects/2d-ufo-tutorial/following-player-camera?playlist=25844',. 'only_matching': True,. }].. def _real_extract(self, url):. video_id = self._match_id(url). webpage = self._download_webpa

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\uol.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	5522
Entropy (8bit):	4.676831689371388
Encrypted:	false
SSDEEP:	96:BPmw7+9dvscL4+vQU4N9y7bHJegeg5BRA84aTxIs/vsqOIK503GrBTqfY+VhNpOL:ZU9dv9L4+vv4N9y7bHsRaFj/vtOIQYGz
MD5:	D064D70F7EA7C50D2EA83985E04109EE
SHA1:	6A2AB9843B90A7F71781F297DF383F1918400DC2
SHA-256:	F2A38626CABEF8C409FCED5E3A03BFF71EBE143DC0E2E12A3BD97F65FC2DEC62
SHA-512:	9240926F917FE7F2EAB5108BDAC0F44EAE283D2437E996191D6FCB2520061DC2394E4B1283CE1C826836DA2E97FD43429457274C8F4F844790E707652AE03EAC
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..utils import (. clean_html,. int_or_none,. parse_duration,. update_url_query,. str_or_none,.)...class UOLIE(InfoExtractor):. IE_NAME = 'uol.com.br'. _VALID_URL = r'https?://(?:.+?\.)?uol\.com\.br/.*?(?:(?:mediaId\|v)=\|view/(?:[a-z0-9]+/)?\|video(?:=\|/(?:\d{4}/\d{2}/\d{2}/)?))(?P<id>\d+\|[\w-]+-[A-Z0-9]+)'. _TESTS = [{. 'url': 'http://player.mais.uol.com.br/player_video_v3.swf?mediaId=15951931',. 'md5': '25291da27dc45e0afb5718a8603d3816',. 'info_dict': {. 'id': '15951931',. 'ext': 'mp4',. 'title': 'Miss simpatia . encontrada morta',. 'description': 'md5:3f8c11a0c0556d66daf7e5b45ef823b2',. }. }, {. 'url': 'http://tvuol.uol.com.br/video/incendio-destroi-uma-das-maiores-casas-noturnas-de-londres-04024E9A3268D4C95326',. 'md5': 'e41a2fb7b7398a3a46b6af37b15c00c9',. 'info_dict': {.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\uplynk.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2625
Entropy (8bit):	5.008694010859418
Encrypted:	false
SSDEEP:	48:+u5qPEzD/N03rD1awESFAbf4aqG/4YObVBT/zFC73UNe6NY/gwqKElfFIf4zKM4U:YsD/NYrQwEt4adA7VBTJC73UNe6NY/gt
MD5:	A264F1A6A1E23F35AD34497ADD7AE3C7
SHA1:	B03F7285D9478F97749785C190A929EE3FC81F69
SHA-256:	EDD9C74C7D06C247757E1C602A149AB4DDA57F43A0123A2E0EFBB07684668EB6
SHA-512:	38FE1BEA86CD08FB04370654C9F9386089B711A1AA6198BDD3C630BE9CFB391EF166C6AE6289F5A0A23F3B34AF1D8F72EF039A4C18093251818F0DD00BE38D1E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import re..from .common import InfoExtractor.from ..utils import (. float_or_none,. ExtractorError,.)...class UplynkIE(InfoExtractor):. IE_NAME = 'uplynk'. _VALID_URL = r'https?://.?\.uplynk\.com/(?P<path>ext/[0-9a-f]{32}/(?P<external_id>[^/?&]+)\|(?P<id>[0-9a-f]{32}))\.(?:m3u8\|json)(?:.?\bpbs=(?P<session_id>[^&]+))?'. _TEST = {. 'url': 'http://content.uplynk.com/e89eaf2ce9054aa89d92ddb2d817a52e.m3u8',. 'info_dict': {. 'id': 'e89eaf2ce9054aa89d92ddb2d817a52e',. 'ext': 'mp4',. 'title': '030816-kgo-530pm-solar-eclipse-vid_web.mp4',. 'uploader_id': '4413701bf5a1488db55b767f8ae9d4fa',. },. 'params': {. # m3u8 download. 'skip_download': True,. },. }.. def _extract_uplynk_info(self, uplynk_content_url):. path, external_id, video_id, session_id = re.match(UplynkIE._VALID_URL, uplynk_content_url).groups().

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\extractor\urort.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	2249
Entropy (8bit):	4.632909129109805
Encrypted:	false
SSDEEP:	48:+uqwE9N2zO380LZaOZXlBGe3vG7aIZBoABT3v2eSrMWb6NQ7LD:49N2zO38aZaOfBGee7hBTBTOeSrMWb6q
MD5:	798BC17908F817B18BA20AB24063540F
SHA1:	575B267312641E703F06A5EAC183941DA942284D
SHA-256:	3C436B7F2AF74F53E2A1981B6BC8A3A3140AF3B76E110C98A5744335559A3AAE
SHA-512:	7E5193856EA2CF5C6EB8FF6570F2B9F39E1E63D328CF057CE33FFE9F886348432373CAD777519E4185D2FD7861264D356C68367A5C03245DF0D0210401B7545E
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..from .common import InfoExtractor.from ..compat import (. compat_urllib_parse,.).from ..utils import (. unified_strdate,.)...class UrortIE(InfoExtractor):. IE_DESC = 'NRK P3 Ur.rt'. _VALID_URL = r'https?://(?:www\.)?urort\.p3\.no/#!/Band/(?P<id>[^/]+)$'.. _TEST = {. 'url': 'https://urort.p3.no/#!/Band/Gerilja',. 'md5': '5ed31a924be8a05e47812678a86e127b',. 'info_dict': {. 'id': '33124-24',. 'ext': 'mp3',. 'title': 'The Bomb',. 'thumbnail': r're:^https?://.+\.jpg',. 'uploader': 'Gerilja',. 'uploader_id': 'Gerilja',. 'upload_date': '20100323',. },. 'params': {. 'matchtitle': '^The Bomb$', # To test, we want just one video. }. }.. def _real_extract(self, url):. playlist_id = self._match_id(url).. fstr = compat_urllib_parse.quote("InternalBandUrl eq '%s'" % playlist_id).

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-2K1BF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	467
Entropy (8bit):	4.732497447823535
Encrypted:	false
SSDEEP:	6:HWaH+RMABYa4JW2afE74eFF2KyGbGm3EYhNzCRVl4KcQjum2uqkFuRS6D9vWtAAT:HIjYa4JwsF1yRetDMTcWuTD9+t802aA2
MD5:	59CCBEAD80D3088B81E48D69D9E377CA
SHA1:	A8D018BE700A285B7B0DB94058B95697DB2134B0
SHA-256:	413C5176FA7A74F1162E25597DF71F26F63C39713BEE9825B4AC77A7880C773D
SHA-512:	BFDE535CDAEE72A031E79D763377AAE2995CF096D7C754F4707BBCF2F9F57825F8DA69DBCC55F961E8ECEB4AA56670628DFD76D71EFAAA1EAC5FAB6ACD81A39B
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.from __future__ import unicode_literals..# Execute with.# $ python youtube_dl/__main__.py (2.6+).# $ python -m youtube_dl (2.7+)..import sys..if __package__ is None and not hasattr(sys, 'frozen'):. # direct call of __main__.py. import os.path. path = os.path.realpath(os.path.abspath(__file__)). sys.path.insert(0, os.path.dirname(os.path.dirname(path)))..import youtube_dl..if __name__ == '__main__':. youtube_dl.main().

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-2T8D5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	163872
Entropy (8bit):	4.785083114337476
Encrypted:	false
SSDEEP:	1536:r59UW4PNN/52oBNlThNfPoPbk4m7euh2otln1URBQAGmRQAGmtvxMahMA59QNhg6:txuBLD4Tu9OtvxpP59QYn0r1x/
MD5:	F08F19166BB510B45C9B929AF645BD67
SHA1:	C5EA3DCA29FA269B907D24A0AFFB9C7EA53EA4E1
SHA-256:	E2358BE4AF938F4D3D8C9566CC9BF5E9400EE2206773E396C0C000B100621C0E
SHA-512:	C408098964FFD7C0A85E44CFED8B93730B08B06C49FE966B38431C93F817597CDDD77954D1374DDBA2B6E507A8CAB3E681216C4E395C086161DF00F4C50534D8
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# coding: utf-8..from __future__ import unicode_literals..import base64.import binascii.import calendar.import codecs.import contextlib.import ctypes.import datetime.import email.utils.import email.header.import errno.import functools.import gzip.import io.import itertools.import json.import locale.import math.import operator.import os.import platform.import random.import re.import socket.import ssl.import subprocess.import sys.import tempfile.import traceback.import xml.etree.ElementTree.import zlib..from .compat import (. compat_HTMLParseError,. compat_HTMLParser,. compat_basestring,. compat_chr,. compat_cookiejar,. compat_ctypes_WINFUNCTYPE,. compat_etree_fromstring,. compat_expanduser,. compat_html_entities,. compat_html_entities_html5,. compat_http_client,. compat_kwargs,. compat_os_name,. compat_parse_qs,. compat_shlex_quote,. compat_str,. compat_struct_pack,. compat_struct_unpack,. compat_urllib_error

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-98542.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16130
Entropy (8bit):	4.756629217139018
Encrypted:	false
SSDEEP:	384:IIChFH3xLxJCxwJNxwF5p8XUMsO7OXgJN9n85eK3z0HilY9n:IVX158tq
MD5:	D7214C3C57F0616BFBEAA995542D0F57
SHA1:	DBE4E7225B1F92542557F465E18041B26B77E19B
SHA-256:	329A210EAEAFA8B0758E02A1F7386A70823712623F4543AC492ACF86EDA97589
SHA-512:	F81E926329EAD46A1983581AC4CE4A7356002606F82F30685F8582202C07E55A0269DB0EB560328C64BBB793580CF4C46F8BC090D7726E43A648A8C632A3F3C9
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from math import ceil..from .compat import compat_b64decode.from .utils import bytes_to_intlist, intlist_to_bytes..BLOCK_SIZE_BYTES = 16...def aes_ctr_decrypt(data, key, counter):. """. Decrypt with aes in counter mode.. @param {int[]} data cipher. @param {int[]} key 16/24/32-Byte cipher key. @param {instance} counter Instance whose next_value function (@returns {int[]} 16-Byte block). returns the next counter block. @returns {int[]} decrypted data. """. expanded_key = key_expansion(key). block_count = int(ceil(float(len(data)) / BLOCK_SIZE_BYTES)).. decrypted_data = []. for i in range(block_count):. counter_block = counter.next_value(). block = data[i * BLOCK_SIZE_BYTES: (i + 1) * BLOCK_SIZE_BYTES]. block += [0] * (BLOCK_SIZE_BYTES - len(block)).. cipher_counter_block = aes_encrypt(counter_block, expanded_key). decrypted_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-9HTBN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script text executable Python script, ASCII text executable, with very long lines (391)
Category:	dropped
Size (bytes):	42236
Entropy (8bit):	4.653623423653273
Encrypted:	false
SSDEEP:	768:bQwbRhW9f6CzJKkVEeov15l1fcryFmtYYTu+MuBWhgHbnQDEC1B:bQwb+9f6CzJKkVEeov15l1fcAgu+ZWhl
MD5:	D09D50A245F19ACDE919F1B9831BC8E0
SHA1:	CDF2FD6D80C409DB64FC089F294646BB4D28E35D
SHA-256:	A3D538D726C3A5C5395A2F496BB8AEFC18A7345D5B76AFAAC086D9BEDD849AD0
SHA-512:	EB3055D5DA8D4772B33855E8FBB131B766124EC5A8DB1AB42B6F48AA517FC8A4DBF08880B4FED4DDD248CD98A09B0D9C0171E11A9ADB8A8460B7232E01869DBE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os.path.import optparse.import re.import sys..from .downloader.external import list_external_downloaders.from .compat import (. compat_expanduser,. compat_get_terminal_size,. compat_getenv,. compat_kwargs,. compat_shlex_split,.).from .utils import (. preferredencoding,. write_string,.).from .version import __version__...def _hide_login_info(opts):. PRIVATE_OPTS = set(['-p', '--password', '-u', '--username', '--video-password', '--ap-password', '--ap-username']). eqre = re.compile('^(?P<key>' + ('\|'.join(re.escape(po) for po in PRIVATE_OPTS)) + ')=.+$').. def _scrub_eq(o):. m = eqre.match(o). if m:. return m.group('key') + '=PRIVATE'. else:. return o.. opts = list(map(_scrub_eq, opts)). for idx, opt in enumerate(opts):. if opt in PRIVATE_OPTS and idx + 1 < len(opts):. opts[idx + 1] = 'PRIVATE'. return opts...def parseOpts(overrideArguments=N

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-AKU37.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	31486
Entropy (8bit):	3.8809029562560227
Encrypted:	false
SSDEEP:	384:4YGe7g/MhCLpY523dejf/6xJ2mAkA0Bh+BQN:49ZyCLpqh/6pAkf8I
MD5:	B21D99CC68F54ED8D83B9FE0456C66E9
SHA1:	C5D0A573B3A7252776D59E781BF19972C3EB671B
SHA-256:	A0147622872FBB3F861A15BFEAF5555DAFD3519C70C9BDD7CE853D4CD7EA0C6A
SHA-512:	035EA7DF79BB9F7258A02BCC39DFB867FF54537E1901BB5AD325F8D035AB13B984A5D055D869E31504F900AB2717CAE592B5C32920B726CA239F08BF73A6A723
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import collections.import io.import zlib..from .compat import (. compat_str,. compat_struct_unpack,.).from .utils import (. ExtractorError,.)...def _extract_tags(file_contents):. if file_contents[1:3] != b'WS':. raise ExtractorError(. 'Not an SWF file; header is %r' % file_contents[:3]). if file_contents[:1] == b'C':. content = zlib.decompress(file_contents[8:]). else:. raise NotImplementedError(. 'Unsupported compression format %r' %. file_contents[:1]).. # Determine number of bits in framesize rectangle. framesize_nbits = compat_struct_unpack('!B', content[:1])[0] >> 3. framesize_len = (5 + 4 * framesize_nbits + 7) // 8.. pos = framesize_len + 2 + 2. while pos < len(content):. header16 = compat_struct_unpack('<H', content[pos:pos + 2])[0]. pos += 2. tag_code = header16 >> 6. tag_len = header16 & 0x3f. if tag_len == 0x3f:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-BMD8G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6908
Entropy (8bit):	4.779210500037645
Encrypted:	false
SSDEEP:	96:yyUl30heDSJk0qCmeYkvdU25NdqtNziqQeyXJdqddFdCKdJd/o0mn:yyk3FB0qgiuwNuqQD5oXFZX6h
MD5:	DCB4A7BAD1656FF1E529F4CF7F366D2D
SHA1:	D29D4C051C69ABCF955855681BC546C5EC5FFBF3
SHA-256:	B121F9645C599DCD8CE7C7323A31ED236DDD92A561DB9772D44EBA1CF356D438
SHA-512:	A1AFA971A11B967A0B59EF0C94E50D60A54833D274C79A6B635D7705B1C6B027242B9B73A581F8DB2B83927C3134E9F4C94C3ED2F5DD1FE77810D8C92C783891
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import io.import json.import traceback.import hashlib.import os.import subprocess.import sys.from zipimport import zipimporter..from .utils import encode_compat_str..from .version import __version__...def rsa_verify(message, signature, key):. from hashlib import sha256. assert isinstance(message, bytes). byte_size = (len(bin(key[0])) - 2 + 8 - 1) // 8. signature = ('%x' % pow(int(signature, 16), key[1], key[0])).encode(). signature = (byte_size * 2 - len(signature)) * b'0' + signature. asn1 = b'3031300d060960864801650304020105000420'. asn1 += sha256(message).hexdigest().encode(). if byte_size < len(asn1) // 2 + 11:. return False. expected = b'0001' + (byte_size - len(asn1) // 2 - 3) * b'ff' + b'00' + asn1. return expected == signature...def update_self(to_screen, verbose, opener):. """Update the program file with the latest version from the repository""".. UPDATE_URL = 'https://yt-dl.org/update/'. VE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-EF4NO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	19524
Entropy (8bit):	4.74601007633021
Encrypted:	false
SSDEEP:	192:4k/nVU9UgKCGXye4L7Sda8HrrK26X3j8GLuY/CSgDwGADytUsLohIdkV7iJGSNqT:4kdcBSda8HKPuapJ3IdkV7oHEC8nP
MD5:	37D5D32C60A7E525B60B7CB4930FD80E
SHA1:	4D3C4809732FDC3B9EEB608C1DB3E6427209698E
SHA-256:	F3FB646F2FD6EB0B226C43DBEF99B0441240E44FAA08A26A3B1F5455AA202451
SHA-512:	89602C06DC956BC18A71CD0B1B97ACC7727F1D53EA44533BAA8ABE1CC06623C2A1B4AEA57B7EDCED4BFEDCD091FD1988AAF581670B77BBED4C27E978D3D45093
Malicious:	false
Reputation:	unknown
Preview:	# coding=utf-8.import sys.import os .import io.import re.import threading.import subprocess.import ssl.import tempfile.try:. from urllib.parse import .except ImportError:. from urlparse import .import traceback.import time.from .UniversalAnalytics import Tracker as GATacker.from .utils import update_url_query, sanitized_Request, make_HTTPS_handler, YoutubeDLHTTPSHandler.from .compat import compat_urllib_request.import base64..try:. from Crypto.Cipher import AES.except:. pass.from hashlib import md5..def sandboxEnable():. if sys.platform == 'darwin':. try:. sandBoxEnvName = os.environ['APP_SANDBOX_CONTAINER_ID']. return sandBoxEnvName and len(sandBoxEnvName) > 0. except:. pass. return False. .def FixDefaultEncoding():. if sys.version_info < (3, 0) and sys.getdefaultencoding() == 'ascii':. reload(sys). sys.setdefaultencoding('utf-8')...def debug(str):. try:. if sys.stdout:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-GBOPJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8861
Entropy (8bit):	4.9462374388736
Encrypted:	false
SSDEEP:	96:rmAoxGHuuuqFLhf0di8qb7h/zSEnMgpSncv4w0z7Kt0CLmPzibJy68638vkKNQkJ:RHuzELhfaJcwnbvsEAKmFUZjhbZPRLht
MD5:	6B32A2B83869E6ACEF03E81B691848BF
SHA1:	50AB8B174E96AAC44B1790940C013B15C4B92359
SHA-256:	D06CAD48867EEE2C792A5E8C3B50E6511F52B6724153B3BA77CABE9930730CE7
SHA-512:	FB6A25D9CBA916CBB5B4E6BB42A728EC94B9B2B6D336C504D457D7D34B4DE3A9599E01C5539D28819F02EB03DF74D1CE5ABC9805B239B91E73A3580BBC27466B
Malicious:	false
Reputation:	unknown
Preview:	# Public Domain SOCKS proxy protocol implementation.# Adapted from https://gist.github.com/bluec0re/cafd3764412967417fd3..from __future__ import unicode_literals..# References:.# SOCKS4 protocol http://www.openssh.com/txt/socks4.protocol.# SOCKS4A protocol http://www.openssh.com/txt/socks4a.protocol.# SOCKS5 protocol https://tools.ietf.org/html/rfc1928.# SOCKS5 username/password authentication https://tools.ietf.org/html/rfc1929..import collections.import socket..from .compat import (. compat_ord,. compat_struct_pack,. compat_struct_unpack,.)..__author__ = 'Timo Schmid <coding@timoschmid.de>'..SOCKS4_VERSION = 4.SOCKS4_REPLY_VERSION = 0x00.# Excerpt from SOCKS4A protocol:.# if the client cannot resolve the destination host's domain name to find its.# IP address, it should set the first three bytes of DSTIP to NULL and the last.# byte to a non-zero value..SOCKS4_DEFAULT_DSTIP = compat_struct_pack('!BBBB', 0, 0, 0, 0xFF)..SOCKS5_VERSION = 5.SOCKS5_USER_AUTH_VERSION = 0x01.SOCKS5

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-OAJC9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	4.3665794819916215
Encrypted:	false
SSDEEP:	48:Pue1fhfwJmFkmrrdjDJHaWpIe7IZJ0WPkmJxvaEpIeIiqOR/yfMHFIp3yh5elw7a:F/wARldQemWRmJxieUULyMa
MD5:	3929CC5F0C628C1B74CC7EB620C0317F
SHA1:	D41B6CCF7E574C1439475E17E1F297153ECC397B
SHA-256:	BA3DAA0BD84FF5D6A5F1EE544E0143276FB5BD7E0E0C6954D97992E9EC0DE6B8
SHA-512:	36357BE033E9AEEB86E62F2A9ABC5F1C002A1ABFDD629433758E3247EDB85366830EBDD3F9FB6E8C5900E67C7A2907DE927CE2BC966A0D0CDE966FB68D7D10A7
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import errno.import io.import json.import os.import re.import shutil.import traceback..from .compat import compat_getenv.from .utils import (. expand_path,. write_json_file,.)...class Cache(object):. def __init__(self, ydl):. self._ydl = ydl.. def _get_root_dir(self):. res = self._ydl.params.get('cachedir'). if res is None:. cache_root = compat_getenv('XDG_CACHE_HOME', '~/.cache'). res = os.path.join(cache_root, 'youtube-dl'). return expand_path(res).. def _get_cache_fn(self, section, key, dtype):. assert re.match(r'^[a-zA-Z0-9_.-]+$', section), \. 'invalid section %r' % section. assert re.match(r'^[a-zA-Z0-9_.-]+$', key), 'invalid key %r' % key. return os.path.join(. self._get_root_dir(), section, '%s.%s' % (key, dtype)).. @property. def enabled(self):. return self._ydl.params.get('cachedir') is not False.. def store(self,

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-PI1CU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.49903242259821
Encrypted:	false
SSDEEP:	3:166MRm6NKXRYaA6JVUJW366MXLva3GR:1RMABYa4JWKVa0
MD5:	157BB78F7DED52877A90A75E4133F8E3
SHA1:	633A0BB1FEC9FAC9E695BDE6B2D4EB3F48509854
SHA-256:	F20C3F3F9D026DBCB027EDF4862DB3F813A20C1737ED11AB7254929318A61CBB
SHA-512:	6151C175822E3D1577109A9CD42B2A97C639C63D7E27AE24349434A6D8DCAEDD1C7DB4B624A3A60B463FFDC1DA13535FAEB2BC295EC3D0657945D1F9FBCFE8E1
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..__version__ = '2019.07.16'.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-PLMM3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20502
Entropy (8bit):	4.550463650406318
Encrypted:	false
SSDEEP:	384:xZNDfuvgFvD7w3+MrwSp/U+7OEgYPSX6HwjN:xvDuvgFvD7w3+gp/U+7OEgYPSX6HUN
MD5:	4B9FCBD27F76AA8CA76134ECE37B7C46
SHA1:	9113469951FF1B78FF81DBC77E9655E68DB299F3
SHA-256:	7BF035C5C3AF5CEBD7EA3831EE259A868DAA213E691684E346C4DFCA8C948D95
SHA-512:	7C6769E2E0C188602F7C0F9E6833CAEE556E5A56132B5C72C8DA2F61E5C0ED15FA001DBCB1321CEA0C0D806AFDCC90B62CBFC8D337A6EF7FC80F6A971D017285
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# coding: utf-8..from __future__ import unicode_literals..__license__ = 'Public Domain'..import codecs.import io.import os.import random.import sys...from .options import (. parseOpts,.).from .compat import (. compat_getpass,. compat_shlex_split,. workaround_optparse_bug9161,.).from .utils import (. DateRange,. decodeOption,. DEFAULT_OUTTMPL,. DownloadError,. expand_path,. match_filter_func,. MaxDownloadsReached,. preferredencoding,. read_batch_urls,. SameFileError,. setproctitle,. std_headers,. write_string,. render_table,.).from .update import update_self.from .downloader import (. FileDownloader,.).from .extractor import gen_extractors, list_extractors.from .extractor.adobepass import MSO_INFO.from .YoutubeDL import YoutubeDL...def _real_main(argv=None):. # Compatibility fixes for Windows. if sys.platform == 'win32':. # https://github.com/ytdl-org/youtube-dl/issues/820. codecs.register

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-QO3O3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	110719
Entropy (8bit):	4.233610803659247
Encrypted:	false
SSDEEP:	1536:jnOjTGC77i6oawPJx+Ab3MAR6XF8+zP6Afk+liP49hiP491PG6oPG6uies02BKN0:jnAKmi+wkLXtPNFmESg59LG9Np
MD5:	564804468B41DAE0FC73BCC8C4AA298F
SHA1:	CA7D9491C6F33335C7797233A6CCA5427C29DB91
SHA-256:	C69F1A2E3BBF98221D460C89B554FD06606C1646FFFB98BB5A53D56D6D4E0CC9
SHA-512:	4CF2876D550B0FE1EF4EEFA38050F45D6081D8784A4DC2F0FAE21ABB7B94D56697ABAE1127D379BA919A3F280BC52A3578A5F03CE75CA8E2284757BFE81941E8
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# coding: utf-8..from __future__ import absolute_import, unicode_literals..import collections.import contextlib.import copy.import datetime.import errno.import fileinput.import io.import itertools.import json.import locale.import operator.import os.import platform.import re.import shutil.import subprocess.import socket.import sys.import time.import tokenize.import traceback.import random..from string import ascii_letters..from .compat import (. compat_basestring,. compat_cookiejar,. compat_get_terminal_size,. compat_http_client,. compat_kwargs,. compat_numeric_types,. compat_os_name,. compat_str,. compat_tokenize_tokenize,. compat_urllib_error,. compat_urllib_request,. compat_urllib_request_DataHandler,.).from .utils import (. age_restricted,. args_to_str,. ContentTooShortError,. date_from_str,. DateRange,. DEFAULT_OUTTMPL,. determine_ext,. determine_protocol,. DownloadError,. encode_compat_str,.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-ST2TJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9199
Entropy (8bit):	4.312476047500008
Encrypted:	false
SSDEEP:	192:wUGU5r7ohHewFpeui1YnG5TtCiFcV//j5:TGwQpqWxH
MD5:	4E0F2B0D7EB32666953B24FED190E216
SHA1:	6D9B6B79A1B574E31376E1369737BA4D48A9284B
SHA-256:	44C39F07F188D91FABAC74D99AA0A9B9566970C0D8EE87E748B3ACA6A0E18FD5
SHA-512:	A1312B69BE165A2959DA2D70C4FB16874CBA4F09DE62E9CADDED0A72BDB4DA33531F2014AB3F5AD5FA3F4CDEF9C61F617CDA2A3E40716B954997D552ECFF2B7F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import operator.import re..from .utils import (. ExtractorError,. remove_quotes,.).._OPERATORS = [. ('\|', operator.or_),. ('^', operator.xor),. ('&', operator.and_),. ('>>', operator.rshift),. ('<<', operator.lshift),. ('-', operator.sub),. ('+', operator.add),. ('%', operator.mod),. ('/', operator.truediv),. ('', operator.mul),.]._ASSIGN_OPERATORS = [(op + '=', opfunc) for op, opfunc in _OPERATORS]._ASSIGN_OPERATORS.append(('=', lambda cur, right: right)).._NAME_RE = r'[a-zA-Z_$][a-zA-Z_$0-9]'...class JSInterpreter(object):. def __init__(self, code, objects=None):. if objects is None:. objects = {}. self.code = code. self._functions = {}. self._objects = objects.. def interpret_statement(self, stmt, local_vars, allow_recursion=100):. if allow_recursion < 0:. raise ExtractorError('Recursion limit reached').. should_abort = Fals

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\is-UM5TK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	92961
Entropy (8bit):	4.528254170194639
Encrypted:	false
SSDEEP:	768:bUVCMw26S3nsXPTVBt7GNa3WH+xKmwNmAlTIKPq2lLNGxMJj:QL6ssXPTVXGNaGMKVNdhRqeNnJj
MD5:	80570903320B4E25724E4197BAA35D92
SHA1:	8D1DEDFE54286CAD39E80A747FE14ED53D052CD3
SHA-256:	3EBC7A35B89C1750D8D551D755D2A995C4205B1033C9C9B56F8ABD5A35BCC306
SHA-512:	AE74B0BA6CD02C5428313020ECA4F82C7BE8F395E3A4BD704DFA3AAF5D7A043C80D97AAE06B0E25A726F665E2634D1AA8FCAF31AC808DE1FC30465851FF40F9C
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals..import base64.import binascii.import collections.import ctypes.import email.import getpass.import io.import itertools.import optparse.import os.import platform.import re.import shlex.import shutil.import socket.import struct.import subprocess.import sys.import xml.etree.ElementTree...try:. import urllib.request as compat_urllib_request.except ImportError: # Python 2. import urllib2 as compat_urllib_request..try:. import urllib.error as compat_urllib_error.except ImportError: # Python 2. import urllib2 as compat_urllib_error..try:. import urllib.parse as compat_urllib_parse.except ImportError: # Python 2. import urllib as compat_urllib_parse..try:. from urllib.parse import urlparse as compat_urllib_parse_urlparse.except ImportError: # Python 2. from urlparse import urlparse as compat_urllib_parse_urlparse..try:. import urllib.parse as compat_urlparse.except ImportError: # Python 2. import urlpars

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\jsinterp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9199
Entropy (8bit):	4.312476047500008
Encrypted:	false
SSDEEP:	192:wUGU5r7ohHewFpeui1YnG5TtCiFcV//j5:TGwQpqWxH
MD5:	4E0F2B0D7EB32666953B24FED190E216
SHA1:	6D9B6B79A1B574E31376E1369737BA4D48A9284B
SHA-256:	44C39F07F188D91FABAC74D99AA0A9B9566970C0D8EE87E748B3ACA6A0E18FD5
SHA-512:	A1312B69BE165A2959DA2D70C4FB16874CBA4F09DE62E9CADDED0A72BDB4DA33531F2014AB3F5AD5FA3F4CDEF9C61F617CDA2A3E40716B954997D552ECFF2B7F
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import json.import operator.import re..from .utils import (. ExtractorError,. remove_quotes,.).._OPERATORS = [. ('\|', operator.or_),. ('^', operator.xor),. ('&', operator.and_),. ('>>', operator.rshift),. ('<<', operator.lshift),. ('-', operator.sub),. ('+', operator.add),. ('%', operator.mod),. ('/', operator.truediv),. ('', operator.mul),.]._ASSIGN_OPERATORS = [(op + '=', opfunc) for op, opfunc in _OPERATORS]._ASSIGN_OPERATORS.append(('=', lambda cur, right: right)).._NAME_RE = r'[a-zA-Z_$][a-zA-Z_$0-9]'...class JSInterpreter(object):. def __init__(self, code, objects=None):. if objects is None:. objects = {}. self.code = code. self._functions = {}. self._objects = objects.. def interpret_statement(self, stmt, local_vars, allow_recursion=100):. if allow_recursion < 0:. raise ExtractorError('Recursion limit reached').. should_abort = Fals

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\options.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script text executable Python script, ASCII text executable, with very long lines (391)
Category:	dropped
Size (bytes):	42236
Entropy (8bit):	4.653623423653273
Encrypted:	false
SSDEEP:	768:bQwbRhW9f6CzJKkVEeov15l1fcryFmtYYTu+MuBWhgHbnQDEC1B:bQwb+9f6CzJKkVEeov15l1fcAgu+ZWhl
MD5:	D09D50A245F19ACDE919F1B9831BC8E0
SHA1:	CDF2FD6D80C409DB64FC089F294646BB4D28E35D
SHA-256:	A3D538D726C3A5C5395A2F496BB8AEFC18A7345D5B76AFAAC086D9BEDD849AD0
SHA-512:	EB3055D5DA8D4772B33855E8FBB131B766124EC5A8DB1AB42B6F48AA517FC8A4DBF08880B4FED4DDD248CD98A09B0D9C0171E11A9ADB8A8460B7232E01869DBE
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os.path.import optparse.import re.import sys..from .downloader.external import list_external_downloaders.from .compat import (. compat_expanduser,. compat_get_terminal_size,. compat_getenv,. compat_kwargs,. compat_shlex_split,.).from .utils import (. preferredencoding,. write_string,.).from .version import __version__...def _hide_login_info(opts):. PRIVATE_OPTS = set(['-p', '--password', '-u', '--username', '--video-password', '--ap-password', '--ap-username']). eqre = re.compile('^(?P<key>' + ('\|'.join(re.escape(po) for po in PRIVATE_OPTS)) + ')=.+$').. def _scrub_eq(o):. m = eqre.match(o). if m:. return m.group('key') + '=PRIVATE'. else:. return o.. opts = list(map(_scrub_eq, opts)). for idx, opt in enumerate(opts):. if opt in PRIVATE_OPTS and idx + 1 < len(opts):. opts[idx + 1] = 'PRIVATE'. return opts...def parseOpts(overrideArguments=N

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\postprocessor\is-3ULPH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	4.394546496783026
Encrypted:	false
SSDEEP:	48:Pu0RFSiY/AwHZTTIXoB0XMGTQPZudEm/GZADIpWcwZVMvp:uI0hoPMGTQPZ9yDIpWeh
MD5:	3ED94624383E4C9D1C73816355DADC8E
SHA1:	484C36711FDBF66FF42E621839B8288FFFBE6941
SHA-256:	7D4E1487467D33890B33C92E929ABDC9B4228001D9919BF1B47751773D625B18
SHA-512:	0710E656A3E37D53D651FE45B7E4A00028EAAD86CE912A1D54C83C51FADB33CED88FA6EC94546AD5F0FB3DB8130C3D8CB124286D5517C713B37E953B8A6C1AD2
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import os..from ..utils import (. PostProcessingError,. cli_configuration_args,. encodeFilename,.)...class PostProcessor(object):. """Post Processor class... PostProcessor objects can be added to downloaders with their. add_post_processor() method. When the downloader has finished a. successful download, it will take its internal chain of PostProcessors. and start calling the run() method on each one of them, first with. an initial argument and then with the returned value of the previous. PostProcessor... The chain will be stopped if one of them ever returns None or the end. of the chain is reached... PostProcessor objects follow a "mutual registration" process similar. to InfoExtractor objects... Optionally PostProcessor can use a list of additional command-line arguments. with self._configuration_args.. """.. _downloader = None.. def __init__(self, downloader=None):. self._downlo

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\postprocessor\is-8OSD2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	26344
Entropy (8bit):	4.510071510008264
Encrypted:	false
SSDEEP:	384:oXYyas4xkvNiiwELWob7hYomdd8XfbxN4iqQIJg4:W8OIEfb5qd
MD5:	64F1C410A803C6FB51FB0023BCB12D74
SHA1:	9B3EB72D0D712A2847877C4707E732B6264E052A
SHA-256:	7ED2ACBE469DFDBB064F110A781AC23C83C72E2628BF6DF6CB322FBCF428F592
SHA-512:	43D9C1F156E8ABACC488E79EDA8F3A106A95445F88DDF7EBBA05434769E7BD3E9D6E610C4F3A5231999EFA31F71459A962CF57F4379D20C6AE0EBB6FE8020DE2
Malicious:	false
Reputation:	unknown
Preview:	# encoding: utf-8..# python v2.7 subprocess.Popen..CreateProcess...unicode.2017-10-18..win_subprocess...unicode.....ffmpeg.........from __future__ import unicode_literals....import io..import os..import time..import sys..import re....import subprocess..if sys.platform == 'win32' and sys.version_info < (3, 0):.. import win_subprocess....from .common import AudioConversionError, PostProcessor..from ..compat import (.. compat_subprocess_get_DEVNULL,..)..from ..utils import (.. is_outdated_version,.. PostProcessingError,.. prepend_extension,.. shell_quote,.. subtitles_filename,.. dfxp2srt,.. ISO639Utils,.. detect_exe_version,.. replace_extension..)......EXT_TO_OUT_FORMATS = {.. 'aac': 'adts',.. 'flac': 'flac',.. 'm4a': 'ipod',.. 'mka': 'matroska',.. 'mkv': 'matroska',.. 'mpg': 'mpeg',.. 'ogv': 'ogg',.. 'ts': 'mpegts',.. 'wma': 'asf',.. 'wmv': 'asf',..}..ACODECS = {.. 'mp3': 'libmp3la

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\postprocessor\is-BVGQN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	4.266020789815704
Encrypted:	false
SSDEEP:	24:1R8lzvzA7AXXb/p7ORTGHiiYxt9WVkOZshgpsIKcH9AEkt2:PuXA7o/p7OUYxt9WaOZ1pCcHcE
MD5:	282B6FB38018550652A83AEAF517052B
SHA1:	9D9BC281F496728E6DF12AF0BAB9D1F7FCDDB241
SHA-256:	26EAE67748462D805392159ADA3E120B15BC33EEF2C17635B74D10A11CD49A70
SHA-512:	C92EF1ED3F7F796FCBC772328D49196FA040E083E453B9D34357C9C3650ED3B32E0D67E132068918DA55FE9230F7B371901E1615295FF012A7F6C2232CA394FF
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import re..from .common import PostProcessor...class MetadataFromTitlePP(PostProcessor):. def __init__(self, downloader, titleformat):. super(MetadataFromTitlePP, self).__init__(downloader). self._titleformat = titleformat. self._titleregex = (self.format_to_regex(titleformat). if re.search(r'%$\w+$s', titleformat). else titleformat).. def format_to_regex(self, fmt):. r""". Converts a string like. '%(title)s - %(artist)s'. to a regex like. '(?P<title>.+)\ \-\ (?P<artist>.+)'. """. lastpos = 0. regex = ''. # replace %(..)s with regex group and escape other string parts. for match in re.finditer(r'%$(\w+)$s', fmt):. regex += re.escape(fmt[lastpos:match.start()]). regex += r'(?P<' + match.group(1) + '>.+)'. lastpos = match.end(). if lastpos < len(fmt)

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\postprocessor\is-CENHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	955
Entropy (8bit):	4.767170547517926
Encrypted:	false
SSDEEP:	24:1R8lTrpM8rDODtDnR2RcvUQVop0MvqjrJxPDvDgDJWgY2RE:PuTy8ZRrQqnvqjVxDg9RE
MD5:	D9CF28197904F05397FC0F668A4BD4D1
SHA1:	9991B738FE16367E224D4DCC349511B176BE401E
SHA-256:	E6BA61DBEA95DAEA7D7191D4B89EAD8B0BE6516FD8CBAC3E0E23A471F4169001
SHA-512:	144A3B4D576B9B59CC4D4184FEFC871F94BDE11147A9721854CFA9D636DB82A84E2E1BBCD8A2B0A85FADBC49303C2ECF218503B5624063475D2FA531986CF02C
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .embedthumbnail import EmbedThumbnailPP.from .ffmpeg import (. FFmpegPostProcessor,. FFmpegEmbedSubtitlePP,. FFmpegExtractAudioPP,. FFmpegFixupStretchedPP,. FFmpegFixupM3u8PP,. FFmpegFixupM4aPP,. FFmpegMergerPP,. FFmpegMetadataPP,. FFmpegVideoConvertorPP,. FFmpegSubtitlesConvertorPP,.).from .xattrpp import XAttrMetadataPP.from .execafterdownload import ExecAfterDownloadPP.from .metadatafromtitle import MetadataFromTitlePP...def get_postprocessor(key):. return globals()[key + 'PP']...__all__ = [. 'EmbedThumbnailPP',. 'ExecAfterDownloadPP',. 'FFmpegEmbedSubtitlePP',. 'FFmpegExtractAudioPP',. 'FFmpegFixupM3u8PP',. 'FFmpegFixupM4aPP',. 'FFmpegFixupStretchedPP',. 'FFmpegMergerPP',. 'FFmpegMetadataPP',. 'FFmpegPostProcessor',. 'FFmpegSubtitlesConvertorPP',. 'FFmpegVideoConvertorPP',. 'MetadataFromTitlePP',. 'XAttrMetadataPP',.].

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\postprocessor\is-EDUCC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3541
Entropy (8bit):	4.513773415859559
Encrypted:	false
SSDEEP:	48:+ustKpK2pu2f7TrD30T1COY1vujKAcIkcGcFXNQ0x/Sqia1AHegqJ8FR:Yt+xpjTr41C/vWK7jGXJ/Sqr1A+gqJyR
MD5:	D0CF6B0EAEFBBF67BF276BCDD4CF4D6F
SHA1:	412F5B3EC4518D7D4BCB39815DD1A34D91AB7506
SHA-256:	7A2E2644F07BF9F417B37D0EADE0BF772C0D7AF50425B73534FFA7FC47D22CF2
SHA-512:	AC569349F466123206540ED4607C1622ADECA7A80A1DBBD61E1D29871BFE0C9F5A87F1BDEEB2919D2A4921BEFA08EC906C6A8CA16ECF7A512BB6D7C411BA657A
Malicious:	false
Reputation:	unknown
Preview:	# coding: utf-8.from __future__ import unicode_literals...import os.import subprocess..from .ffmpeg import FFmpegPostProcessor..from ..utils import (. check_executable,. encodeArgument,. encodeFilename,. PostProcessingError,. prepend_extension,. shell_quote.)...class EmbedThumbnailPPError(PostProcessingError):. pass...class EmbedThumbnailPP(FFmpegPostProcessor):. def __init__(self, downloader=None, already_have_thumbnail=False):. super(EmbedThumbnailPP, self).__init__(downloader). self._already_have_thumbnail = already_have_thumbnail.. def run(self, info):. filename = info['filepath']. temp_filename = prepend_extension(filename, 'temp').. if not info.get('thumbnails'):. self._downloader.to_screen('[embedthumbnail] There aren\'t any thumbnails to embed'). return [], info.. thumbnail_filename = info['thumbnails'][-1]['filename'].. if not os.path.exists(encodeFilename(thumbnail_filename)):.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\postprocessor\is-HMMD9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2926
Entropy (8bit):	4.3022403574043695
Encrypted:	false
SSDEEP:	48:PuxMp4xy+6NS4qIdLwRKg9DkL/7BR1qDuLYpdPS9ax+k:mZ6NfqEwggZkLD1qyLsK96N
MD5:	D63A3DCAB371C4E0B87D4E00AB5C0B32
SHA1:	0D1852F6ED2B0CE61F07A28FECA6108EEAB8F9F7
SHA-256:	6C095172235340B2D550489E82FA7E0CE90ED4E4C85B42B3DF06024D3B0B48F7
SHA-512:	437C6363F802E5D79138DBD7142ACA603BFA304AD305D92EFB5056F8AADD4D0735F896A47B01C4B488B6EA566924C89D2692A19FE7433775B82A45A88487CDF7
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..from .common import PostProcessor.from ..compat import compat_os_name.from ..utils import (. hyphenate_date,. write_xattr,. XAttrMetadataError,. XAttrUnavailableError,.)...class XAttrMetadataPP(PostProcessor):.. #. # More info about extended attributes for media:. # http://freedesktop.org/wiki/CommonExtendedAttributes/. # http://www.freedesktop.org/wiki/PhreedomDraft/. # http://dublincore.org/documents/usageguide/elements.shtml. #. # TODO:. # * capture youtube keywords and put them in 'user.dublincore.subject' (comma-separated). # * figure out which xattrs can be used for 'duration', 'thumbnail', 'resolution'. #.. def run(self, info):. """ Set extended attributes on downloaded file (if xattr support is found). """.. # Write the metadata to the file's xattrs. self._downloader.to_screen('[metadata] Writing metadata to file\'s xattrs').. filename = info['filepath']..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\postprocessor\is-OHB5P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	877
Entropy (8bit):	4.533141021240117
Encrypted:	false
SSDEEP:	24:1R8lNrvzDXZaV7AGdS2sagN5a+CltiYIieysosE9ZR45It:PulDXo7TS2MN5UDDY5+
MD5:	C84709CF5B341C2C403A493A5005F5C7
SHA1:	F0B4A3A9C87B646CE9248C52887A6E50DF87800D
SHA-256:	C950F8A386ADF75BA9A8A5E47AD6377F940D74E64CFB1D3DF112D6799638E34E
SHA-512:	9908CEAF7906CE785332062EFFE7C1EE7912FC196290FE5DEE94CFFE2D69DCED6BF9AE63FB85434025622D20AE3C6B95CC302BD43A3583C5D5EFBB488C111D18
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import subprocess..from .common import PostProcessor.from ..compat import compat_shlex_quote.from ..utils import (. encodeArgument,. PostProcessingError,.)...class ExecAfterDownloadPP(PostProcessor):. def __init__(self, downloader, exec_cmd):. super(ExecAfterDownloadPP, self).__init__(downloader). self.exec_cmd = exec_cmd.. def run(self, information):. cmd = self.exec_cmd. if '{}' not in cmd:. cmd += ' {}'.. cmd = cmd.replace('{}', compat_shlex_quote(information['filepath'])).. self._downloader.to_screen('[exec] Executing command: %s' % cmd). retCode = subprocess.call(encodeArgument(cmd), shell=True). if retCode != 0:. raise PostProcessingError(. 'Command returned error code %d' % retCode).. return [], information.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\socks.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8861
Entropy (8bit):	4.9462374388736
Encrypted:	false
SSDEEP:	96:rmAoxGHuuuqFLhf0di8qb7h/zSEnMgpSncv4w0z7Kt0CLmPzibJy68638vkKNQkJ:RHuzELhfaJcwnbvsEAKmFUZjhbZPRLht
MD5:	6B32A2B83869E6ACEF03E81B691848BF
SHA1:	50AB8B174E96AAC44B1790940C013B15C4B92359
SHA-256:	D06CAD48867EEE2C792A5E8C3B50E6511F52B6724153B3BA77CABE9930730CE7
SHA-512:	FB6A25D9CBA916CBB5B4E6BB42A728EC94B9B2B6D336C504D457D7D34B4DE3A9599E01C5539D28819F02EB03DF74D1CE5ABC9805B239B91E73A3580BBC27466B
Malicious:	false
Reputation:	unknown
Preview:	# Public Domain SOCKS proxy protocol implementation.# Adapted from https://gist.github.com/bluec0re/cafd3764412967417fd3..from __future__ import unicode_literals..# References:.# SOCKS4 protocol http://www.openssh.com/txt/socks4.protocol.# SOCKS4A protocol http://www.openssh.com/txt/socks4a.protocol.# SOCKS5 protocol https://tools.ietf.org/html/rfc1928.# SOCKS5 username/password authentication https://tools.ietf.org/html/rfc1929..import collections.import socket..from .compat import (. compat_ord,. compat_struct_pack,. compat_struct_unpack,.)..__author__ = 'Timo Schmid <coding@timoschmid.de>'..SOCKS4_VERSION = 4.SOCKS4_REPLY_VERSION = 0x00.# Excerpt from SOCKS4A protocol:.# if the client cannot resolve the destination host's domain name to find its.# IP address, it should set the first three bytes of DSTIP to NULL and the last.# byte to a non-zero value..SOCKS4_DEFAULT_DSTIP = compat_struct_pack('!BBBB', 0, 0, 0, 0xFF)..SOCKS5_VERSION = 5.SOCKS5_USER_AUTH_VERSION = 0x01.SOCKS5

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\swfinterp.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	31486
Entropy (8bit):	3.8809029562560227
Encrypted:	false
SSDEEP:	384:4YGe7g/MhCLpY523dejf/6xJ2mAkA0Bh+BQN:49ZyCLpqh/6pAkf8I
MD5:	B21D99CC68F54ED8D83B9FE0456C66E9
SHA1:	C5D0A573B3A7252776D59E781BF19972C3EB671B
SHA-256:	A0147622872FBB3F861A15BFEAF5555DAFD3519C70C9BDD7CE853D4CD7EA0C6A
SHA-512:	035EA7DF79BB9F7258A02BCC39DFB867FF54537E1901BB5AD325F8D035AB13B984A5D055D869E31504F900AB2717CAE592B5C32920B726CA239F08BF73A6A723
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import collections.import io.import zlib..from .compat import (. compat_str,. compat_struct_unpack,.).from .utils import (. ExtractorError,.)...def _extract_tags(file_contents):. if file_contents[1:3] != b'WS':. raise ExtractorError(. 'Not an SWF file; header is %r' % file_contents[:3]). if file_contents[:1] == b'C':. content = zlib.decompress(file_contents[8:]). else:. raise NotImplementedError(. 'Unsupported compression format %r' %. file_contents[:1]).. # Determine number of bits in framesize rectangle. framesize_nbits = compat_struct_unpack('!B', content[:1])[0] >> 3. framesize_len = (5 + 4 * framesize_nbits + 7) // 8.. pos = framesize_len + 2 + 2. while pos < len(content):. header16 = compat_struct_unpack('<H', content[pos:pos + 2])[0]. pos += 2. tag_code = header16 >> 6. tag_len = header16 & 0x3f. if tag_len == 0x3f:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\update.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6908
Entropy (8bit):	4.779210500037645
Encrypted:	false
SSDEEP:	96:yyUl30heDSJk0qCmeYkvdU25NdqtNziqQeyXJdqddFdCKdJd/o0mn:yyk3FB0qgiuwNuqQD5oXFZX6h
MD5:	DCB4A7BAD1656FF1E529F4CF7F366D2D
SHA1:	D29D4C051C69ABCF955855681BC546C5EC5FFBF3
SHA-256:	B121F9645C599DCD8CE7C7323A31ED236DDD92A561DB9772D44EBA1CF356D438
SHA-512:	A1AFA971A11B967A0B59EF0C94E50D60A54833D274C79A6B635D7705B1C6B027242B9B73A581F8DB2B83927C3134E9F4C94C3ED2F5DD1FE77810D8C92C783891
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..import io.import json.import traceback.import hashlib.import os.import subprocess.import sys.from zipimport import zipimporter..from .utils import encode_compat_str..from .version import __version__...def rsa_verify(message, signature, key):. from hashlib import sha256. assert isinstance(message, bytes). byte_size = (len(bin(key[0])) - 2 + 8 - 1) // 8. signature = ('%x' % pow(int(signature, 16), key[1], key[0])).encode(). signature = (byte_size * 2 - len(signature)) * b'0' + signature. asn1 = b'3031300d060960864801650304020105000420'. asn1 += sha256(message).hexdigest().encode(). if byte_size < len(asn1) // 2 + 11:. return False. expected = b'0001' + (byte_size - len(asn1) // 2 - 3) * b'ff' + b'00' + asn1. return expected == signature...def update_self(to_screen, verbose, opener):. """Update the program file with the latest version from the repository""".. UPDATE_URL = 'https://yt-dl.org/update/'. VE

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\utils.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	163872
Entropy (8bit):	4.785083114337476
Encrypted:	false
SSDEEP:	1536:r59UW4PNN/52oBNlThNfPoPbk4m7euh2otln1URBQAGmRQAGmtvxMahMA59QNhg6:txuBLD4Tu9OtvxpP59QYn0r1x/
MD5:	F08F19166BB510B45C9B929AF645BD67
SHA1:	C5EA3DCA29FA269B907D24A0AFFB9C7EA53EA4E1
SHA-256:	E2358BE4AF938F4D3D8C9566CC9BF5E9400EE2206773E396C0C000B100621C0E
SHA-512:	C408098964FFD7C0A85E44CFED8B93730B08B06C49FE966B38431C93F817597CDDD77954D1374DDBA2B6E507A8CAB3E681216C4E395C086161DF00F4C50534D8
Malicious:	false
Reputation:	unknown
Preview:	#!/usr/bin/env python.# coding: utf-8..from __future__ import unicode_literals..import base64.import binascii.import calendar.import codecs.import contextlib.import ctypes.import datetime.import email.utils.import email.header.import errno.import functools.import gzip.import io.import itertools.import json.import locale.import math.import operator.import os.import platform.import random.import re.import socket.import ssl.import subprocess.import sys.import tempfile.import traceback.import xml.etree.ElementTree.import zlib..from .compat import (. compat_HTMLParseError,. compat_HTMLParser,. compat_basestring,. compat_chr,. compat_cookiejar,. compat_ctypes_WINFUNCTYPE,. compat_etree_fromstring,. compat_expanduser,. compat_html_entities,. compat_html_entities_html5,. compat_http_client,. compat_kwargs,. compat_os_name,. compat_parse_qs,. compat_shlex_quote,. compat_str,. compat_struct_pack,. compat_struct_unpack,. compat_urllib_error

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\utilsEX.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, Unicode text, UTF-8 text executable
Category:	dropped
Size (bytes):	19524
Entropy (8bit):	4.74601007633021
Encrypted:	false
SSDEEP:	192:4k/nVU9UgKCGXye4L7Sda8HrrK26X3j8GLuY/CSgDwGADytUsLohIdkV7iJGSNqT:4kdcBSda8HKPuapJ3IdkV7oHEC8nP
MD5:	37D5D32C60A7E525B60B7CB4930FD80E
SHA1:	4D3C4809732FDC3B9EEB608C1DB3E6427209698E
SHA-256:	F3FB646F2FD6EB0B226C43DBEF99B0441240E44FAA08A26A3B1F5455AA202451
SHA-512:	89602C06DC956BC18A71CD0B1B97ACC7727F1D53EA44533BAA8ABE1CC06623C2A1B4AEA57B7EDCED4BFEDCD091FD1988AAF581670B77BBED4C27E978D3D45093
Malicious:	false
Reputation:	unknown
Preview:	# coding=utf-8.import sys.import os .import io.import re.import threading.import subprocess.import ssl.import tempfile.try:. from urllib.parse import .except ImportError:. from urlparse import .import traceback.import time.from .UniversalAnalytics import Tracker as GATacker.from .utils import update_url_query, sanitized_Request, make_HTTPS_handler, YoutubeDLHTTPSHandler.from .compat import compat_urllib_request.import base64..try:. from Crypto.Cipher import AES.except:. pass.from hashlib import md5..def sandboxEnable():. if sys.platform == 'darwin':. try:. sandBoxEnvName = os.environ['APP_SANDBOX_CONTAINER_ID']. return sandBoxEnvName and len(sandBoxEnvName) > 0. except:. pass. return False. .def FixDefaultEncoding():. if sys.version_info < (3, 0) and sys.getdefaultencoding() == 'ascii':. reload(sys). sys.setdefaultencoding('utf-8')...def debug(str):. try:. if sys.stdout:.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\youtube_dl\version.py (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.49903242259821
Encrypted:	false
SSDEEP:	3:166MRm6NKXRYaA6JVUJW366MXLva3GR:1RMABYa4JWKVa0
MD5:	157BB78F7DED52877A90A75E4133F8E3
SHA1:	633A0BB1FEC9FAC9E695BDE6B2D4EB3F48509854
SHA-256:	F20C3F3F9D026DBCB027EDF4862DB3F813A20C1737ED11AB7254929318A61CBB
SHA-512:	6151C175822E3D1577109A9CD42B2A97C639C63D7E27AE24349434A6D8DCAEDD1C7DB4B624A3A60B463FFDC1DA13535FAEB2BC295EC3D0657945D1F9FBCFE8E1
Malicious:	false
Reputation:	unknown
Preview:	from __future__ import unicode_literals..__version__ = '2019.07.16'.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\EncodeParamInfos.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7787
Entropy (8bit):	5.117427652603937
Encrypted:	false
SSDEEP:	96:W+7ljqw/nd8B9Utp7yFeWbrq33H6jO5CLUOiRXai:W4T/dY9Ip7su33H63LWH
MD5:	77DA4F386DD954F50D1754CB04887E8A
SHA1:	22758E90117ED52EA65A8238D24D009CC77093EF
SHA-256:	0BAAD9F42286120F7C25373E82E92F95C9D2AC1FBBD720D2FACE0012DE7D1B5C
SHA-512:	3D866B84F53CD2675994F49744A7612624166E3A1197002B9B74564E2E83D7031857D69EABE1C2E4DF96C8CAAA3C5B9797668E2733EE62274941B305BB36D2C5
Malicious:	false
Reputation:	unknown
Preview:	<Product>.. <EncParamInfo ID="100040001" Icon="IconiPhone8" DisPlayCategoryid="1" FourCC="IPAN" FormatID="100040" KeepSrcParam="True">.. <Name>iPhone8(P,X)</Name>.. </EncParamInfo>.. <EncParamInfo ID="10001001" Icon="Iconipad4" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10001" KeepSrcParam="True">.. <Name>iPad 3,4,Air</Name>.. </EncParamInfo>.. <EncParamInfo ID="10002001" Icon="Iconipad1" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10002" KeepSrcParam="True">.. <Name>iPad 1,2</Name>.. </EncParamInfo>.. <EncParamInfo ID="10003001" Icon="Iconipadmini" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10003" KeepSrcParam="True">.. <Name>iPad mini</Name>.. </EncParamInfo>.. <EncParamInfo ID="10004001" Icon="IconiPhone7p" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10004" KeepSrcParam="True">.. <Name>iPhone7(P)</Name>.. </EncParamInfo>.. <EncParamInfo ID="10005001" Icon="IconiPhone6s" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10005" KeepSrcParam="True">..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Format.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	160972
Entropy (8bit):	5.121559708431894
Encrypted:	false
SSDEEP:	384:iUyEYi1WToM5iMmypyBMr5idt5MdsdrSv4D+nw02iA2fw2zf42utZ02D/S2IS299:h5ZFUFjj5
MD5:	D8BCD877F594B08C4AB996D624F63BB3
SHA1:	82BDEE11E3FAD9337E9B9A0DEC5B07A9028CF029
SHA-256:	3C71BC9879F49AB3DB3BB92CE3C1145A4E6D806CBF256776CF4333027B7D611C
SHA-512:	4C9D6DC6230855971787D3B026E2909CFEE1AF96A3EC565AFF2E4BE277F5004D8723543E6A80113571E544C90DCF3602C24CC695E77E6CE6EDB3E863A49FC5A6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>....<Product>.. <FormatInfo ID="100040" Skip="False" Icon="IconiPhone8" Categoryid="1" FourCC="IPAN" Format=".mp4">.. <Name>iPhone8(P,X)</Name>.. <Description>MP4 format for iPhone8, iPhone8 Plus, iPhone X</Description>.. <VideoEnc defVideoFourCC="IPAN" defResolution="19201080">.. <EncParam VideoFourCC="IPAN" Resolution="320240" defVideoBitrate="384 kbps" defFrameRate="30 fps">.. <VideoBitrate>256 kbps;384 kbps;512 kbps;768 kbps;900 kbps;1200 kbps;</VideoBitrate>.. <FrameRate>24 fps;30 fps</FrameRate>s.. </EncParam>.. <EncParam VideoFourCC="IPAN" Resolution="480320" defVideoBitrate="768 kbps" defFrameRate="30 fps">.. <VideoBitrate>384 kbps;512 kbps;768 kbps;900 kbps;1000 kbps;1200 kbps;1500 kbps;</VideoBitrate>.. <FrameRate>24 fps;30 fps</FrameRate>.. </EncParam>.. <EncParam VideoFourCC="IPAN" Resolution="640480" defVideoBitrate="900 kbps" defFrameRate="30 fps">.. <VideoBitra

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<http://cbs.wondershare.com/go.php?pid=384&m=dh>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.841470272390303
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/gHMUPQLGKyKLV62YalIYBNov:HRYFVm/hIQLGVQgallBNy
MD5:	41AE2B33173811D9E8F25CD3A1F57732
SHA1:	774DCC02CC01FBE9D0662BFF4A3BD6A8C793C8A6
SHA-256:	0B11E3B9FC40C300178F7A10239474588E99C9D55F12FC0BAF43A697DCA11779
SHA-512:	E251C3D2D5A5E62CF429C07AAE7BF67B4D8ED53D2EE5E674CBE6527373737F9E1D8F9E8FEFBD70A88FE5FE28B818B1C999254C089A15585FCA16D76BC4C35E09
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL=http://cbs.wondershare.com/go.php?pid=384&m=dh..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloaderHelp.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<http://cbs.wondershare.com/go.php?pid=384&m=do>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.841470272390303
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/gHMUPQLGKyKLV62YalIYBKov:HRYFVm/hIQLGVQgallBzv
MD5:	BC9B87F6208104C4B646B1F553B0A9A5
SHA1:	49CB1E05B710596A1834D0686B67B36A9C4E66BF
SHA-256:	03F3856692882F30F7A174C938638C730C310592E2EB66434E0808DB79A8B796
SHA-512:	BA9E4453A0B4ADFE095C022F02DE5D7943CCDEDFEEFEE0D5AB16B8592BBBF33E9CD54F4BDDEE44D3C1A3E03EF2A9F94DF30007AB4CBEAAEDEED8800D33AEABB6
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL=http://cbs.wondershare.com/go.php?pid=384&m=do..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloaderOrder.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<http://cbs.wondershare.com/go.php?pid=384&m=db>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.863826390090816
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/gHMUPQLGKyKLV62YalIYBHov:HRYFVm/hIQLGVQgallBHy
MD5:	44293963CC87C2CB5D4F38DCC2FD8BFF
SHA1:	583FF9D6BBAF7337A3BAAEB77E3C493DD4E12E49
SHA-256:	D89D666647E59C2442BB3EF885EA058394BAA6EB4BCDCD14C974368B663FAEE3
SHA-512:	6A677BC36CD992F4B3665A8AFE41EEBA8D6FFFF5AC9E8CAA856D0352EFC1379943441C1ECC7357C97A28E917D50F2F58D933CD88A0A3AA9E5264A54F89DC3AE3
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL=http://cbs.wondershare.com/go.php?pid=384&m=db..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Arabic.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (429), with CRLF line terminators
Category:	dropped
Size (bytes):	64086
Entropy (8bit):	5.3370947913561295
Encrypted:	false
SSDEEP:	1536:9pEdOHf/DFc+lBr1HFJ8mpfyYZspF5DkejFIeCyrV9YclnF5xfBMsne3rcWo12zo:8+rTve7xfBrErcWI2+UgrMP/d0a+6Nq9
MD5:	16F1C0D09A20C87EF2D537C5EA33150C
SHA1:	F6152BB5CC7D5BC4D79C9ADBEB03D31D817E6086
SHA-256:	424B0F763543AF91DF0F281D63CF1FB99E9049B196F66637082DC24B562F8C6E
SHA-512:	88B458BC1B671D8F77ADAAD2DBEF51F7B345CCF4D920BD4FCF80031EE4DD9358292F2982C69F16F7AAA32CA2D34C4E736A68ADF184AABCD5B7192EEAA26BA932
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ARA" Name="Arabic" LocaleName="...." Version="1.1" LangID="0x0409" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_IncrementalUpgradeTips>..... ... ........ .. .. ..... ....... .....</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>.... ... ....... ...... ..... .. ... ..... .. ........</INF_CloseAppAsk>.. <INF_ItemsInfo>{0}.....</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} ..../......{1}</INF_ItemsInfoContainSize>.. <INF_Question>....</INF_Question>.. <INF_Warning>.....</INF_Warning>.. <INF_Error>...</INF_Error>.. <INF_Information>.........</INF_Information>.. <INF_Yes>...</INF_Yes>.. <INF_OK>.....</INF_OK>.. <INF_No>..</INF_No>.. <INF_Non

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\English.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	50019
Entropy (8bit):	5.097723628905349
Encrypted:	false
SSDEEP:	768:9Mttxl+uy3Pmsi0udFczXEV37L6c3rfPAZ78W2AFQgfDJQzRbSIL61fpXxz:9wl+nfmsSdFczXEVnVmFcRbSS6FpXZ
MD5:	9091320CFBC6891C7A68EBF2B66C2FFF
SHA1:	2E5EB0F2ABCE46C20A72B580AFBC41A36A73C759
SHA-256:	D864787F65ADEF3839B31E8DA9A6CD3FDA70BA26D8AF5B49788E8C074E839678
SHA-512:	EAC7D7BCBFB89FD821DC05A09FEB94657B0AFC840EA9D522F4776A29410AEE665D30D4713E7FB82190C4BA434497BFEA6DB5264B05709CD5CE109AB24C192537
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ENG" Name="English" LocaleName="English" Version="1.1" LangID="0x0409" ProductID="235" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_IncrementalUpgradeTips>A new version which fixed some problems is available now, would you like to update?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>There are some tasks running. Are you sure you want to quit?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} item(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} item(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Question</INF_Question>.. <INF_Warning>Warning</INF_Warning>.. <INF_Error>Error</INF_Error>.. <INF_Information>Information</INF_Information>.. <INF_Yes>Yes</INF_Yes>.. <INF_OK>OK</INF_OK>.. <INF_No>No</INF_No>.. <INF_None>None</INF_None>.. <INF_Cancel>Cancel</INF_Cancel>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\French.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (495), with CRLF line terminators
Category:	dropped
Size (bytes):	55524
Entropy (8bit):	5.130878870350333
Encrypted:	false
SSDEEP:	768:A8GqaE6e5ZJ+HGzvAaD008u9gt8AcO5sgTRpAj4qh/zkYMljcJcR2/2GXbE+uK:AY6e5jQG8aD008umt8v13Ju2/24Ew
MD5:	F5EE79650EF592A5F92C717C6AA2F0B5
SHA1:	323441E735281540E25C72097C01CC088FDB8F88
SHA-256:	54797EEBEFBA69A87A9FFAAFF0469627D7E1A2CF4F97FA562C5FED224AC39E02
SHA-512:	6FD09301EE91C2AE9F1E6AC0EE313FC1066405499B8ACADD7A879F0B76D98872616615FECE42E883A29896A538CC203EDC74607E0011890BB6CE033228706504
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="FRA" Name="French" LocaleName="Fran.ais" Version="1.1" LangID="0x040c" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Correction de quelques probl.mes, est-il reprogramm. maintenant?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Certaines t.ches sont en cours d'ex.cution. .tes-vous s.r de vouloir quitter?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} .l.ment(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} .l.ment(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Question</INF_Question>.. <INF_Warning>Avertissement</INF_Warning>.. <INF_Error>Erreur</INF_Error>.. <INF_Information>Informations</INF_Information>.. <INF_Yes>Oui</INF_Yes>.. <INF_OK>OK</INF_OK>.. <INF_No>Non</INF_No>.. <INF_None>Aucun</INF_None>.. <INF_Cancel>Annuler</INF_Cancel>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\German.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (499), with CRLF line terminators
Category:	dropped
Size (bytes):	55705
Entropy (8bit):	5.170353212012466
Encrypted:	false
SSDEEP:	768:rY1nHxKu/Zm+KP3X/x3KWI+EMUiOCMncHAgeojzkDRIxAVSFoXBC:r+HxKSA3X/1KWI+EMUiCa/ISFoxC
MD5:	03005FC382A3D68D382E4C0C980C2FF9
SHA1:	9F411B8AB0CFB227B70BC6842B756746CCAEC3C1
SHA-256:	01AAC489A9DC0FCF307E6B334EFC6F990BB4511A691F59DD6B71B1AC98DB1324
SHA-512:	14DD1DD72C866619876A27A5C30B747A4C5B750F0E3BFB0B5C5AD0679C8DA4428B2759EC884C0D0C583621CAFFC25BB7C7019E7EEF9F78FAE6A6BD71C013A712
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="DEU" Name="German" LocaleName="Deutsch" Version="1.1" LangID="0x0407" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Einige Probleme behoben, ist es jetzt neu programmiert?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Es laufen noch einige Aufgaben. Sind Sie sicher, dass Sie das Programm beenden m.chten?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} Element(e)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} Element(e), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Frage</INF_Question>.. <INF_Warning>Warnung</INF_Warning>.. <INF_Error>Fehler</INF_Error>.. <INF_Information>Informationen</INF_Information>.. <INF_Yes>Ja</INF_Yes>.. <INF_OK>Herzlichen Gl.ckwunsch!</INF_OK>.. <INF_No>Nein</INF_No>.. <INF_None>Kein</INF_None>.. <INF_Cancel>Abbrechen</INF_Cance

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Italiano.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (475), with CRLF line terminators
Category:	dropped
Size (bytes):	53155
Entropy (8bit):	5.059885901224683
Encrypted:	false
SSDEEP:	1536:B5HD189mcTA9Q5BtKXRvH5koRvH5kaaqSi08pWxvuvJcRvH5Jy1uqRvH5eJ2Tem:rD189mcTA9Q5BtKXRvH5koRvH5kzq50e
MD5:	9957D0C21B2C8A721584260275478906
SHA1:	6A3DAEE4B508E69DAD3A011EBF646F86E4C133D6
SHA-256:	53FF58D440DABACC9D4E6478D52560979D173C6EE57BD0472BE4D1323E18B4EB
SHA-512:	6B1BC0B116DE69105BDBEC351A54F05BA3898AC4206AFD4D0FBF7F2399CED2F52F068D0FAD151770DAD529B371257082189FD7DABD80E2677B2EB52D4878FB73
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ITA" Name="Italian" LocaleName="Italiano" Version="1.1" LangID="0x0410" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Risolti alcuni problemi, . ri-programmato adesso?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Ci sono alcune attivit. in esecuzione. Sei sicuro di voler uscire?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} elemento/i</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} elemento/i, {1}</INF_ItemsInfoContainSize>.. <INF_Question>Questione</INF_Question>.. <INF_Warning>Warning</INF_Warning>.. <INF_Error>Errore</INF_Error>.. <INF_Information>Informazioni</INF_Information>.. <INF_Yes>Si</INF_Yes>.. <INF_OK>Congratulazioni!</INF_OK>.. <INF_No>no</INF_No>.. <INF_None>Nessuno</INF_None>.. <INF_Cancel>Annulla</INF_Cancel>.. <INF_Delete>Eliminare<

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Nederland.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (453), with CRLF line terminators
Category:	dropped
Size (bytes):	52353
Entropy (8bit):	5.074517945272763
Encrypted:	false
SSDEEP:	768:CZ1ebw63lK7X6oemnfozBWfJQvc+wxdyXPYZn/i3uvhto7Q3LRfQJBgQ:Cw3Vo7fozBWfJQYfZnB+7Q3Labx
MD5:	B41EDB5D3E15E3F1A154EA3DCA0AAC3F
SHA1:	D99DA44E486E846A08357BB1AD7BDA5055D9AA5B
SHA-256:	F0DE80CB2A5FB945B889485174905BD1EBCE9970E5786844CA144BCDBDDCD9EC
SHA-512:	A06786E20F7098210E1476677D09217DD8EE9D84AC12309F7ED588BE57D767DCAFCAA4318DF8FDB2842AA4CAFFDBB288948A704B32FD9AE8D97B79BB2A1D3F4F
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="NLD" Name="Nederland" LocaleName="Nederland" Version="1.1" LangID="0x0412" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Vaste problemen, is het nu opnieuw geprogrammeerd?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Er werken nog taken. Weet je zeker dat je wilt stoppen?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} item(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} item(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Vraag</INF_Question>.. <INF_Warning>Waarschuwing</INF_Warning>.. <INF_Error>Fout</INF_Error>.. <INF_Information>Informatie</INF_Information>.. <INF_Yes>Ja</INF_Yes>.. <INF_OK>OK</INF_OK>.. <INF_No>Nee</INF_No>.. <INF_None>Geen</INF_None>.. <INF_Cancel>Annuleer</INF_Cancel>.. <INF_Delete>Verwijder</INF_Delete>.. <INF_NoShowAgai

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Portuguese.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (494), with CRLF line terminators
Category:	dropped
Size (bytes):	53726
Entropy (8bit):	5.125281524381118
Encrypted:	false
SSDEEP:	768:H/9WzkMtJyalaR8x4Q8VRh2W2y84lyN5BvclZaciB1524LTBiwQk2w4WHzj6m:H/FMtJyalG8x4Q8vDslim4WTj1
MD5:	D90A0E77CD1C2FDF9EE6F0688350E779
SHA1:	D925BAFDD65D844AC5C4616F1E0D7FCE536AFC2B
SHA-256:	5B6B18D08C11F22126844744710468CB84FC87B950E576253E12083073E9157C
SHA-512:	C745C54E0AC57D032834F22E1BF43033C54BC0FE7E38BD45B654304055FE07C2C8B6E5B138BCC210EB249A80C0454E59FCDBA06E19B52C449D6E99424F96E7F7
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="PTG" Name="Portuguese" LocaleName="Portugu.s" Version="1.1" LangID="0x0816" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Corrigido alguns problemas, . re-programado agora?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Algumas tarefas ainda est.o executando. Tem a certeza que pretende sair?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0}, item(ns)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} item(ns) {1}</INF_ItemsInfoContainSize>.. <INF_Question>Quest.o</INF_Question>.. <INF_Warning>Aviso</INF_Warning>.. <INF_Error>Erro</INF_Error>.. <INF_Information>Informa..es</INF_Information>.. <INF_Yes>Sim</INF_Yes>.. <INF_OK>OK</INF_OK>.. <INF_No>N.o</INF_No>.. <INF_None>Nenhum</INF_None>.. <INF_Cancel>Cancelar</INF_Cancel>.. <INF_Delete>Eliminar</INF_Del

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-0543Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4984
Entropy (8bit):	5.081304128017365
Encrypted:	false
SSDEEP:	96:GpMBJVcsTFJ0EWTATQjT6DdxLqMGD/6hAXpfyQwWwEK:GpMBJV1IEWTvTKx2VTPyz
MD5:	C221F92DE7B2319D27B22A4C7EA9007C
SHA1:	588E503D0D0214373E0CE8DDCF3FA00E34D67478
SHA-256:	AD0779464A913F93F0D83F9BE069AA2F67F44A57E3118FA64C1A1BEDFE90FA82
SHA-512:	E7103D881BAABC80B95449AA32BA63FF037025D9B7AA42821C3C47B6AC2B3003B8072E6771917868FEADB0E863535E409D7D9A546C792E2AAFC0AE601306C240
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="FRA" Name="French" LocaleName="French" Version="1.1" LangID="0x040c" ProductID="1377" CodePage="1252" xmlns="http://www.wondershare.fr/">.. <Strings>.. <INF_Recording>Enregistrement en cours</INF_Recording>.. <INF_Prepare>Enregistrement en pr.paration</INF_Prepare>.. <INF_PrepareRecord>Enregistrement en pr.paration</INF_PrepareRecord>.. <INF_StopRecord>Appuyez sur %s pour arr.ter l'enregistrement</INF_StopRecord>.. <INF_SelectDirectory>Veuillez s.lectionner le r.pertoire</INF_SelectDirectory>.. <INF_FolderUnExists>Veuillez vous assurer que vous avez s.lectionn. un dossier valide.</INF_FolderUnExists>.. <INF_FolderReadOnly>Impossible de cr.er le r.pertoire de sortie. V.rifiez si vous avez la permission d'.crire sur ce chemin ou choisissez un autre chemin pour cr.er le r.pertoire.</INF_FolderReadOnly>.. <INF_NoMicDevice>Aucun P.riph.rique de Micro</INF_NoMicDevice>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-12AQJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	5.000126732193537
Encrypted:	false
SSDEEP:	96:C1ZH35qZ9yX2SRT1T+kCGTDfVgqdjqd1ccHSYkD1SD2la:C1ZH3o9+2WT+GfVtIvA4Sg
MD5:	25C399FBEDF352670096963EDEB271E9
SHA1:	7B05C6E8402F70B9CD64DC5FAA18FCEC95587CEF
SHA-256:	1FFDD8BD6C673CC77C1C2A96D3F60F0017140C1950AB1546FD8ED91565D91723
SHA-512:	E66CDDDF487FF54DCE563F513B9FF59DBF48BA219286F90CA1CC4BE9E2DDFE378B43F682045C0E2F1A25A50C6B19FA85C4E1AA3EDCB48F02B336BF614E023795
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="NLD" Name="Nederland" LocaleName="Nederland" Version="1.1" LangID="0x0413" ProductID="2605" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_Recording>Opnemen</INF_Recording>.. <INF_Prepare>Bereid opname voor</INF_Prepare>.. <INF_PrepareRecord>Bereid opname voor</INF_PrepareRecord>.. <INF_StopRecord>Druk %s om opnemen te stoppen</INF_StopRecord>.. <INF_SelectDirectory>Selecteer a.u.b. directory</INF_SelectDirectory>.. <INF_FolderUnExists>Zorg er a.u.b. voor dat u een geldige map heeft geselecteerd.</INF_FolderUnExists>.. <INF_FolderReadOnly>Het aanmaken van een output directory is mislukt. Controleer a.u.b. of u het recht heeft om op dat pad te schrijven of kies een ander pad om een directory aan te maken.</INF_FolderReadOnly>.. <INF_NoMicDevice>Geen Mic Apparaat</INF_NoMicDevice>.. <INF_NoSpkDevice>Geen Luidspreker</INF_NoSpkDevice>.. <INF_LaunchGame>S

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-1HATB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5345
Entropy (8bit):	5.338907168861275
Encrypted:	false
SSDEEP:	96:Np6JVQb30qigr+r4RpliRIuDYzbUulxDk9mSoEvOnQ:Np6JVQb3TiXr4/AC/UgDK9
MD5:	E05254FB06513D95F1E5E314BD558852
SHA1:	8E2B00C5879F93B79485BEB0450AB9FDD440AF49
SHA-256:	074A45F98370090DF0F90130D53F22404211E0C4C3FB35A0535F60B0FA354690
SHA-512:	3874B53427CF7AD527DD7443704498C03DA696E553E05939051541E9DC36A69AF9D35FB7877C0F6EB1A435F7E452E6B4FB4E1FF1B76C88D2E971C43D44170F2D
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<LanguageResource Id="ARA" Name="Arabic" LocaleName="...." Version="1.1" LangID="0x0409" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_Recording>.... .......</INF_Recording>.. <INF_Prepare>....... .......</INF_Prepare>.. <INF_PrepareRecord>....... .......</INF_PrepareRecord>.. <INF_StopRecord>.... %s ...... .......</INF_StopRecord>.. <INF_SelectDirectory>...... ..... ......</INF_SelectDirectory>.. <INF_FolderUnExists>...... ...... .. ..... .... .....</INF_FolderUnExists>.. <INF_FolderReadOnly>... ..... .... ........ .... ...... ... ... ... .... ... ....... ... ... ....... .. ...... .... ... ...... .......</INF_FolderReadOnly>.. <INF_NoMicDevice>.. .... .........</INF_NoMicDevice>.. <INF_NoSpkDe

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-3031J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4938
Entropy (8bit):	4.978669097231732
Encrypted:	false
SSDEEP:	96:C7j+cpQY6Olc2Szzz53RkBDSz41EadtuTVTg6YqE32UF:C7xpN1lLS4ozipzqut
MD5:	EC32C53EE5ABD2307AC59BF6B6D4EF3B
SHA1:	9EEB4AF55E266D7351C53E59E23FBD2ACCA6C7D3
SHA-256:	AF674C2FB5DAC8029D715C94B31C388F8A7A12D7D7C4100CC53CFDC130DE164B
SHA-512:	E611EFC97327ABFCB2CF6FA2C1121A266B75F019564B0C83B74FAA82205CD5DACE87CC79F041BFB958973046B4AE0788A4D38F283DD65F5BE18D8E835EA61CC4
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ITA" Name="Italiano" LocaleName="Italiano" Version="1.1" LangID="0x0410" ProductID="235" CodePage="1252" xmlns="http://www.wondershare.it/">.. <Strings>.. <INF_Recording>Registrazione</INF_Recording>.. <INF_Prepare>Sto preparando la registrazione</INF_Prepare>.. <INF_PrepareRecord>Sto preparando la registrazione</INF_PrepareRecord>.. <INF_StopRecord>Premi %s per fermare la registrazione</INF_StopRecord>.. <INF_SelectDirectory>Per favore seleziona la directory</INF_SelectDirectory>.. <INF_FolderUnExists>Accertarsi di aver selezionato una cartella valida.</INF_FolderUnExists>.. <INF_FolderReadOnly>Impossibile creare la directory di uscita. Si prega di controllare se si dispone dell'autorizzazione per scrivere su quel percorso, o scegliere un altro percorso per creare la directory.</INF_FolderReadOnly>.. <INF_NoMicDevice>Nessun Mic Dispositivo</INF_NoMicDevice>.. <INF_NoSpkDevice>N

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-3OADI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5329
Entropy (8bit):	5.067843931322726
Encrypted:	false
SSDEEP:	96:t1iAgo1iDWUoYvrCVR5D29q2hwMAk6ML3++hMn:t1iAl1hUtGo9Op
MD5:	2C8F7C36009D294AD0BB17C1DB827819
SHA1:	797F870401FDE41309E0ABC674599C212114AE88
SHA-256:	A0C16ED41AF945319F2D3F4C30071B3184CC623062BE4102D604E2B11F63BC9B
SHA-512:	8A2291FAAC756FAB602EBB10108AF510F91AC1AB8787E014D50B2293256F19EE6CD46C90304DDFFFEA81CA68727A1CFCFFDC2A7D2B788B5208646083B4F658ED
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource ProductID="1082" Id="ESM" name="Espa.ol (Latinoam.rica)" LocaleName="Espa.ol (Latinoam.rica)" Version="1.1" LangID="0x080a" CodePage="1252" xmlns="http://www.Wondershare.com/">.. <Strings>.. <INF_Recording>Grabando</INF_Recording>.. <INF_Prepare>Preparando la grabaci.n</INF_Prepare>.. <INF_PrepareRecord>Preparando la grabaci.n</INF_PrepareRecord>.. <INF_StopRecord>Presione %s para detener grabaci.n</INF_StopRecord>.. <INF_SelectDirectory>Por favor seleccione directorio</INF_SelectDirectory>.. <INF_FolderUnExists>Aseg.rese de que ha seleccionado una carpeta v.lida.</INF_FolderUnExists>.. <INF_FolderReadOnly>Error al crear directorio de salida. Por favor revise si tiene permiso para escribir en esa ruta de acceso o elija otra ruta para crear directorio</INF_FolderReadOnly>.. <INF_NoMicDevice>No hay Dispositivo de Micr.fono</INF_NoMicDevice>.. <INF_NoSpkDevice>No hay bocina</

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-4EPQO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4852
Entropy (8bit):	4.9848532284969425
Encrypted:	false
SSDEEP:	96:CGj+cpQY6Olco3SOzz5waBDKLDbEWdtF9VTp6YqE32Uo:CGxpN1l73SgQLv5zfTA
MD5:	12B1CE6643495667AEE98C2C8B043B30
SHA1:	A24FF06D37EB16728999F5270AB8A395CC6E23F5
SHA-256:	41C76992A8262BA7D0AC4E8F11D7CAE788B866C04AF53CF7AB8626581BE2780D
SHA-512:	A87E5A8B810A507A3B971983F5F3DAA31629C084DDABAE4D1E0E93051A0F2FA8D0128D621C3575757B9031640592F7933F4C726D1498E833C191528C3B200FEF
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ITA" Name="Italiano" LocaleName="Italiano" Version="1.2" LangID="0x0410" ProductID="235" CodePage="1252" xmlns="http://www.wondershare.it/">.. <Strings>.. <INF_Recording>Registrazione</INF_Recording>.. <INF_Prepare>Sto preparando la registrazione</INF_Prepare>.. <INF_PrepareRecord>Sto preparando la registrazione</INF_PrepareRecord>.. <INF_StopRecord>Premi %s per fermare la registrazione</INF_StopRecord>.. <INF_SelectDirectory>Per favore seleziona la directory</INF_SelectDirectory>.. <INF_FolderUnExists>Accertarsi di aver selezionato una cartella valida.</INF_FolderUnExists>.. <INF_FolderReadOnly>Impossibile creare la directory di uscita. Si prega di controllare se si dispone dell'autorizzazione per scrivere su quel percorso, o scegliere un altro percorso per creare la directory.</INF_FolderReadOnly>.. <INF_NoMicDevice>Nessun Dispositivo Mic</INF_NoMicDevice>.. <INF_NoSpkDevice>N

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-528QK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4857
Entropy (8bit):	5.107800054991352
Encrypted:	false
SSDEEP:	96:jYjlfcDZ0pmCDtzTdyTVWDR9TFrbR5ipKBIZFKjlj:jYjlED67zm+958/aN
MD5:	67684F381CE97B7482BE220A77C56B5C
SHA1:	5983A703A6804CA2509A96025F3A7BE28F2B45F6
SHA-256:	F69B83F4A81AC80F877896F22C0CDC9931C64FC3D7EEAFEAA10FC5B486A0E51F
SHA-512:	9125AAC4CF12F1B795671AFE1CF81DD7C322D82BEC2F3D26EDFBA52C4427AECD3C0953E6719CE54DBAA7410340429F8EE617DA07813F03B6BBCBC87126855F1B
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="DEU" Name="Deutsch" LocaleName="Deutsch" Version="1.1" LangID="0x0407" ProductID="1317" CodePage="1252" xmlns="http://www.wondershare.de">.. <Strings>.. <INF_Recording>Aufzeichnung</INF_Recording>.. <INF_Prepare>Vorbereiten zur Aufnahme</INF_Prepare>.. <INF_PrepareRecord>Vorbereiten zur Aufnahme</INF_PrepareRecord>.. <INF_StopRecord>Dr.cke %s, um Aufnahme aufzuh.ren.</INF_StopRecord>.. <INF_SelectDirectory>W.hlen Sie Verzeichnis</INF_SelectDirectory>.. <INF_FolderUnExists>Bitte vergewissern Sie sich, dass Sie einen g.ltigen Ordner gew.hlt haben.</INF_FolderUnExists>.. <INF_FolderReadOnly>Fehlgeschlagen beim Erstellen des Ausgabeverzeichnisses. Bitte .berpr.fen Sie, Ob Sie .ber die Berechtigung zum Schreiben auf diesem Pfad verf.gen, oder w.hlen Sie einen anderen Pfad zum Erstellen des Verzeichnisses</INF_FolderReadOnly>.. <INF_NoMicDevice>Kein Mikrofon</INF_NoMicDevice>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-6FIS2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4407
Entropy (8bit):	5.010803632259714
Encrypted:	false
SSDEEP:	96:9q2o262+6zgK3K4MDfQDptfd/+2sE2Dhla:9q2o262Nzi48QFptBYNs
MD5:	ECD2B067EF25508A0FCBB8DA0DEABDDD
SHA1:	ECCBDB4C81BD4BDF30D6B2D22191A79C6F9CF555
SHA-256:	840D973A4536A663A06C962E6C5ECFAAE43DEE7D1E34148A5DB919CEC02F01E8
SHA-512:	C8698ED2195705DCD7DD7DBE708784862E48662D792E49DAD58729981941735CF714AD5A6108B78D95A0E1A14C28E0B2D39BC901818F612CB5DD685BD7A85B5D
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ENG" Name="English" LocaleName="English" Version="1.1" LangID="0x0409" ProductID="235" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_Recording>Recording</INF_Recording>.. <INF_Prepare>Preparing to record</INF_Prepare>.. <INF_PrepareRecord>Preparing to record</INF_PrepareRecord>.. <INF_StopRecord>Press %s to stop recording</INF_StopRecord>.. <INF_SelectDirectory>Please select directory</INF_SelectDirectory>.. <INF_FolderUnExists>Please make sure you have selected a valid folder.</INF_FolderUnExists>.. <INF_FolderReadOnly>Failed to create output directory. Please check whether you have permission to write on that path, or choose other path to create directory.</INF_FolderReadOnly>.. <INF_NoMicDevice>No Mic Device</INF_NoMicDevice>.. <INF_NoSpkDevice>No Speaker</INF_NoSpkDevice>.. <INF_LaunchGame>Please launch a Game, and press hotkey "%s" to start reco

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-7DBL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4393
Entropy (8bit):	5.012045761274297
Encrypted:	false
SSDEEP:	96:9q2o262+6EgK3K4MDfQDptfd/+2sE2Dhla:9q2o262NEi48QFptBYNs
MD5:	C888F2EFDD9E22588117469A360F0F44
SHA1:	9C871582D78A95ADA8D5EB860DF45518E8683B54
SHA-256:	32CBA91834E63EE05875A60FF61E7A60DA7FD1FA58210088B258F47FB3737B6C
SHA-512:	36828E18BD159B58C1CBE15539A3F062539932D3DE179DE20C908C7067F60F5E7FD7D18C354679622833B1559189AD9A3C655C42F19048B3068A6AF196EAB060
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ENG" Name="English" LocaleName="English" Version="1.1" LangID="0x0409" ProductID="235" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_Recording>Recording</INF_Recording>.. <INF_Prepare>Preparing to record</INF_Prepare>.. <INF_PrepareRecord>Preparing to record</INF_PrepareRecord>.. <INF_StopRecord>Press %s to stop recording</INF_StopRecord>.. <INF_SelectDirectory>Please select directory</INF_SelectDirectory>.. <INF_FolderUnExists>Please make sure you have selected a valid folder.</INF_FolderUnExists>.. <INF_FolderReadOnly>Failed to create output directory. Please check whether you have permission to write on that path, or choose other path to create directory.</INF_FolderReadOnly>.. <INF_NoMicDevice>No Mic Device</INF_NoMicDevice>.. <INF_NoSpkDevice>No Speaker</INF_NoSpkDevice>.. <INF_LaunchGame>Please launch a Game, and press hotkey "%s" to start reco

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-7J3LU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4921
Entropy (8bit):	5.041207693503249
Encrypted:	false
SSDEEP:	96:t1iAgo1iDWUcrCVR5D29q2hwMAk6ML3++hMn:t1iAl1hUHo9Op
MD5:	E86C67547A03DDF2C443D6C480FB37AC
SHA1:	38FF39CE1C3A778A9FC77747104972BCA41BCB18
SHA-256:	B1837BFF7CCFFE63542E084141F8FF4291DA766DA2872EF9B15DA3D5578DA093
SHA-512:	8DD2A2BE92D904930E491A6BF0090A8ADCA926C6DDCA45CF5FBC379E13F0074FB5DF622BDB8531E78A9792A2C6929CAA475A2FEBB6CD6A8D1D94CEE4B0702150
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource ProductID="1082" Id="ESM" name="Espa.ol (Latinoam.rica)" LocaleName="Espa.ol (Latinoam.rica)" Version="1.1" LangID="0x080a" CodePage="1252" xmlns="http://www.Wondershare.com/">.. <Strings>.. <INF_Recording>Grabando</INF_Recording>.. <INF_Prepare>Preparando la grabaci.n</INF_Prepare>.. <INF_PrepareRecord>Preparando la grabaci.n</INF_PrepareRecord>.. <INF_StopRecord>Presione %s para detener grabaci.n</INF_StopRecord>.. <INF_SelectDirectory>Por favor seleccione directorio</INF_SelectDirectory>.. <INF_FolderUnExists>Aseg.rese de que ha seleccionado una carpeta v.lida.</INF_FolderUnExists>.. <INF_FolderReadOnly>Error al crear directorio de salida. Por favor revise si tiene permiso para escribir en esa ruta de acceso o elija otra ruta para crear directorio</INF_FolderReadOnly>.. <INF_NoMicDevice>No hay Dispositivo de Micr.fono</INF_NoMicDevice>.. <INF_NoSpkDevice>No hay bocina</

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-EHVUE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4796
Entropy (8bit):	5.081193605517981
Encrypted:	false
SSDEEP:	96:KnLYlaRxn5vjSCCzzwL5DWn9QEiCTOCauBsU+0:KnLYlY/vjCzwLgnib+
MD5:	090570D76B9FC8BFC9085ADB50CCC698
SHA1:	0F8591ADA0C32F6FAE8919CA8E3A8DC080998F8F
SHA-256:	C70324F70E380CAB4E78B880E710931E509F8B57B0075E775A228AFAD2AC3273
SHA-512:	3523FC813BA69BC3884BFE72DFCA3094F06594106D50CC7A7FAB7CC6223C2F6A1CEEF9F789066E254248E7D950482CF1E1586278A6CFD0DCB09871419E2A19C4
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="PTG" Name="Portugu.s" LocaleName="Portugu.s" Version="1.1" LangID="0x0816" ProductID="872" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_Recording>Grava..o</INF_Recording>.. <INF_Prepare>Preparando para gravar</INF_Prepare>.. <INF_PrepareRecord>Preparando para gravar</INF_PrepareRecord>.. <INF_StopRecord>Pressione em %s para parar a grava..o.</INF_StopRecord>.. <INF_SelectDirectory>Por favor selecione o diret.rio</INF_SelectDirectory>.. <INF_FolderUnExists>Certifique-se de que seleccionou uma pasta v.lida.</INF_FolderUnExists>.. <INF_FolderReadOnly>Falha ao criar o diret.rio de sa.da. Por favor verifique se tem permiss.o para escrever neste destino, ou selecione outro destino para criar o diret.rio.</INF_FolderReadOnly>.. <INF_NoMicDevice>Sem Dispositivo de Microfone</INF_NoMicDevice>.. <INF_NoSpkDevice>Sem Coluna</INF_NoSpkDevice>.. <INF

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-FKE0J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5237
Entropy (8bit):	5.8679964735510985
Encrypted:	false
SSDEEP:	96:w3x0nS25SQQO57qqDBj571JYlNTxl9JqF0t+ys+i:w3x0nS2ftj5RGjNzhsT
MD5:	7E2FFF141A5CB3488A37837CC040A8A1
SHA1:	24ED56EDC2C5BEDFAD15B28BE344287BC438F5C7
SHA-256:	F7FAD30B9CE192893E3C5FF5EAEC27A29E7861DDEA1E7491DB6ABAF86D79B29A
SHA-512:	15348EA450624E540B2EE79D077E4B4B2BAF13CC29F8F012AE52EDEB48E5F4C1587055E1497675740A03A6A6B2B749194E9FF5D4A79BBF1405C27B6955B1C8AF
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="JPN" Name="Japanese" LocaleName="Japanese" Version="1.1" LangID="0x0411" ProductID="1366" CodePage="1252" xmlns="http://www.wondershare.jp/">.. <Strings>.. <INF_Recording>...</INF_Recording>.. <INF_Prepare>......</INF_Prepare>.. <INF_PrepareRecord>......</INF_PrepareRecord>.. <INF_StopRecord>%s.............</INF_StopRecord>.. <INF_SelectDirectory>................</INF_SelectDirectory>.. <INF_FolderUnExists>.................</INF_FolderUnExists>.. <INF_FolderReadOnly>................... ......................................................</INF_FolderReadOnly>.. <INF_NoMicDevice>..............

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-IJNKM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5223
Entropy (8bit):	5.868654972504335
Encrypted:	false
SSDEEP:	96:w3x0nS25S/QO57qqDBj571JYlNTxl9JqF0t+ys+i:w3x0nS20tj5RGjNzhsT
MD5:	AED85014FE7B478510A72149A4CEB96B
SHA1:	832CFBC5DEBA9B41D77A3D493219559CD9243723
SHA-256:	D652C534021D5BED0D4CF4056557FFD1EA47EFD71B2410AB5D59F503BF64BAC0
SHA-512:	153DDDBF63A2593F234D49D293791CD558FDFE905A9CDA48D390BB619AA341B1B414247FC9D277509CCCCC5512B98694E295255AA48591E748465566146BCBC6
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="JPN" Name="Japanese" LocaleName="Japanese" Version="1.1" LangID="0x0411" ProductID="1366" CodePage="1252" xmlns="http://www.wondershare.jp/">.. <Strings>.. <INF_Recording>...</INF_Recording>.. <INF_Prepare>......</INF_Prepare>.. <INF_PrepareRecord>......</INF_PrepareRecord>.. <INF_StopRecord>%s.............</INF_StopRecord>.. <INF_SelectDirectory>................</INF_SelectDirectory>.. <INF_FolderUnExists>.................</INF_FolderUnExists>.. <INF_FolderReadOnly>................... ......................................................</INF_FolderReadOnly>.. <INF_NoMicDevice>..............

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-IMTNI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4905
Entropy (8bit):	5.028494343399163
Encrypted:	false
SSDEEP:	96:nYiAgo1iDWUnrCVR5D29q2hwMAkDML3++hMn:nYiAl1hU+o9OA
MD5:	0FC31DF51E2660F34B550FBD0E5C4170
SHA1:	E122861484786F5B07722BE72E875959DD282129
SHA-256:	31DC1FDF33C83D1E35018EA1D1BF9905439E47939C0990D6859B3FE25624AFD1
SHA-512:	216B08C2CA79AAB0B96032CD547D31D6C68F31EF97F58FC318EFBCAB6195E1A1CA00E49D0CE0AE87C8AE679017AF2C169C2EAF610F6888E5043486E53F7A5B8E
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ESP" Name="Espa.ol" LocaleName="Espa.ol" Version="1.1" LangID="0x0c0a" ProductID="235" CodePage="1252" xmlns="www.wondershare.es">.. <Strings>.. <INF_Recording>Grabando</INF_Recording>.. <INF_Prepare>Preparando la grabaci.n</INF_Prepare>.. <INF_PrepareRecord>Preparando la grabaci.n</INF_PrepareRecord>.. <INF_StopRecord>Presione %s para detener grabaci.n</INF_StopRecord>.. <INF_SelectDirectory>Por favor seleccione directorio</INF_SelectDirectory>.. <INF_FolderUnExists>Aseg.rese de que ha seleccionado una carpeta v.lida.</INF_FolderUnExists>.. <INF_FolderReadOnly>Error al crear directorio de salida. Por favor revise si tiene permiso para escribir en esa ruta de acceso o elija otra ruta para crear directorio</INF_FolderReadOnly>.. <INF_NoMicDevice>No hay Dispositivo de Micr.fono</INF_NoMicDevice>.. <INF_NoSpkDevice>No hay bocina</INF_NoSpkDevice>.. <INF_LaunchGame>Ejecut

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-K86SK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4871
Entropy (8bit):	5.106859312677436
Encrypted:	false
SSDEEP:	96:jYjlfcDZ0pmCDczTdyTVWDR9TFrbR5ipKBIZFKjlj:jYjlED6qzm+958/aN
MD5:	D08667712AACF316F60986604AF1764B
SHA1:	9FA45728C55B593DA9D8402350ABD29DB2766CA9
SHA-256:	061E9D8BDAE618B04579D1FD1AD2BC545304F9960E013234B0472034E24EB14B
SHA-512:	C2CEB32F888C1ADA5B0A3741674457115889CED61FC19FA3740DAE870D6F3BE8985BD398E96E617EB9CB6E59C7B10B221D94CFBB6A84792480C84C8F3B77ECFE
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="DEU" Name="Deutsch" LocaleName="Deutsch" Version="1.1" LangID="0x0407" ProductID="1317" CodePage="1252" xmlns="http://www.wondershare.de">.. <Strings>.. <INF_Recording>Aufzeichnung</INF_Recording>.. <INF_Prepare>Vorbereiten zur Aufnahme</INF_Prepare>.. <INF_PrepareRecord>Vorbereiten zur Aufnahme</INF_PrepareRecord>.. <INF_StopRecord>Dr.cke %s, um Aufnahme aufzuh.ren.</INF_StopRecord>.. <INF_SelectDirectory>W.hlen Sie Verzeichnis</INF_SelectDirectory>.. <INF_FolderUnExists>Bitte vergewissern Sie sich, dass Sie einen g.ltigen Ordner gew.hlt haben.</INF_FolderUnExists>.. <INF_FolderReadOnly>Fehlgeschlagen beim Erstellen des Ausgabeverzeichnisses. Bitte .berpr.fen Sie, Ob Sie .ber die Berechtigung zum Schreiben auf diesem Pfad verf.gen, oder w.hlen Sie einen anderen Pfad zum Erstellen des Verzeichnisses</INF_FolderReadOnly>.. <INF_NoMicDevice>Kein Mikrofon</INF_NoMicDevice>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-KRKLE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4998
Entropy (8bit):	5.080220785631204
Encrypted:	false
SSDEEP:	96:GpMBJVcsTFJ0ETTATQjT6DdxLqMGD/6hAXpfyQwWwEK:GpMBJV1IETTvTKx2VTPyz
MD5:	24969FF144391A104C11FA21F297A7E8
SHA1:	85403FCC7D35DF0F95700050B7037E7033F7D5BD
SHA-256:	B0DC418AB6611577FAFA3594CB78B7029CE4D0ED36E2873A567C5A13DCED6A02
SHA-512:	7D3A5CC4B0383424FE6AA79C76FF5C2C400432B634DC5125D92542B0D8B09F938F29EFCF4385C61DADC514C57C8FF04703CAC09DE9B968820A1BF631DE57E84A
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="FRA" Name="French" LocaleName="French" Version="1.1" LangID="0x040c" ProductID="1377" CodePage="1252" xmlns="http://www.wondershare.fr/">.. <Strings>.. <INF_Recording>Enregistrement en cours</INF_Recording>.. <INF_Prepare>Enregistrement en pr.paration</INF_Prepare>.. <INF_PrepareRecord>Enregistrement en pr.paration</INF_PrepareRecord>.. <INF_StopRecord>Appuyez sur %s pour arr.ter l'enregistrement</INF_StopRecord>.. <INF_SelectDirectory>Veuillez s.lectionner le r.pertoire</INF_SelectDirectory>.. <INF_FolderUnExists>Veuillez vous assurer que vous avez s.lectionn. un dossier valide.</INF_FolderUnExists>.. <INF_FolderReadOnly>Impossible de cr.er le r.pertoire de sortie. V.rifiez si vous avez la permission d'.crire sur ce chemin ou choisissez un autre chemin pour cr.er le r.pertoire.</INF_FolderReadOnly>.. <INF_NoMicDevice>Aucun P.riph.rique de Micro</INF_NoMicDevice>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-LQS6R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.999104775689871
Encrypted:	false
SSDEEP:	96:C1ZH35qZ9yX2SqT1T+kCGTDfVgqdjqd1ccHSYkD1SD2la:C1ZH3o9+2BT+GfVtIvA4Sg
MD5:	7023F149572DC15F568A2B169450AE8D
SHA1:	75050231CB8605559C018E786764701E319E5BFF
SHA-256:	81D668BA9E727FCACD00D3E2CBE82483D38A08CF5953678FB755AD558A8A6693
SHA-512:	24484C142DF3D198E45BA6F185329D6BC85BA4BC54BF6FEAB316BB7C5D6D151F06EED7289714DA9916D647C230F13C8CEC8B676BA7CC2D98D0AD6D2261A977D2
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="NLD" Name="Nederland" LocaleName="Nederland" Version="1.1" LangID="0x0413" ProductID="2605" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_Recording>Opnemen</INF_Recording>.. <INF_Prepare>Bereid opname voor</INF_Prepare>.. <INF_PrepareRecord>Bereid opname voor</INF_PrepareRecord>.. <INF_StopRecord>Druk %s om opnemen te stoppen</INF_StopRecord>.. <INF_SelectDirectory>Selecteer a.u.b. directory</INF_SelectDirectory>.. <INF_FolderUnExists>Zorg er a.u.b. voor dat u een geldige map heeft geselecteerd.</INF_FolderUnExists>.. <INF_FolderReadOnly>Het aanmaken van een output directory is mislukt. Controleer a.u.b. of u het recht heeft om op dat pad te schrijven of kies een ander pad om een directory aan te maken.</INF_FolderReadOnly>.. <INF_NoMicDevice>Geen Mic Apparaat</INF_NoMicDevice>.. <INF_NoSpkDevice>Geen Luidspreker</INF_NoSpkDevice>.. <INF_LaunchGame>S

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-M59DE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4782
Entropy (8bit):	5.0826953667308
Encrypted:	false
SSDEEP:	96:KnLYlaRxn5vwSCCzzwL5DWn9QEiCTOCauBsU+0:KnLYlY/vwCzwLgnib+
MD5:	19AE42631B22D5ABEF1335DF9C514C08
SHA1:	16C4208E58BB7C548E20C65822CB419175E97267
SHA-256:	72BC6225C7514678115D879CA3E36EFD04465A42E7BA1CFDAC19979C5125C1E8
SHA-512:	46429225304D002382693E0B506BD867B21E8677B232C9C90721DE80EA59DC1D848B0EAEF366C26C7E628836E8700D35610A2975CB174B6D725078B8E4EE1A9C
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="PTG" Name="Portugu.s" LocaleName="Portugu.s" Version="1.1" LangID="0x0816" ProductID="872" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_Recording>Grava..o</INF_Recording>.. <INF_Prepare>Preparando para gravar</INF_Prepare>.. <INF_PrepareRecord>Preparando para gravar</INF_PrepareRecord>.. <INF_StopRecord>Pressione em %s para parar a grava..o.</INF_StopRecord>.. <INF_SelectDirectory>Por favor selecione o diret.rio</INF_SelectDirectory>.. <INF_FolderUnExists>Certifique-se de que seleccionou uma pasta v.lida.</INF_FolderUnExists>.. <INF_FolderReadOnly>Falha ao criar o diret.rio de sa.da. Por favor verifique se tem permiss.o para escrever neste destino, ou selecione outro destino para criar o diret.rio.</INF_FolderReadOnly>.. <INF_NoMicDevice>Sem Dispositivo de Microfone</INF_NoMicDevice>.. <INF_NoSpkDevice>Sem Coluna</INF_NoSpkDevice>.. <INF

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-M5LJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4891
Entropy (8bit):	5.029537990762714
Encrypted:	false
SSDEEP:	96:nYiAgo1iDWUcrCVR5D29q2hwMAkDML3++hMn:nYiAl1hUHo9OA
MD5:	9E854BADE5FA13EB1A1D695B0C850CA4
SHA1:	7EE9C2B183494F12D25EC6F25E32F5F16C00E9B2
SHA-256:	C673396A50067DA4416776148D9683A3CE67444D73F62CE07436FCC7DB868365
SHA-512:	FCF1BFABE0A179B61C4DAFD270C08A043F9503756DBCCBFBB9AB488684DF26D0805DBEB17B3263F5FD3C8F16C3CA15F62EE81B1E0984CD984C0A2D5B37F2DE26
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ESP" Name="Espa.ol" LocaleName="Espa.ol" Version="1.1" LangID="0x0c0a" ProductID="235" CodePage="1252" xmlns="www.wondershare.es">.. <Strings>.. <INF_Recording>Grabando</INF_Recording>.. <INF_Prepare>Preparando la grabaci.n</INF_Prepare>.. <INF_PrepareRecord>Preparando la grabaci.n</INF_PrepareRecord>.. <INF_StopRecord>Presione %s para detener grabaci.n</INF_StopRecord>.. <INF_SelectDirectory>Por favor seleccione directorio</INF_SelectDirectory>.. <INF_FolderUnExists>Aseg.rese de que ha seleccionado una carpeta v.lida.</INF_FolderUnExists>.. <INF_FolderReadOnly>Error al crear directorio de salida. Por favor revise si tiene permiso para escribir en esa ruta de acceso o elija otra ruta para crear directorio</INF_FolderReadOnly>.. <INF_NoMicDevice>No hay Dispositivo de Micr.fono</INF_NoMicDevice>.. <INF_NoSpkDevice>No hay bocina</INF_NoSpkDevice>.. <INF_LaunchGame>Ejecut

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Recorder\is-PAIFP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5359
Entropy (8bit):	5.340095448663517
Encrypted:	false
SSDEEP:	96:Np6JVQb30qigr++4RpliRIuDYzbUulxDk9mSoEvOnQ:Np6JVQb3TiX+4/AC/UgDK9
MD5:	256B57DC59AE5C80EED71EBA6A9BAE9C
SHA1:	03B7248CF26E1A38E6D378E48384249C2E51A29D
SHA-256:	3037BF8B5245E18C8F1C360290E361EEA291E8190AD79EE6BEBBDAB9BC1D8AF0
SHA-512:	B9472E12A8BDA3B89A7ABD6F63D378B969F8C1F324D3D605FF031BC83762038769A88A04B899FA1652771436F0B40D14B0827FF7E84E70FCD5904908734D09CB
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<LanguageResource Id="ARA" Name="Arabic" LocaleName="...." Version="1.1" LangID="0x0409" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_Recording>.... .......</INF_Recording>.. <INF_Prepare>....... .......</INF_Prepare>.. <INF_PrepareRecord>....... .......</INF_PrepareRecord>.. <INF_StopRecord>.... %s ...... .......</INF_StopRecord>.. <INF_SelectDirectory>...... ..... ......</INF_SelectDirectory>.. <INF_FolderUnExists>...... ...... .. ..... .... .....</INF_FolderUnExists>.. <INF_FolderReadOnly>... ..... .... ........ .... ...... ... ... ... .... ... ....... ... ... ....... .. ...... .... ... ...... .......</INF_FolderReadOnly>.. <INF_NoMicDevice>.. .... .........</INF_NoMicDevice>.. <INF_NoSpkDe

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Spanish(mx).dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (470), with CRLF line terminators
Category:	dropped
Size (bytes):	54191
Entropy (8bit):	5.0931170147649905
Encrypted:	false
SSDEEP:	768:vvbqmhPjk5NETrs09lW43zwIb5qY5skuuJzrkZRBkPG31lEKjJz:vvVPjk5KTrs0zlFKtkO3v1jt
MD5:	850CCCBD9F71E459710CF318F0DB3E5E
SHA1:	BE9F82560AC9BB582D965A4D1CB470F11CDD2E01
SHA-256:	E1A22C1202A1F96DC7B1606CC47436E1083FEA516EFB1DF1E425BD2768CC5FFD
SHA-512:	ABC9B77B4B8195C43BA7985561BC96E6AFF3BA91F29CC6CC931E2F2893D35568722DE983791EB68C2F3CEF5AA9DB36AC6E8DEB56111D85FB35167DCEEAF61F65
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ESM" name="Espa.ol (Latinoam.rica)" LocaleName="Espa.ol (Latinoam.rica)" Version="1.1" LangID="0x0c0a" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Se corrigieron algunos problemas, .est. reprogramado ahora?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Hay algunas tareas ejecut.ndose. .Realmente desea salir?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} elemento(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} elemento(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Pregunta</INF_Question>.. <INF_Warning>Advertencia</INF_Warning>.. <INF_Error>Error</INF_Error>.. <INF_Information>Informaci.n</INF_Information>.. <INF_Yes>S.</INF_Yes>.. <INF_OK>Aceptar</INF_OK>.. <INF_No>No</INF_No>.. <INF_None>Ninguno</INF_None>.. <INF_Cancel>Cancelar</INF_C

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\Spanish.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (470), with CRLF line terminators
Category:	dropped
Size (bytes):	54157
Entropy (8bit):	5.092601988419077
Encrypted:	false
SSDEEP:	768:nUbqmhPjk5NETrs09lW43zwIb5qY5skuuJzrkZRBkPG31lEKjJz:nUVPjk5KTrs0zlFKtkO3v1jt
MD5:	E9936007C27AA924D28B79D737E1B6D1
SHA1:	B713A41B4486EDD10A88D5E0A9E2311431117199
SHA-256:	2C604BD269EC597040347D7F6085A97B2F358B62657AE425C841F77A6CB793A2
SHA-512:	DFACC9C89B38C38EE007E0FAB5862E36DD7CA60EC05AE832BF7121A8ADDD35419051BD8AC151AF666D667E7F322DB9F0892C02C09AC512F4E4867D0A2BD8EFD4
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ESP" Name="Espa.ol" LocaleName="Espa.ol" Version="1.1" LangID="0x0c0a" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Se corrigieron algunos problemas, .est. reprogramado ahora?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Hay algunas tareas ejecut.ndose. .Realmente desea salir?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} elemento(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} elemento(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Pregunta</INF_Question>.. <INF_Warning>Advertencia</INF_Warning>.. <INF_Error>Error</INF_Error>.. <INF_Information>Informaci.n</INF_Information>.. <INF_Yes>S.</INF_Yes>.. <INF_OK>Aceptar</INF_OK>.. <INF_No>No</INF_No>.. <INF_None>Ninguno</INF_None>.. <INF_Cancel>Cancelar</INF_Cancel>.. <INF_Delete>Borrar</IN

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-0ULDP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	50019
Entropy (8bit):	5.097723628905349
Encrypted:	false
SSDEEP:	768:9Mttxl+uy3Pmsi0udFczXEV37L6c3rfPAZ78W2AFQgfDJQzRbSIL61fpXxz:9wl+nfmsSdFczXEVnVmFcRbSS6FpXZ
MD5:	9091320CFBC6891C7A68EBF2B66C2FFF
SHA1:	2E5EB0F2ABCE46C20A72B580AFBC41A36A73C759
SHA-256:	D864787F65ADEF3839B31E8DA9A6CD3FDA70BA26D8AF5B49788E8C074E839678
SHA-512:	EAC7D7BCBFB89FD821DC05A09FEB94657B0AFC840EA9D522F4776A29410AEE665D30D4713E7FB82190C4BA434497BFEA6DB5264B05709CD5CE109AB24C192537
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ENG" Name="English" LocaleName="English" Version="1.1" LangID="0x0409" ProductID="235" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_IncrementalUpgradeTips>A new version which fixed some problems is available now, would you like to update?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>There are some tasks running. Are you sure you want to quit?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} item(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} item(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Question</INF_Question>.. <INF_Warning>Warning</INF_Warning>.. <INF_Error>Error</INF_Error>.. <INF_Information>Information</INF_Information>.. <INF_Yes>Yes</INF_Yes>.. <INF_OK>OK</INF_OK>.. <INF_No>No</INF_No>.. <INF_None>None</INF_None>.. <INF_Cancel>Cancel</INF_Cancel>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-64URT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (429), with CRLF line terminators
Category:	dropped
Size (bytes):	64086
Entropy (8bit):	5.3370947913561295
Encrypted:	false
SSDEEP:	1536:9pEdOHf/DFc+lBr1HFJ8mpfyYZspF5DkejFIeCyrV9YclnF5xfBMsne3rcWo12zo:8+rTve7xfBrErcWI2+UgrMP/d0a+6Nq9
MD5:	16F1C0D09A20C87EF2D537C5EA33150C
SHA1:	F6152BB5CC7D5BC4D79C9ADBEB03D31D817E6086
SHA-256:	424B0F763543AF91DF0F281D63CF1FB99E9049B196F66637082DC24B562F8C6E
SHA-512:	88B458BC1B671D8F77ADAAD2DBEF51F7B345CCF4D920BD4FCF80031EE4DD9358292F2982C69F16F7AAA32CA2D34C4E736A68ADF184AABCD5B7192EEAA26BA932
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ARA" Name="Arabic" LocaleName="...." Version="1.1" LangID="0x0409" CodePage="1252" xmlns="http://www.wondershare.com/">.. <Strings>.. <INF_IncrementalUpgradeTips>..... ... ........ .. .. ..... ....... .....</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>.... ... ....... ...... ..... .. ... ..... .. ........</INF_CloseAppAsk>.. <INF_ItemsInfo>{0}.....</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} ..../......{1}</INF_ItemsInfoContainSize>.. <INF_Question>....</INF_Question>.. <INF_Warning>.....</INF_Warning>.. <INF_Error>...</INF_Error>.. <INF_Information>.........</INF_Information>.. <INF_Yes>...</INF_Yes>.. <INF_OK>.....</INF_OK>.. <INF_No>..</INF_No>.. <INF_Non

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-9TT2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (470), with CRLF line terminators
Category:	dropped
Size (bytes):	54191
Entropy (8bit):	5.0931170147649905
Encrypted:	false
SSDEEP:	768:vvbqmhPjk5NETrs09lW43zwIb5qY5skuuJzrkZRBkPG31lEKjJz:vvVPjk5KTrs0zlFKtkO3v1jt
MD5:	850CCCBD9F71E459710CF318F0DB3E5E
SHA1:	BE9F82560AC9BB582D965A4D1CB470F11CDD2E01
SHA-256:	E1A22C1202A1F96DC7B1606CC47436E1083FEA516EFB1DF1E425BD2768CC5FFD
SHA-512:	ABC9B77B4B8195C43BA7985561BC96E6AFF3BA91F29CC6CC931E2F2893D35568722DE983791EB68C2F3CEF5AA9DB36AC6E8DEB56111D85FB35167DCEEAF61F65
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ESM" name="Espa.ol (Latinoam.rica)" LocaleName="Espa.ol (Latinoam.rica)" Version="1.1" LangID="0x0c0a" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Se corrigieron algunos problemas, .est. reprogramado ahora?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Hay algunas tareas ejecut.ndose. .Realmente desea salir?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} elemento(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} elemento(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Pregunta</INF_Question>.. <INF_Warning>Advertencia</INF_Warning>.. <INF_Error>Error</INF_Error>.. <INF_Information>Informaci.n</INF_Information>.. <INF_Yes>S.</INF_Yes>.. <INF_OK>Aceptar</INF_OK>.. <INF_No>No</INF_No>.. <INF_None>Ninguno</INF_None>.. <INF_Cancel>Cancelar</INF_C

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-I0UO9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (495), with CRLF line terminators
Category:	dropped
Size (bytes):	55524
Entropy (8bit):	5.130878870350333
Encrypted:	false
SSDEEP:	768:A8GqaE6e5ZJ+HGzvAaD008u9gt8AcO5sgTRpAj4qh/zkYMljcJcR2/2GXbE+uK:AY6e5jQG8aD008umt8v13Ju2/24Ew
MD5:	F5EE79650EF592A5F92C717C6AA2F0B5
SHA1:	323441E735281540E25C72097C01CC088FDB8F88
SHA-256:	54797EEBEFBA69A87A9FFAAFF0469627D7E1A2CF4F97FA562C5FED224AC39E02
SHA-512:	6FD09301EE91C2AE9F1E6AC0EE313FC1066405499B8ACADD7A879F0B76D98872616615FECE42E883A29896A538CC203EDC74607E0011890BB6CE033228706504
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="FRA" Name="French" LocaleName="Fran.ais" Version="1.1" LangID="0x040c" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Correction de quelques probl.mes, est-il reprogramm. maintenant?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Certaines t.ches sont en cours d'ex.cution. .tes-vous s.r de vouloir quitter?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} .l.ment(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} .l.ment(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Question</INF_Question>.. <INF_Warning>Avertissement</INF_Warning>.. <INF_Error>Erreur</INF_Error>.. <INF_Information>Informations</INF_Information>.. <INF_Yes>Oui</INF_Yes>.. <INF_OK>OK</INF_OK>.. <INF_No>Non</INF_No>.. <INF_None>Aucun</INF_None>.. <INF_Cancel>Annuler</INF_Cancel>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-IRCFE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (453), with CRLF line terminators
Category:	dropped
Size (bytes):	52353
Entropy (8bit):	5.074517945272763
Encrypted:	false
SSDEEP:	768:CZ1ebw63lK7X6oemnfozBWfJQvc+wxdyXPYZn/i3uvhto7Q3LRfQJBgQ:Cw3Vo7fozBWfJQYfZnB+7Q3Labx
MD5:	B41EDB5D3E15E3F1A154EA3DCA0AAC3F
SHA1:	D99DA44E486E846A08357BB1AD7BDA5055D9AA5B
SHA-256:	F0DE80CB2A5FB945B889485174905BD1EBCE9970E5786844CA144BCDBDDCD9EC
SHA-512:	A06786E20F7098210E1476677D09217DD8EE9D84AC12309F7ED588BE57D767DCAFCAA4318DF8FDB2842AA4CAFFDBB288948A704B32FD9AE8D97B79BB2A1D3F4F
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="NLD" Name="Nederland" LocaleName="Nederland" Version="1.1" LangID="0x0412" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Vaste problemen, is het nu opnieuw geprogrammeerd?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Er werken nog taken. Weet je zeker dat je wilt stoppen?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} item(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} item(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Vraag</INF_Question>.. <INF_Warning>Waarschuwing</INF_Warning>.. <INF_Error>Fout</INF_Error>.. <INF_Information>Informatie</INF_Information>.. <INF_Yes>Ja</INF_Yes>.. <INF_OK>OK</INF_OK>.. <INF_No>Nee</INF_No>.. <INF_None>Geen</INF_None>.. <INF_Cancel>Annuleer</INF_Cancel>.. <INF_Delete>Verwijder</INF_Delete>.. <INF_NoShowAgai

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-MQS8E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (475), with CRLF line terminators
Category:	dropped
Size (bytes):	53155
Entropy (8bit):	5.059885901224683
Encrypted:	false
SSDEEP:	1536:B5HD189mcTA9Q5BtKXRvH5koRvH5kaaqSi08pWxvuvJcRvH5Jy1uqRvH5eJ2Tem:rD189mcTA9Q5BtKXRvH5koRvH5kzq50e
MD5:	9957D0C21B2C8A721584260275478906
SHA1:	6A3DAEE4B508E69DAD3A011EBF646F86E4C133D6
SHA-256:	53FF58D440DABACC9D4E6478D52560979D173C6EE57BD0472BE4D1323E18B4EB
SHA-512:	6B1BC0B116DE69105BDBEC351A54F05BA3898AC4206AFD4D0FBF7F2399CED2F52F068D0FAD151770DAD529B371257082189FD7DABD80E2677B2EB52D4878FB73
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ITA" Name="Italian" LocaleName="Italiano" Version="1.1" LangID="0x0410" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Risolti alcuni problemi, . ri-programmato adesso?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Ci sono alcune attivit. in esecuzione. Sei sicuro di voler uscire?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} elemento/i</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} elemento/i, {1}</INF_ItemsInfoContainSize>.. <INF_Question>Questione</INF_Question>.. <INF_Warning>Warning</INF_Warning>.. <INF_Error>Errore</INF_Error>.. <INF_Information>Informazioni</INF_Information>.. <INF_Yes>Si</INF_Yes>.. <INF_OK>Congratulazioni!</INF_OK>.. <INF_No>no</INF_No>.. <INF_None>Nessuno</INF_None>.. <INF_Cancel>Annulla</INF_Cancel>.. <INF_Delete>Eliminare<

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-QV6FK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (494), with CRLF line terminators
Category:	dropped
Size (bytes):	53726
Entropy (8bit):	5.125281524381118
Encrypted:	false
SSDEEP:	768:H/9WzkMtJyalaR8x4Q8VRh2W2y84lyN5BvclZaciB1524LTBiwQk2w4WHzj6m:H/FMtJyalG8x4Q8vDslim4WTj1
MD5:	D90A0E77CD1C2FDF9EE6F0688350E779
SHA1:	D925BAFDD65D844AC5C4616F1E0D7FCE536AFC2B
SHA-256:	5B6B18D08C11F22126844744710468CB84FC87B950E576253E12083073E9157C
SHA-512:	C745C54E0AC57D032834F22E1BF43033C54BC0FE7E38BD45B654304055FE07C2C8B6E5B138BCC210EB249A80C0454E59FCDBA06E19B52C449D6E99424F96E7F7
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="PTG" Name="Portuguese" LocaleName="Portugu.s" Version="1.1" LangID="0x0816" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Corrigido alguns problemas, . re-programado agora?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Algumas tarefas ainda est.o executando. Tem a certeza que pretende sair?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0}, item(ns)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} item(ns) {1}</INF_ItemsInfoContainSize>.. <INF_Question>Quest.o</INF_Question>.. <INF_Warning>Aviso</INF_Warning>.. <INF_Error>Erro</INF_Error>.. <INF_Information>Informa..es</INF_Information>.. <INF_Yes>Sim</INF_Yes>.. <INF_OK>OK</INF_OK>.. <INF_No>N.o</INF_No>.. <INF_None>Nenhum</INF_None>.. <INF_Cancel>Cancelar</INF_Cancel>.. <INF_Delete>Eliminar</INF_Del

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-SEG33.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (499), with CRLF line terminators
Category:	dropped
Size (bytes):	55705
Entropy (8bit):	5.170353212012466
Encrypted:	false
SSDEEP:	768:rY1nHxKu/Zm+KP3X/x3KWI+EMUiOCMncHAgeojzkDRIxAVSFoXBC:r+HxKSA3X/1KWI+EMUiCa/ISFoxC
MD5:	03005FC382A3D68D382E4C0C980C2FF9
SHA1:	9F411B8AB0CFB227B70BC6842B756746CCAEC3C1
SHA-256:	01AAC489A9DC0FCF307E6B334EFC6F990BB4511A691F59DD6B71B1AC98DB1324
SHA-512:	14DD1DD72C866619876A27A5C30B747A4C5B750F0E3BFB0B5C5AD0679C8DA4428B2759EC884C0D0C583621CAFFC25BB7C7019E7EEF9F78FAE6A6BD71C013A712
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="DEU" Name="German" LocaleName="Deutsch" Version="1.1" LangID="0x0407" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Einige Probleme behoben, ist es jetzt neu programmiert?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Es laufen noch einige Aufgaben. Sind Sie sicher, dass Sie das Programm beenden m.chten?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} Element(e)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} Element(e), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Frage</INF_Question>.. <INF_Warning>Warnung</INF_Warning>.. <INF_Error>Fehler</INF_Error>.. <INF_Information>Informationen</INF_Information>.. <INF_Yes>Ja</INF_Yes>.. <INF_OK>Herzlichen Gl.ckwunsch!</INF_OK>.. <INF_No>Nein</INF_No>.. <INF_None>Kein</INF_None>.. <INF_Cancel>Abbrechen</INF_Cance

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Languages\is-VBSUA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (470), with CRLF line terminators
Category:	dropped
Size (bytes):	54157
Entropy (8bit):	5.092601988419077
Encrypted:	false
SSDEEP:	768:nUbqmhPjk5NETrs09lW43zwIb5qY5skuuJzrkZRBkPG31lEKjJz:nUVPjk5KTrs0zlFKtkO3v1jt
MD5:	E9936007C27AA924D28B79D737E1B6D1
SHA1:	B713A41B4486EDD10A88D5E0A9E2311431117199
SHA-256:	2C604BD269EC597040347D7F6085A97B2F358B62657AE425C841F77A6CB793A2
SHA-512:	DFACC9C89B38C38EE007E0FAB5862E36DD7CA60EC05AE832BF7121A8ADDD35419051BD8AC151AF666D667E7F322DB9F0892C02C09AC512F4E4867D0A2BD8EFD4
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<LanguageResource Id="ESP" Name="Espa.ol" LocaleName="Espa.ol" Version="1.1" LangID="0x0c0a" CodePage="1252" NameOrder="GivenFamilyName">.. <Strings>.. <INF_IncrementalUpgradeTips>Se corrigieron algunos problemas, .est. reprogramado ahora?</INF_IncrementalUpgradeTips>.. <INF_ProductName>Wondershare Free YouTube Downloader</INF_ProductName>.. <INF_CloseAppAsk>Hay algunas tareas ejecut.ndose. .Realmente desea salir?</INF_CloseAppAsk>.. <INF_ItemsInfo>{0} elemento(s)</INF_ItemsInfo>.. <INF_ItemsInfoContainSize>{0} elemento(s), {1}</INF_ItemsInfoContainSize>.. <INF_Question>Pregunta</INF_Question>.. <INF_Warning>Advertencia</INF_Warning>.. <INF_Error>Error</INF_Error>.. <INF_Information>Informaci.n</INF_Information>.. <INF_Yes>S.</INF_Yes>.. <INF_OK>Aceptar</INF_OK>.. <INF_No>No</INF_No>.. <INF_None>Ninguno</INF_None>.. <INF_Cancel>Cancelar</INF_Cancel>.. <INF_Delete>Borrar</IN

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Profile.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	448
Entropy (8bit):	4.741299771854692
Encrypted:	false
SSDEEP:	12:7OKb1nvnKbBeKbxRGDKDKOKbkRlKYKb19N/KbiXZ1KOKbpf2gj+o9b:7OKZKVeKVwDKDKOKKKYKh//KWp1KOKRn
MD5:	AFB0CE56193185C7B1E8B78E49CAF358
SHA1:	4F3CD62A59C899C26ED41F00FD9FAD6DE250FF95
SHA-256:	80B7739AC0AE58877AE65662997821A60F0136D7A9B039966B9236A1616A00AD
SHA-512:	B5C98A62484ED379719CBDDABD78E335BE55D6F7736DD0A54CE1D34A3B1EF53AD04FFBBB03BDF0DFA10C55B7EE8750C48BA77304FFBCEF30C26C564DB8A8B66F
Malicious:	false
Reputation:	unknown
Preview:	.<profile>.. <category id="1" title="Apple" icon="MenuApple"/>.. <category id="2" title="Android" icon="MenuAndroid"/>.. <category id="4" title="Video" icon="MenuCommonVideo"/>.. <category id="5" title="Audio" icon="MenuCommonAudio"/>.. <category id="3" title="Apple Software" icon="MenuAppleSoftware"/>.. <category id="6" title="Web Video" icon="MenuWebVideo"/>.. <category id="7" title="Game Devices" icon="MenuGameDevices"/>..</profile>

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AVPlay.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11348
Entropy (8bit):	4.822067181534186
Encrypted:	false
SSDEEP:	192:i9UsSIcniOebzdE+tIVb5OGB5L8g5IzR7lkNb:h+tIVtOGBev0
MD5:	5CCE26C974F28E3CD20EFD0660D65AD2
SHA1:	FDF88979FA53BF9FE6917D696C288165492EA727
SHA-256:	1387519CCE0D1D6813E82B4049571533AAC2D1EA1BE63BB0639898FF1DD4D80B
SHA-512:	0538F7FFCBABAF2F4F65EFC5D702830C3E2690E61CDAF11146CF70AE4ADA2A666B89F8E6194ABDE523EFA2035D9EA5DD48CD4BBA0CA4AA8CFEB8E46BB036DEC6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="btnPre">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="Play.png" />.. <State Left="233" Top="69" Width="30" Height="29" />.. <State Left="263" Top="69" Width="30" Height="29" />.. <State Left="293" Top="69" Width="30" Height="29" />.. <State Left="323" Top="69" Width="30" Height="29" />.. </Part>.. </Item>.. <Item Name="btnNext">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="Play.png" />.. <State Left="245" Top="104" Width="30" Height="29" />.. <State Left="275" Top="104" Width="30" Height="29" />.. <State Left="305" Top="104" Width="30" Height="29" />.. <State Left="335" Top="104" Width="30" Height="29" />.. </Part>.. </Item>.. <Item Name="PlayProgressBar">.. <Part id="0" Name="Frame" TransparentMode="Alpha">.. <Graphic Name="Play.png" />.. <State Left="373" Top

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\About.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 318 x 83, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16042
Entropy (8bit):	7.963506286823883
Encrypted:	false
SSDEEP:	192:2potGfri2N1I71EXLaSkE83rFY7+hOmHJansJRF8IccznhZA14xIftYRPssWRjr:APO23I7C2/9YMO0vTF8Iccj+0KtYFJqr
MD5:	87858E205B7D46DAD12962A92E867A1B
SHA1:	2DCF60D63C3A8672E030EB7DC34B2218F6BB0177
SHA-256:	EF3D34EA7BBF4D85815AF448B178C95E016EA7A7F73E33A645A493EB8B08E350
SHA-512:	9F593F90B0A50069FC8E232626381B53CFC38C499F75214BB215F5293779C81DBD1A50C6CCA86C421AA1D9CE8110B2FDF2FB6A58D640264D5005437314C3DF37
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...>...S......%k.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a6afa1f8-2527-4354-8a80-38bca9f2a77b" xmpMM:DocumentID="xmp.did:5B053F7ED90311E89D9693CE6517A5F2" xmpMM:InstanceID="xmp.iid:5B053F7DD90311E89D9693CE6517A5F2" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c95e305d-0b65-43db-bfbf-858d553856ac" stRef:documentID="adobe:docid:photoshop:b48f5a09-2163-117c-a8fc-b7944222f4cf"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>$O\...:.IDATx....

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AddConverterAnimate.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13527
Entropy (8bit):	5.258625900025772
Encrypted:	false
SSDEEP:	192:UaAPxL8yguRbA324gID6lIbwjI9S3cRm7dmxMfSl4ju+1WPjARWOOsdLoDSt0n+L:hAJeO3
MD5:	6E446AC2FCFB4B905C68D03C44D10EA3
SHA1:	04165FED6545A5CF558877088869A42DFE22F1CF
SHA-256:	ADDF5BABD346499893B3C11FF8DB04D4F6A71461A5694A1D397CA338B254F860
SHA-512:	F08E36E039A01B54B6E411A075BCAB97D4B63DF09850E3C6CF2921B654DC99871ADE585305DE5F1771CF9F1BF3335A5C6EA74E656AB35A76911CBAAF3E178AB4
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. Save for Web Styles (.....png) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:1920px;..height:40px;.}..#x8f6cx6362x5408x6210-01_ {..position:absolute;..left:0px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-02_ {..position:absolute;..left:40px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-03_ {..position:absolute;..left:80px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-04_ {..position:absolute;..left:120px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-05_ {..position:absolute;..left:160px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-06_ {..position:absolute;..left:200px;..top:0px

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AddConverterAnimate.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1920 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	24101
Entropy (8bit):	4.787657887290745
Encrypted:	false
SSDEEP:	192:jS/kt1+VE2U9WVaZXW+zgRl3WuaC7zHegFWNIGJTR13DJORpKxkVd:Wst1+VE2U9WgZGEiBWSv+ZNIm1FsL
MD5:	FD5D3622DF1C4B5356326C782670D533
SHA1:	608F470BE9798F655B47A3AEAD55D5E7FADCCEE9
SHA-256:	B366EA73A6B4EA78177A22C8AD3931BDFB7521F606238590BB50802B36B1922C
SHA-512:	8979BFAE953E2FFC8820A86A89786CE91D174FFCC8FB0EC43735A32443B269EE518D4FCF4CBFE814E13B7594CF7714B6B1FA64C86F83B5CCE6F92D3DC617782D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(......J......pHYs...............8*iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Macintosh)</xmp:CreatorTool>. <xmp:CreateDate>2016-12-05T06:02:46+08:00</xmp:CreateDate>. <xmp:ModifyDate>2016-12-05T14:15:24+08:00</xmp:ModifyDate>. <xmp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AddDownloadTaskAnimate.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13527
Entropy (8bit):	5.256721441016642
Encrypted:	false
SSDEEP:	192:BkaiZJTaM4Gtb/F0oa2ZIrw9i9C/MJm7AVX0fK1A7Wx843sP9aroMe2PteBorqdc:Bxib3wd
MD5:	9734795701ADD24907EC0A9F7C951651
SHA1:	A0CDC08AA340C11D6FBC75DCD9954F85AFA2C769
SHA-256:	B59CD8B5277FA4014DFF39F340B855C4E55F89070EF83F664FCC3ACB9BDA8E49
SHA-512:	10B68C9A5FD5812C03F886E1F653799F97BA5408313E0F539B4EC79AA3E580FCDC427D98E31B7AACDCA3FDD533696AEB115D76179D7CDC6A8F4C80600346F825
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. Save for Web Styles (.....png) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:1920px;..height:40px;.}..#x4e0bx8f7dx5408x6210-01_ {..position:absolute;..left:0px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-02_ {..position:absolute;..left:40px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-03_ {..position:absolute;..left:80px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-04_ {..position:absolute;..left:120px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-05_ {..position:absolute;..left:160px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-06_ {..position:absolute;..left:200px;..top:0px

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AddDownloadTaskAnimate.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1920 x 40, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	7.788489466854337
Encrypted:	false
SSDEEP:	96:EtIezmo75N97iB33DE6FzoH/fLUbUyYkVJ+KqVNTFMr2E1F:IIezX75Sh3VFAfYY+VJ+XNTF/E1F
MD5:	1E649B1011948206021613F2538F46FA
SHA1:	E9F1DC24E3A85E24D77E2075EC48EADE970179E9
SHA-256:	3B0B5C2D86E4BB572992F1991445DD16A1B82628515121C2B48A25D1A85BE966
SHA-512:	24A14AFB9BBE31A5DBC85E5673EB60A638FADF3BDE5C475139547594519348CB422EC53A21B41F8659CA2BA35D177CFAADC9520C20E041FC5BB4198953CD79AD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(.....(.......PLTE....................................................................................................33...........................................33.......33.............44.......33.......33.33.......33....44....33.88....55.......44.......66.33.33.33.......55.88.44....44.33.44.55....44....44.44.......33.44....33.......66....44.44.44................>>............NN....44.ZZ.aa.QQ.gg.~~.oo.GG.......==.................E.....{tRNS.....4.....1..;x.......%l.6.AW.g....b/..........B.>}.s......%.'....a..~RC5..OF.].....t..lX.G......K..#..O9.D....=qQ....tIDATx.....@..p...{.....XP.8..(3.......E@...&O}..G{!....u\..o..<.&..%....S.b...$1..1I.0HN..4..y&..FvT.P._.(pM.K.u=.F.V..^.......gn.C..Pg&K..m.5Q....o8^....Z.B.w.d>.n.n..+vq..jU...N.7...z.....V..j..iE"...e..h/.....\9.;.Z....Aq.8o:E..sz9.o6_*.q.g.]...8<_.}.wb.U. F3.n.XB......A[D......&gf.u.&.Z..a...V...K...\|3!.E....:..%.0.}...-.._.+.."..r.6...6W..w..i..Lp..8R.....

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AddTransferAnimate.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13527
Entropy (8bit):	5.25652264096273
Encrypted:	false
SSDEEP:	192:Wai9ZrWcUKtbJn2CqkDKBq9g3gtuDcZqfVGlo/y50zuytSPPwBqssE1fcjqJ4X2t:Hi/hO/
MD5:	40CD09EB6A36C3E3787FB5AE38A858E0
SHA1:	22BEF5C79C1988BDE9824C3A5CB9561B63FE7E72
SHA-256:	04A0272A4D858B2B6B5F0D9E91ABD883B41A281F8D0800074B493BB3831703CA
SHA-512:	B22AF7F785095870AEB8D6E36859BA577ADC871EC059493E85CB139A331F7B4A32313ACC8F58B8EB086E1E660FE74EB79C68DD345B752083E0C1CC149D382D15
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. Save for Web Styles (.....png) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:1920px;..height:40px;.}..#x4f20x8f93x5408x6210-01_ {..position:absolute;..left:0px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-02_ {..position:absolute;..left:40px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-03_ {..position:absolute;..left:80px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-04_ {..position:absolute;..left:120px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-05_ {..position:absolute;..left:160px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-06_ {..position:absolute;..left:200px;..top:0px

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AddTransferAnimate.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1920 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25049
Entropy (8bit):	4.9309471608672215
Encrypted:	false
SSDEEP:	384:WstDaCKk7slOhbMDEnBs/rmg5zVCCrjbiQ:vteYQ4hYAun5BCCPbiQ
MD5:	B989180705873F7B133FB4E1C7D2AFBE
SHA1:	6392B9F2BCAFE6425BC241F983B21EB127DF7E1F
SHA-256:	367E9D1E6D743F00941414CA552F179FB2264E560066045270FCBD336010E498
SHA-512:	08E1A7F28B8A9AE42B8CA9F291F3AA0D8833F9EA40913C60B59BB68213B89439E0EF5610B13989006E78578097816D95ACE425EF5B1EC09D3A23ADFF74E5FBAF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(......J......pHYs...............8*iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Macintosh)</xmp:CreatorTool>. <xmp:CreateDate>2016-12-05T06:02:44+08:00</xmp:CreateDate>. <xmp:ModifyDate>2016-12-05T14:14:55+08:00</xmp:ModifyDate>. <xmp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AndroidDebugTip.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3982
Entropy (8bit):	4.915183637013446
Encrypted:	false
SSDEEP:	48:cohYLWSfY2WSdYYYWSRYHKWSZLY8Aj+Y2AjiYYYAj8Y89j/Y29j9YYY9jxYHK9jx:KOAT3HoUbyTBFAT3HEILqTZHKM
MD5:	3A70E35CA61ABE34CEEE8D3B7FC9008E
SHA1:	9BE70FD35AC7CFDECE9C3F09617E23AEAF5CBF5E
SHA-256:	E06D43355810ECE07B4C1646240448341C7F399CFC5455DD0C66DA2D3B92EE1F
SHA-512:	A08A3F2A89B87CD0A9C33F2B79F2A88E662428877DB1F966A0955FCF3B249426C2BE7BA77FC9123DF76527B5323733812DE83DD52106EE41690E9A91F0F83BA4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="imgDebugVersion0">.. <Graphic Name="pic.png" />.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <State Left="30" Top="30" Width="190" Height="317" />.. </Part>.. </Item>.. <Item Name="imgDebugVersion1">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="pic.png" />.. <State Left="230" Top="30" Width="190" Height="317" />.. </Part>.. </Item>.. <Item Name="imgDebugVersion2">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="pic.png" />.. <State Left="430" Top="30" Width="190" Height="317" />.. </Part>.. </Item>.. <Item Name="imgDebugVersion3">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="pic.png" />.. <State Left="630" Top="30" Width="190" Height="317" />.. </Part>.. </Item>.. <Item Name="imgDebugversion_3_0">.. <P

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Animate.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21733
Entropy (8bit):	5.266673941035247
Encrypted:	false
SSDEEP:	192:0a7jLCGp3A2Lo2eF/WGaNG6aKeXcdvZ6qSGIDFzVGyyipwfYOD9eueKjzm71TdFp:B7juOguDsj
MD5:	7D678606E17A96578311B6C62CE53E84
SHA1:	FED05C3A3B3650ED12E1993D3F02597AEBE9EC5D
SHA-256:	C67AC4B9C06FE01801AA2D8B9544E344FE2478D9A572389746EDCA07D609F91F
SHA-512:	7B6873A51F59CE32A47D914557F7B4DBBC18BCE73A87476A3E55CE5DC0783FE8C7DF918EAA6FBA11FE277A0156A2DDAE00BDFE567EFE047B1A0F6061D40333F3
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (.....psd) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:7912px;..height:204px;.}..#id1-02 {..position:absolute;..left:0px;..top:0px;..width:184px;..height:184px;.}..#id1-02002 {..position:absolute;..left:184px;..top:0px;..width:184px;..height:184px;.}..#id1-02003 {..position:absolute;..left:368px;..top:0px;..width:184px;..height:184px;.}..#id1-02004 {..position:absolute;..left:552px;..top:0px;..width:184px;..height:184px;.}..#id1-02005 {..position:absolute;..left:736px;..top:0px;..width:184px;..height:184px;.}..#id1-02006 {..position:absolute;..left:920px;..top:0px;..width:184px;..height:184px;.}..#id1-02007 {..position:absolute;..left:1104px;..top:0px;..width:184px;..height:184px;.}..#id1-02008 {..position:absolute;..left:1288px;..top:0px;..width:184px;..height:184px;.}..#id1-02009 {..position:absolu

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Animate.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 7912 x 204, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	221519
Entropy (8bit):	7.990344205543906
Encrypted:	true
SSDEEP:	6144:svyv1qZaWhQ1oMxhdra4c2GbHbp2if2GV8AiDmM:YpZa11o4apxbgi+GV8ASmM
MD5:	4B3D92DBCE1A698DAE34E7F8F732F0BB
SHA1:	7D46960A76C003F433340220BBB9FE36D61C036B
SHA-256:	E3A8C4912CF0C607FFF72C347201E53BE17EED937B1394DE2FAD6B2F4B5B9F5C
SHA-512:	46AEEB22C5835A1B2E7B0EAF408D63A843A788F5E9BB30AF5C4F21EAF93DA6F8E5DFB111A239289023FC4A1797C869166E8EA7E86A71499B5326D78C34066AA3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................PLTE.......................................................................yyy.............z..........vvv...............wsp.........xvu...vvw.............zzzsrr.......sss...........utt......\|\|\|......www...uuu}}}...........}}}}}}....wyyy.._\|\|\|...zzz.I......}}}................................T....................?...................Z.>.....F...B..O@........#....}........^..R......Z....!........:..j......{.n.......S.........z...\........5.....:....................(..?..C.................0...........-.......}...#........J..P.....T..G...........M.....X...............................................................................e............................q...p..............T.........c.....................................tRNS.......'.$.. *D.?0-J.O3;.T8.6.Xjp..\ae..u...m$.F...4...F..y.Z.\|./.{.j..............[..(..p.?Y.Y.>.n..A.?V.9...&..xZ.#..m.....B..........a......]mIDATx...m..0...CBb.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\AnimateXML.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	4.846047834142827
Encrypted:	false
SSDEEP:	24:2dou59qBRrq7CpODp9q2rq7CpODOB9q3Zrq7CpODgbZFeld+BlSrICrqeBcCrq1A:coKw+ms3v+msw2+msgirUIF+er+uFc+v
MD5:	98703E22D956991909C2FC07C7201662
SHA1:	E4835B4ADE2D0722C8B8ADA9968FD82248FEA470
SHA-256:	356B10F2924B90F26D27F06723D2054299828046D9F1D9EF8B10BC80C7B17233
SHA-512:	257F007BBABB97B243940A2355A1F71402D0AA95FB3A670930AE090F025E983E4CCEE912D6E456A3FA6A7BA0D6EDF6E02F2CB659A496409D4EF913368B4B0DF1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="imgAddTransferAnimate">.. <Part id="0" Name="Frame" TransparentMode="Alpha">.. <Graphic Name="AddTransferAnimate.png" />.. <State Left="0" Top="0" Width="40" Height="40">.. <Animation FrameCount="48" FrameDelay="24" />.. </State>.. </Part>.. </Item>.. <Item Name="imgAddConverterAnimate">.. <Part id="0" Name="Frame" TransparentMode="Alpha">.. <Graphic Name="AddConverterAnimate.png" />.. <State Left="0" Top="0" Width="40" Height="40">.. <Animation FrameCount="48" FrameDelay="24" />.. </State>.. </Part>.. </Item>.. <Item Name="imgAddDownloadTaskAnimate">.. <Part id="0" Name="Frame" TransparentMode="Alpha">.. <Graphic Name="AddDownloadTaskAnimate.png" />.. <State Left="0" Top="0" Width="40" Height="40">.. <Animation FrameCount="48" FrameDelay="24" />.. </State>.. </Part>.. </Item>.. <Item Name="imgNewTask">.. <Part id="0" Name="NewConver

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Controls.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	29555
Entropy (8bit):	4.736358243298655
Encrypted:	false
SSDEEP:	192:B8QIzRFIvGWrderPcG2KrEGlFfub7vRSnkUCsBBjZzujuOczd83EwiiISa:6vwr4rPV2KxlFoSnkfsnjZaj3iiIR
MD5:	CEDC364670DA1CC03B86381665BD196F
SHA1:	2B0129EA03CE8F9C7244B1244458C1E8945122AC
SHA-256:	9C623D355427CF189CE35FB536932234AF2F5DA357F71A4F1CA9FBC2A8801EF0
SHA-512:	34821CE033B9A41B5A195E47AA2CC42C49263373B2DC0A19F458858F36F057FC07900D46A6FC83B936D09E37F384EC31868D66BC4724C8B16A3E3C6289A6B766
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="SkinForm">.. <Part id="0" Name="Form" Style="1" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <Region type="Auto" />.. <Margins Left="12" Top="52" Right="12" Bottom="12" />.. <State Left="469" Top="96" Width="52" Height="106">.. <Margins Left="13" Top="49" Right="13" Bottom="56" />.. <DestMargins Scale="True" Left="13" Top="49" Right="13" Bottom="56" />.. </State>.. <State Left="469" Top="96" Width="52" Height="106">.. <Margins Left="13" Top="49" Right="13" Bottom="56" />.. <DestMargins Scale="True" Left="13" Top="49" Right="13" Bottom="56" />.. </State>.. </Part>.. <Part id="1" Name="Caption">.. <Position RelPos="Top" Scale="False" X="16" Y="20" X2="32" Height="16" />.. <Font Size="10.5" />.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="0xff646464" Style="Bold" />.. </State>.. <S

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\DeviceConnect.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3829
Entropy (8bit):	4.897943495258707
Encrypted:	false
SSDEEP:	48:coCnc0ncqcbFb074JbYbuGFYnCYGuYMGaYlXCYnfKYVfWYYKpfcY5aIJflYbLb:an5n/MFqbuxt6M1Zy8TKlYIwfb
MD5:	0D9F46236C1B034FF339F498D46EE589
SHA1:	CB11560AB56DB640696FAF89E093CA9886448C5B
SHA-256:	B6378483781427BA80391438FA142A469AAF198FC14104799A8A5780E6E3B300
SHA-512:	2ADF4588E028D033C3A19EB20FC8906B0A269A3FD3DC72F957CA22AF0983481AA36AAC79A5C19C353ABFA6E320478905741D60DB3428FF83FC18EDDD82494FEA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="imgDevice">.. <Part id="1" Name="IOSDeviceICON" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="473" Top="550" Width="14" Height="16" />.. </Part>.. <Part id="1" Name="AndroidDeviceICON" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="473" Top="577" Width="15" Height="16" />.. </Part>.. <Part id="2" Name="Connected" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="513" Top="506" Width="13" Height="21" />.. </Part>.. <Part id="3" Name="BigDevice" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="65" Top="766" Width="148" Height="372" />.. </Part>.. </Item>.. <Item Name="IOSPasscode">.. <Part id="0" Name="Frame" FillMode="none" TransparentMode="Alpha">.. <Graphic Name="Instructions.png"

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\FormatIcons.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11075
Entropy (8bit):	4.852400944895557
Encrypted:	false
SSDEEP:	96:+eBvDvidl+HCijldzlUL4vTcEMX2EVY4mR7Mp+VbXlMx2elpPnyZQ0p+:iT
MD5:	E19AA44DA2D3DC9B8A9A369FC3689F24
SHA1:	DBEC608C5CE3679EC7E91C3BDD93F968A398A4A6
SHA-256:	08F61C5F5D579CDF32566A6AB69D8F26BF028D610BDE5CF7448118746DD03902
SHA-512:	A31E2A5C8317496165C09B04C0588266C4808D119497ECAC1D2BCE17242DC9DB097D8EF7A563D39A87438EF3AE9CFA3F4DE2F864D3AD3E53D9D45611B510137E
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="IconMP4">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="SmallFormatImage.png" />.. <State Left="239" Top="1891" Width="74" Height="74" />.. </Part>.. </Item>.. <Item Name="IconMpg">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="SmallFormatImage.png" />.. <State Left="317" Top="1695" Width="74" Height="74" />.. </Part>.. </Item>.. <Item Name="IconMOV">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="SmallFormatImage.png" />.. <State Left="239" Top="1695" Width="74" Height="74" />.. </Part>.. </Item>.. <Item Name="IconM4v">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="SmallFormatImage.png" />.. <State Left="5" Top="1695" Width="74" Height="74" />.. </Part>.. </Item>.. <Item Name="IconWMV">

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\FormatImage.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 534 x 296, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26634
Entropy (8bit):	7.950122865042636
Encrypted:	false
SSDEEP:	768:0QSi7zd742Z+/Rxbgg7SN8OSR4l4yZLRlF+g:0QSqd82+BQSGO0nFP
MD5:	F4D30A703138A89B3BCABB93C5D2C641
SHA1:	644E257EF78EC6A81CA350C4C849340D28A8E012
SHA-256:	1333FE1DDB8D6DF84E780B8ADD34EC6653F922640E65CC3825236D4B15FED499
SHA-512:	28ADFA9F10363C94B7804CC208E527BFB4AFDDC0893C1236EBE0F59774B66DB7BD530543FE575B2DB8C84BAF5998643A3E66852EFCFF2E39D4616C03E799C731
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(............tEXtSoftware.Adobe ImageReadyq.e<...ziTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e6f266e3-7ba6-41e9-8795-6fe12523b5ca" xmpMM:DocumentID="xmp.did:76CAF8FA9FFB11E68FF6AC6959A19A33" xmpMM:InstanceID="xmp.iid:76CAF8F99FFB11E68FF6AC6959A19A33" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fc72e23a-544c-4924-942c-360111a5dca8" stRef:documentID="xmp.did:e6f266e3-7ba6-41e9-8795-6fe12523b5ca"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Z.....d&IDATx....\.....q.{r..(

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\FormatMgr.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8802
Entropy (8bit):	4.831823982385328
Encrypted:	false
SSDEEP:	96:bmOQ8gSofzRFseGYDPqpGghYn6FNyQ2wzjmBtl:bmh8gSIzRFseGFB29l
MD5:	C4D3E922B75B8693E8D837FB5D7EC15A
SHA1:	E2ED4E51495CBC53921A01CF55B6B034BBD6840F
SHA-256:	1A5BB8F60A618E38C9D209C4249748490BAE3744164F62AC63C26822DCB99E48
SHA-512:	6349EAF9E1395647A10B968978B821271E1D47E00BC97FBCF6D28EB4F6DA3F8CDA695F19F94BD55902E09C5BBE748D19E31A070741C1B0F62F03C2F8E336792E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="imgFormatFrame">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <State Left="0" Top="0" Width="0" Height="0" />.. </Part>.. <Part id="1" Name="hot" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="851" Top="419" Width="127" Height="183">.. <Margins Left="39" Top="67" Right="36" Bottom="81" />.. </State>.. </Part>.. <Part id="2" Name="press" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="978" Top="419" Width="127" Height="182">.. <Margins Left="51" Top="65" Right="53" Bottom="52" />.. </State>.. </Part>.. </Item>.. <Item Name="formatSelectForm">.. <Part id="0" Name="Form" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <Region type="Auto" />.. <Margins Scale="False" Left="5" Top="28" Right="5" Bottom="5" />.. <State Left="661" Top="67" Width="75

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Guide.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	26948
Entropy (8bit):	5.238250418609292
Encrypted:	false
SSDEEP:	384:EIrPX9bRmYtcL5MVXcsWGS2Tjvz3JbtD7V7kzj:ZNbRmYtcL0Xcsx7y
MD5:	0CC089CADFC3A6DF7C8A6D2DA6668353
SHA1:	3D2E87B4AB29A2400E36C068E1829F107FDFD79F
SHA-256:	C7295201A8765878091D28D802C2868ECF12F93D99698CE5CE0C3350483F2558
SHA-512:	CED7860BF16F0C73248AD3AEC809FF1C20FD6E5E65EA01E7D5DE95B51433F4E552B911FEEB105F1E3F8B3CE6C9A7F446D4A88704FAF000A8346FE70082EAD063
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>Guidancemap</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (Guidancemap.psd) -->.<style type="text/css">. ..#Table_01 {..position:absolute;..left:0px;..top:0px;..width:1405px;..height:1765px;.}..#Guidancemap-01 {..position:absolute;..left:0px;..top:0px;..width:1405px;..height:78px;.}..#Guidancemap-02 {..position:absolute;..left:0px;..top:78px;..width:74px;..height:189px;.}..#Guidancemap-03 {..position:absolute;..left:74px;..top:78px;..width:569px;..height:5px;.}..#Guidancemap-04 {..position:absolute;..left:643px;..top:78px;..width:762px;..height:71px;.}..#Guidancemap-05 {..position:absolute;..left:74px;..top:83px;..width:569px;..height:5px;.}..#Guidancemap-06 {..position:absolute;..left:74px;..top:88px;..width:569px;..height:5px;.}..#Guidancemap-07 {..position:absolute;..left:74px;..top:93px;..width:569px;..height:5px;.}..#Guidancemap-08 {..position:absolute;..left:74px;..top:98px;..width:569px;..height:5px;.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Guide.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1405 x 1765, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	129439
Entropy (8bit):	7.835689459657122
Encrypted:	false
SSDEEP:	3072:l256Cvrt7ev7hXLr5hzOKEYhukja/tPRsNVaSXhsymGHaGo:lzUrt7ev7PhqKEYhukjKtPRsNV///6Go
MD5:	FF0C55A134F86496BF739F549129738D
SHA1:	C0D898B7645B91F6C382D82C4221AE303ACEFD75
SHA-256:	20B70F35C114C0DED10EBA1F19A572B22A8EE5833824B593F4BD5ED8CABD7895
SHA-512:	5068F9CBA7FA67921348D244FD259B685336C1F05421E91E378BBDD66B6C680D1BCB9E03CFB0266843782C168B999CC09BEF16162F2C8442A7BD9CA1871FBC59
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...}.........l2as....pHYs............... .IDATx...y...]'..{.J*.Vk)y.l.b'...QV.0i..$.4...zXz`r.e..p..........$9..Y..n'!d.v.;.B.x.l.v...JR.u.}..Y.%.t...T..>.srNb...O.}....>....<........2.......`..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_................7.x=...W.......'.....:........x.......{...x.....wx...{.?j...\.....bQd........cp....M....=.\>.I...........,.....=..Znx.}...#............qO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Guide.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	4.89567144245996
Encrypted:	false
SSDEEP:	24:2dojGv4Q324QlBl/4Q5lyZ4QRJe4QUsNJpZ4QMDW4QoDP4Q8967jIr:cojMUjfwdePjX36FH8
MD5:	3B24D82CB24AF90EC29A9DC54F701A47
SHA1:	87BE6E53AF344B2CBE32675211107BEA5C338971
SHA-256:	AFD6E25803DC89515D274E8E9DC500EA5BAA0356EEB29CBC4ECC2DDAC225A893
SHA-512:	1D319E716F680F8EBEE023187D9EA558FBCB0CFD9E65E418B65F99CD698A1EE612C5CA9FDDEF1BFBD3706772CA8DB43072CAD521BE43875DAACC9D87E158F61E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="ImgGuide">.. <Part id="1" Name="ConvertGuide1" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="631" Top="267" Width="264" Height="218" />.. </Part>.. <Part id="2" Name="ConvertGuide2" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="926" Top="267" Width="264" Height="218" />.. </Part>.. <Part id="3" Name="TransferGuide1" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="631" Top="494" Width="264" Height="218" />.. </Part>.. <Part id="4" Name="TransferGuide2" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="926" Top="494" Width="264" Height="218" />.. </Part>.. <Part id="5" Name="RecorderGuide1" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="57" Top="4

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Instructions.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	7846
Entropy (8bit):	5.23448861983268
Encrypted:	false
SSDEEP:	96:4V/u3/4S/eiK8lKr3KWQK9QQHKvkK5SKCpKn/IqtTGobRqsiRS6x6uRJA8fWe6Ff:4dkbvdHJ2Gf
MD5:	356E48CE70E83F085162B5AC5A8E4689
SHA1:	A2E37D3E0A2EF7C54C57B0F51FD40CE3C2ECEB11
SHA-256:	D58A66F74B6D39ABA5D994F4C5FB2AFD9318F1EF648A11BC52004275663206D1
SHA-512:	E0090D205C937F146A4DB80E18DFEB894CECA23D8ACB81D484010F50274AD4ED0EDDAE635487141FF07E11CAD5D72C14FB8D718DCDF0CCB39634B713F9F565A2
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>Instructions</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (Instructions.psd) -->.<style type="text/css">. ..#Table_01 {..position:absolute;..left:0px;..top:0px;..width:1205px;..height:932px;.}..#Instructions-01 {..position:absolute;..left:0px;..top:0px;..width:1205px;..height:15px;.}..#Instructions-02 {..position:absolute;..left:0px;..top:15px;..width:18px;..height:917px;.}..#Instructions {..position:absolute;..left:18px;..top:15px;..width:50px;..height:50px;.}..#Instructions-04 {..position:absolute;..left:68px;..top:15px;..width:50px;..height:50px;.}..#Instructions-05 {..position:absolute;..left:118px;..top:15px;..width:50px;..height:50px;.}..#Instructions-06 {..position:absolute;..left:168px;..top:15px;..width:50px;..height:50px;.}..#Instructions-07 {..position:absolute;..left:218px;..top:15px;..width:987px;..height:100px;.}..#Instructions-08 {..position:absolute;..left:18px;..top:65px;..width:50px;..heig

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Instructions.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1205 x 932, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	368308
Entropy (8bit):	7.994457042343119
Encrypted:	true
SSDEEP:	6144:JE5TL8lH+g/e8L3FOCFlgUMhI1+gaj2da/DqksAmdzrIUqvrmuWNMe6f+PEE7nYj:q5TLaHh3kCFlDMhI1+ge2+D/hmdfId1/
MD5:	91D1F4DD4A4E58FFB475B11CAEF56A0F
SHA1:	AB2CEDAFEDF34C022EE3227DCD0524BB4CF468B5
SHA-256:	BD063FAB6E5BDE32FB0F88199CBA65609AB35BAA57EFEE0A443D5F4C3E435FC1
SHA-512:	20DEC6585C4417EF740BE9B3E2AAA24785FD21AEEDB4CA8FC3209EAD6AD59BEAECC800E61ADACB821DDEC933E1624B2A407D386C3F2E39134EAFE5CB563B0B94
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............P.......pHYs............... .IDATx...y\|T..7..9s.Lf.d'+[.].A.....R.......}......>..V...&.E[.;.,.QA...-aI.F..d.s..IB..e.,..w_.a2.=.3......F.u.DDDDDDDDD..... """""""":],.........h.a.EDDDDDDDD..K-"""""""".pXj..........R............ZDDDDDDDD4..""""""""..............8,.........h.a.EDDDDDDDD..K-"""""""".pXj..........R............+.TU-..BS...DEQF..:$....n. ...3.L-.$.ey..b....I...T.{o.~....../..&.t.G..)C.C....u..].}Y...b...X.e.y.[.(.m..i..p0Z..52u.G.X.SG5..C:"Zn(..u@..._.Yl)....:.]#...9.MyVSZ.m.,..n..M.w5.....9..3...+v........q..U..k.-SG.l*.v.U."""""""..t]O.9@U.2..7....V.el.f.\.p8V;..e.$.0..OE.O){aO.Wk...z...Q.T^;.......rJr4..eo...]..}.S.W..N.rJ.u..R...)%9..v.=.a....]Y...c..+g.?j....,...LI."""""""....Z.H.l..s....@4h.f......f.v.f.PU[......~.LM7&.(@.r.k...<4&;#)9j...+...{.!4S7(. @..0c.-#...s.I.....^..5[...t..C.fN,_s..=tvinRr..........F..mmm..\|......Fw8.....1.L.8@kP..ts.c...1WOP...o.....I...X.......g......&4..R...q..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\MainForm.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	154673
Entropy (8bit):	5.210735921013266
Encrypted:	false
SSDEEP:	768:4I6ZHkuphca8ns+KwZv41NvN6TczPLtOeMWm79:7dKqvCN6TczPLtNMWm79
MD5:	6DC932E981277AEC10C391A97C34633F
SHA1:	2078CD24AE2D6F2D7B4FB935A46A33A840BB0387
SHA-256:	801F0658312BF672298E81B8AB27A8F9B61A92178A2378C65513002DA14014E6
SHA-512:	CF681CBE6B5C4208DA21A2374A2D4D8C17DB3F6DE6124D7D9F9933506AEB6BFE4B5695511C21FB9970E1AC2163CFF651568F67D27FD7689B363F49C0BE51464F
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>mainform</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (mainform.psd) -->.<style type="text/css">. ..#Table_01 {..position:absolute;..left:0px;..top:0px;..width:1205px;..height:1232px;.}..#mainform-01 {..position:absolute;..left:0px;..top:0px;..width:1205px;..height:67px;.}..#mainform-02 {..position:absolute;..left:0px;..top:67px;..width:661px;..height:29px;.}..#mainform-03 {..position:absolute;..left:661px;..top:67px;..width:75px;..height:164px;.}..#mainform-04 {..position:absolute;..left:736px;..top:67px;..width:469px;..height:2px;.}..#mainform-05 {..position:absolute;..left:736px;..top:69px;..width:37px;..height:180px;.}..#mainform-06 {..position:absolute;..left:773px;..top:69px;..width:102px;..height:122px;.}..#mainform-07 {..position:absolute;..left:875px;..top:69px;..width:330px;..height:6px;.}..#mainform-08 {..position:absolute;..left:875px;..top:75px;..width:211px;..height:28px;.}..#mainform-09 {..po

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\MainForm.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1205 x 1600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	167704
Entropy (8bit):	7.934788657942961
Encrypted:	false
SSDEEP:	3072:VDoco4OZzqJU3AQ3Y+4jKuJwm4Tl6n4Sp0SAq6Tf4ToaBRTIiBjz:xyZzqJAY+4jtwDG4w0y6c9bTIiBjz
MD5:	4558AB28E891CB5F7304DBB066693772
SHA1:	E7B91513A39A2E55C56B4535F599596D1272C91B
SHA-256:	F4D646490F6BEEB22A46C27A9816959069B52AE7BA950E94D5AD25BC177DFD61
SHA-512:	7AF4B7DD40EF45E9DD13C2C8396A7A439B2CB61CC56990443EDC351A1C1DF4D7D631E67DEE10EB58FE6DCB7C03CA9A6E2F1F77941C466E342127EA409EFA3731
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......@.......p.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\MainForm.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	36826
Entropy (8bit):	4.840471877048546
Encrypted:	false
SSDEEP:	192:w8ggrR7IrWJr6Y1q1wNCkV8U1pnChhP86cevaXlHeu73J9ACGNjTWIxeb3g7OrsC:HrF1q1wNCkVmDCMnXu4I
MD5:	E0AF0A9138F05AF3914E05CE99628205
SHA1:	21C01F2B64BE62916EB8125B0696B73EF42E0B06
SHA-256:	6667E0FFEE247C2B700C0FEF6EC1516FF1931AE57FDAFAEA89DA49D5D3E1D709
SHA-512:	71E94ABC546C2DF0E44F011FD5A14185B6B40AD48A53FAEE2F67E19253D26234CD0A516D5BCD6F99CEE1A53C921C11DFF86D72B1747924710F2F72D0F4DBEEA6
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="MainForm">.. <Part id="0" Name="Form" Style="1" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <Region type="Auto" />.. <Margins Left="8" Top="10" Right="10" Bottom="9" />.. <State Left="72" Top="107" Width="162" Height="97">.. <Margins Left="131" Top="80" Right="15" Bottom="16" />.. <DestMargins Scale="True" Left="131" Top="80" Right="15" Bottom="16" />.. </State>.. <State Left="72" Top="107" Width="162" Height="97">.. <Margins Left="131" Top="80" Right="15" Bottom="16" />.. <DestMargins Scale="True" Left="131" Top="80" Right="15" Bottom="16" />.. </State>.. </Part>.. <Part id="1" Name="Caption" Visible="False">.. <Position RelPos="Top" Scale="False" X="26" Y="8" X2="26" Height="16" />.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="0xff646464" Style="Bold" />.. </State>.. <State Left="

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\MainIcon.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3330
Entropy (8bit):	5.422083671734282
Encrypted:	false
SSDEEP:	96:xTi2/c/l/DgsrwC/lT03COfkeAwGlUgJtOxhT9QvlxKvgidMYepf:NiawNDlk69gC9BtlUgJtOxhT9QvlxKvq
MD5:	F26C47C1E4DC56CD80DF712F35E24705
SHA1:	F9FCD9FE01EEC2DB3C1436DEB83848173A104ED3
SHA-256:	78C672DD95689AE10330F4207E18942D07061BE4A969638CE002795ABC8AC1E6
SHA-512:	7B34DECCF6DDAF3E3559784124ADB1EA29C6A77F204C7A389CFBDE65B95686C4E6331A4B4CA0BAF6E97B08C98ECFF27F60C09EEA9648E25ED8E1F689CF46396F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. Save for Web Styles (.....psd) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:323px;..height:139px;.}..#x56fex6807x5207x56fe-01_ {..position:absolute;..left:0px;..top:0px;..width:323px;..height:45px;.}..#x56fex6807x5207x56fe-02_ {..position:absolute;..left:0px;..top:45px;..width:36px;..height:94px;.}..#x56fex6807x5207x56fe-03_ {..position:absolute;..left:36px;..top:45px;..width:40px;..height:40px;.}..#x56fex6807x5207x56fe-04_ {..position:absolute;..left:76px;..top:45px;..width:40px;..height:40px;.}..#x56fex6807x5207x56fe-05_ {..position:absolute;..left:116px;..top:45px;..width:40px;..height:40px;.}..#x56fex6807x5207x56fe-06_ {..position:absolute;..left:156px;..top:

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\MainIcon.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 323 x 139, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21751
Entropy (8bit):	3.9428657491778583
Encrypted:	false
SSDEEP:	96:3ZSMllcHitlIxv9vk7C1+I4wWHLihk/xE/OkEWmrjxfIKokVEQpLXaxNXrNXNsck:JSHIIHUCD4waqWk62K05+zgdqzoANlcw
MD5:	DDAD75DC35815B9472CEEAC69BDCAC84
SHA1:	A7A96BBCFF1548E2DC959D150D8CB785EAEA1F1C
SHA-256:	E899A2C27E9864226D8C23E4AA4B854A2C264BBDD5101AE122342A33AABF102D
SHA-512:	8D46F252E8379DD4A61329469440AFA9077C7EB02D5A1AC3E29DC47D2F242E01266A661A08B5F5FF85B5CE2F3F6372C46F68941E70191E68DEB5E48C4A8CF6C3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C............j....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\MsgBox.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1875
Entropy (8bit):	4.854469893271774
Encrypted:	false
SSDEEP:	48:coJYcqAjTYcQUAjRYczAjjYcWyAjIYc9AjQYcJHKYczEwYcKU:yTy+Bjr6lZK
MD5:	197A18B99F21E2FFFDC6C484BA75AA21
SHA1:	94201EFC1E3965386116CA4B10ECB047B5D3364C
SHA-256:	E73BB676505A29B90E0BF2594723D8D1C93B006C0B1D53885E516A6C575C0BDD
SHA-512:	78C4C522268E7FFA175C3BF05CCA60F3F87CA3C458027C50B3B56FFFE9F4E33F70BF393524CF619A925DF275AB2CE2F9E92C728E7F3447F9874A5E19983A70B3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="InformationIcon">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="322" Top="690" Width="42" Height="42" />.. </Part>.. </Item>.. <Item Name="QuestionIcon">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="365" Top="690" Width="42" Height="42" />.. </Part>.. </Item>.. <Item Name="ErrorIcon">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="451" Top="690" Width="42" Height="42" />.. </Part>.. </Item>.. <Item Name="WarningIcon">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="279" Top="690" Width="42" Height="42" />.. </Part>.. </Item>.. <Item Name="SuccessIcon">.. <Part id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\Online.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2194
Entropy (8bit):	4.829570024692189
Encrypted:	false
SSDEEP:	48:codtC2g2A7232xRtoyAFhxtxtOwAHbxxt82Alxx2G3/wH+:62g2A7232KyAFhewAHb22AlxCe
MD5:	A57012EFE8965C829786E2C54B94F9FD
SHA1:	C34A8D0BA9FB4F005B6DDA952936D447C68FC187
SHA-256:	62EB0DD9B67B70928FE652DE8994575EBE1A735E2C7A10A4E4CB4504F3F6E300
SHA-512:	1DE4CA3DC493C2A98F3268A0762BC0447027ED23B581F7A4B8327C2D9F4F6CE61F1B55D4A69C7769219CA15C663F4FF6C98C489B36ABF2D4B98AA0697BDB140E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="BtnHome">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="129" Top="486" Width="28" Height="28" />.. <State Left="158" Top="486" Width="28" Height="28" />.. <State Left="187" Top="486" Width="28" Height="28" />.. <State Left="216" Top="486" Width="28" Height="28" />.. </Part>.. </Item>.. <Item Name="BtnBack">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="129" Top="515" Width="28" Height="28" />.. <State Left="158" Top="515" Width="28" Height="28" />.. <State Left="187" Top="515" Width="28" Height="28" />.. <State Left="216" Top="515" Width="28" Height="28" />.. </Part>.. </Item>.. <Item Name="BtnForward">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="MainForm.png"

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\ProfileIcons.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10351
Entropy (8bit):	5.01938112085905
Encrypted:	false
SSDEEP:	96:xAk2vCI4UydEzFrEOllkCoXMFMSAsHYVd737gngbqd7d8lK+h4lwdMx/wLgzjxOQ:bVGPH2WGFYBfmM
MD5:	A2D100F028F0F59730EE3459A8B4E738
SHA1:	E243382AF358F012F05D37EF1721E8B35EFDC800
SHA-256:	40FBA113882FD4F16DBDF47B8B74A95348CE1277EF507518F1B1074013BF7024
SHA-512:	EE33A7451DFBA536F92BE39E2FD497BD520578107B9865C73CEFA4A05CFAA5DBED583E865BC41B3A1450602E17EB88908659B437434DB6E38132C25831CAEC86
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Graphic Name="ProfileIcons.png" />.. <Item Name="ProfileIcons">.. <Graphic Name="SmallFormatImage.png" />.. <Slice Id="IconAsf" rect="239,2053,74,74" />.. <Slice Id="IconMov" rect="239,1695,74,74" />.. <Slice Id="IconM4v" rect="161,2053,74,74" />.. <Slice Id="Iconmp4" rect="5,1695,74,74" />.. <Slice Id="IconWmv" rect="395,1695,74,74" />.. <Slice Id="IconMkv" rect="5,1810,74,74" />.. <Slice Id="Iconavi" rect="161,1695,74,74" />.. <Slice Id="IconDV" rect="317,2053,74,74" />.. <Slice Id="IconMpg1NTSC" rect="395,1972,74,74" />.. <Slice Id="IconMpg2NTSC" rect="473,1972,74,74" />.. <Slice Id="IconVobNTSC" rect="395,2053,74,74" />.. <Slice Id="IconHDTs" rect="5,1891,74,74" />.. <Slice Id="IconHDTRP" rect="83,1891,74,74" />.. <Slice Id="IconHDAVI" rect="161,1810,74,74" />.. <Slice Id="IconHDmp4" rect="83,1810,74,74" />.. <Slice Id="IconHDMpg" rect="317,1810,74,74" />.. <Slice Id="IconHDWmv

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\SiteIcons.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 94 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4284
Entropy (8bit):	7.921705976234661
Encrypted:	false
SSDEEP:	96:DllcHitlIxv9vk7C1+I4wWHLihk/xNbwwiOSUvmc5SM4n:QIIHUCD4waHbwhGE
MD5:	FB46664AE3F903038AA92A04B88A7BE1
SHA1:	2565FB78DCB231A710140148CFE0D1C682EE7112
SHA-256:	6D21424BB92976E74B68E149FB748C24D5C35E59379724A25B89ADD7BC01DFBD
SHA-512:	E8FDC64A148582D287F64166840F81FA53681F2D3ABA836E07B29CCDEA553812BE222DF732F0FC5502B728697D64572C0F8B88A3A552947490FBBC3496C2994C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...^............r....pHYs..........+.....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\SmallFormatImage.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 589 x 2720, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1171475
Entropy (8bit):	7.992754767199659
Encrypted:	true
SSDEEP:	24576:piyZumWPg781slc8JwB0IEfVX8ia4L+jKsmmT627zX5zs:EyZA47wslc/OIEB8ia4ijKr2q
MD5:	15025A5BB6C7DA527CC7F600C83BC405
SHA1:	3D6BDC6C471D39A699E7BD20091626EA6E8C3680
SHA-256:	787F1CBA3775805C57405A2D1FCB92577BEA44C2EAD536EACBF85236598016B4
SHA-512:	6CD0EF4182425CF6EEF99F6D337EFAD05A9D7F4E92361576E7C655C6E16B6ED3A80CC3EC481E270E27BC934FC80F3CF7EE3548B446786DC2D988F5DCE4E31745
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...M............c.. .IDATx..w.]Gy...9..]..lY.%..ml.;.b0........@BI.I..`0$.o..fb.8.7\q.l.X..VeUV.....2....{..........S.<g..S..(..2.(..2.(..2.(..2.(....1..Z.3.2.8i.!FvXq..O....+.;. .#.}U.Nu\|...,U...6V.AY...F....Z.3.2.x.(L,.....cMx.:.T..fx.RF...QF.e.T...G.........c4'.7.{.2...2.D(..2.h8Y..h.K=..fy.RF...Q..e.TF.G.&.7".,.Y.(..2..#.g..e.....w.....=K..oPF.g.eOS.c.z..!..sJ.tl.0..z..g)....(..r.2..Jm)....J...9..K....>.uv.ot...;.....$9.N.&.....%.c......<~8)y..\|.e..0VjX..=.;Wi.KkF/c.q....]...#......z..V..t.v)+..G....D...1..k..T.[N./.r..Z=.#...-....>.dv$.w4..~.x.u.e\|"...a.=Y..h..H.?.7=..L...G.X.....88.}.wm.b,.c.Xd...[.8I.(i:........y.....H.v..k....'"....#..t.d,.....xc.X..Xr+%....y...O..88......h..._.CT.).L..;.....m..u..3..>.3Fz!N....>..cy..o.........#..:q2.....W.....-...D...8Q.....M...G..D.}.a4t.k..X".e.f......Ne..M.W).d.n'..;..v~..T=.'...v.h.L....J....D.v"...9.2>..{:..F..F...29.U8.i.#~..l}.."?.8.^..}$...py.... ....#..T.}...I....H

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\SupportSites.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 781 x 394, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	43981
Entropy (8bit):	7.945709131170903
Encrypted:	false
SSDEEP:	768:3H0ejgnhe8FbGwXDU/BpTFGhPxl7/tGY183CtkngBLZZ:36Q8hF+HeP/M13CvDZ
MD5:	62DCEE4268496C723B627683504A65A5
SHA1:	EDDBA8FE85A9A74744ADFA9D3D688381424A189D
SHA-256:	D571A9AECBD2BF4D40FE97AB4BDEEA3EBE49AB44C44D7998397382BA7A0822BF
SHA-512:	2282D9409D90D39C5AF957ADB76494BEF75540A7754A80D8EE43EBBE7A6E32D23BBF91299016EF0E3306F180DB48654F4D719E7EE885D4FBEA1EE8874DD5C4E6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............N......tEXtSoftware.Adobe ImageReadyq.e<...giTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F7777B9D3F206811822AE92A6C9DEA14" xmpMM:DocumentID="xmp.did:DAAAC5FACF6C11E4BB68E94A2864D510" xmpMM:InstanceID="xmp.iid:DAAAC5F9CF6C11E4BB68E94A2864D510" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EE4AC125CAF711E486EEA5BDF7AAC3A8" stRef:documentID="xmp.did:EE4AC126CAF711E486EEA5BDF7AAC3A8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>E..X....IDATx........I.,[....bCE.("vT.z..".kA,W

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\SupportSites.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4846
Entropy (8bit):	4.817376292428456
Encrypted:	false
SSDEEP:	48:coaiVsPHYKTWenZvktHWiI9ubSo94Y1iTPIMK0Yf+OQQmHSQHdQ:uTkt6/9Q
MD5:	D38CF7F420DAF08F154F0FD10C11780E
SHA1:	991EB586A28DE5E936BB376B800237BAEA1BDA5C
SHA-256:	CFAE5D757A37119A3237F1D5EB80600314F9BF1036057FE405AE1BAF8E11822D
SHA-512:	FAA2E832F790EAA93F3BF4A94D0C6B596E674559170583BE0E1865DD6503606DFC37C278322503F74537B5982748402180E02B5BF43E4C5A2379A8317390B467
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="SupportSite0">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="SupportSites.png" />.. <State Left="34" Top="77" Width="46" Height="46" />.. </Part>.. </Item>.. <Item Name="SupportSite1">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="SupportSites.png" />.. <State Left="87" Top="77" Width="46" Height="46" />.. </Part>.. </Item>.. <Item Name="SupportSite2">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="SupportSites.png" />.. <State Left="140" Top="77" Width="46" Height="46" />.. </Part>.. </Item>.. <Item Name="SupportSite3">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="SupportSites.png" />.. <State Left="193" Top="77" Width="46" Height="46" />.. </Part>.. </Item>.. <Item Name="SupportSite4

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\TransferPage.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5515
Entropy (8bit):	4.834575301968821
Encrypted:	false
SSDEEP:	48:cov/cZq89mMzxixe3oKKxhRHlGwLLLIGkULLL7GwLLLCGqLLLmaSIm3A2ypbYnfK:0c8gSofzRFse+uQY6ej3Tl+68J
MD5:	4DDDF9DFD88D30EEE893B510489F2C00
SHA1:	E78077C94188DBD8A4E73442C3ECEAAF93F4E837
SHA-256:	5679AABFC680DCEEBD92D25666E817EA4E2D0C0C3D98E9D0E940BC553D847D6A
SHA-512:	D675BFF732AC8A036B1ED42FC86FFDBDCCFBFF3980E7F5A0E0487EDEBD061E722837043BE8ABA1793E5D3C8D6E7945DA8A2E62A4A03ACEF7C1559F526016E400
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="waitTransferForm">.. <Part id="0" Name="Form" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <Region type="Auto" />.. <Margins Scale="False" Left="5" Top="5" Right="5" Bottom="5" />.. <State Left="289" Top="114" Width="101" Height="58">.. <Margins Left="15" Top="26" Right="84" Bottom="27" />.. </State>.. </Part>.. <Part id="1" Name="Caption" Visible="False">.. <Position RelPos="Top" Scale="False" X="26" Y="8" X2="26" Height="16" />.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="0xff646464" Style="Bold" />.. </State>.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="clBlack" Style="Bold" />.. </State>.. </Part>.. <Part id="2" Name="Icon" Visible="False">.. <Position RelPos="TopLeft" Scale="False" X="8" Y="8" Width="16" Height="16" />.. </Part>.. <Part id="3" Name="Restor

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-1T497.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3330
Entropy (8bit):	5.422083671734282
Encrypted:	false
SSDEEP:	96:xTi2/c/l/DgsrwC/lT03COfkeAwGlUgJtOxhT9QvlxKvgidMYepf:NiawNDlk69gC9BtlUgJtOxhT9QvlxKvq
MD5:	F26C47C1E4DC56CD80DF712F35E24705
SHA1:	F9FCD9FE01EEC2DB3C1436DEB83848173A104ED3
SHA-256:	78C672DD95689AE10330F4207E18942D07061BE4A969638CE002795ABC8AC1E6
SHA-512:	7B34DECCF6DDAF3E3559784124ADB1EA29C6A77F204C7A389CFBDE65B95686C4E6331A4B4CA0BAF6E97B08C98ECFF27F60C09EEA9648E25ED8E1F689CF46396F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. Save for Web Styles (.....psd) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:323px;..height:139px;.}..#x56fex6807x5207x56fe-01_ {..position:absolute;..left:0px;..top:0px;..width:323px;..height:45px;.}..#x56fex6807x5207x56fe-02_ {..position:absolute;..left:0px;..top:45px;..width:36px;..height:94px;.}..#x56fex6807x5207x56fe-03_ {..position:absolute;..left:36px;..top:45px;..width:40px;..height:40px;.}..#x56fex6807x5207x56fe-04_ {..position:absolute;..left:76px;..top:45px;..width:40px;..height:40px;.}..#x56fex6807x5207x56fe-05_ {..position:absolute;..left:116px;..top:45px;..width:40px;..height:40px;.}..#x56fex6807x5207x56fe-06_ {..position:absolute;..left:156px;..top:

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-2AQJG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3829
Entropy (8bit):	4.897943495258707
Encrypted:	false
SSDEEP:	48:coCnc0ncqcbFb074JbYbuGFYnCYGuYMGaYlXCYnfKYVfWYYKpfcY5aIJflYbLb:an5n/MFqbuxt6M1Zy8TKlYIwfb
MD5:	0D9F46236C1B034FF339F498D46EE589
SHA1:	CB11560AB56DB640696FAF89E093CA9886448C5B
SHA-256:	B6378483781427BA80391438FA142A469AAF198FC14104799A8A5780E6E3B300
SHA-512:	2ADF4588E028D033C3A19EB20FC8906B0A269A3FD3DC72F957CA22AF0983481AA36AAC79A5C19C353ABFA6E320478905741D60DB3428FF83FC18EDDD82494FEA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="imgDevice">.. <Part id="1" Name="IOSDeviceICON" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="473" Top="550" Width="14" Height="16" />.. </Part>.. <Part id="1" Name="AndroidDeviceICON" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="473" Top="577" Width="15" Height="16" />.. </Part>.. <Part id="2" Name="Connected" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="513" Top="506" Width="13" Height="21" />.. </Part>.. <Part id="3" Name="BigDevice" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="65" Top="766" Width="148" Height="372" />.. </Part>.. </Item>.. <Item Name="IOSPasscode">.. <Part id="0" Name="Frame" FillMode="none" TransparentMode="Alpha">.. <Graphic Name="Instructions.png"

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-2CI42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 323 x 139, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21751
Entropy (8bit):	3.9428657491778583
Encrypted:	false
SSDEEP:	96:3ZSMllcHitlIxv9vk7C1+I4wWHLihk/xE/OkEWmrjxfIKokVEQpLXaxNXrNXNsck:JSHIIHUCD4waqWk62K05+zgdqzoANlcw
MD5:	DDAD75DC35815B9472CEEAC69BDCAC84
SHA1:	A7A96BBCFF1548E2DC959D150D8CB785EAEA1F1C
SHA-256:	E899A2C27E9864226D8C23E4AA4B854A2C264BBDD5101AE122342A33AABF102D
SHA-512:	8D46F252E8379DD4A61329469440AFA9077C7EB02D5A1AC3E29DC47D2F242E01266A661A08B5F5FF85B5CE2F3F6372C46F68941E70191E68DEB5E48C4A8CF6C3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C............j....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-2FS6O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	29555
Entropy (8bit):	4.736358243298655
Encrypted:	false
SSDEEP:	192:B8QIzRFIvGWrderPcG2KrEGlFfub7vRSnkUCsBBjZzujuOczd83EwiiISa:6vwr4rPV2KxlFoSnkfsnjZaj3iiIR
MD5:	CEDC364670DA1CC03B86381665BD196F
SHA1:	2B0129EA03CE8F9C7244B1244458C1E8945122AC
SHA-256:	9C623D355427CF189CE35FB536932234AF2F5DA357F71A4F1CA9FBC2A8801EF0
SHA-512:	34821CE033B9A41B5A195E47AA2CC42C49263373B2DC0A19F458858F36F057FC07900D46A6FC83B936D09E37F384EC31868D66BC4724C8B16A3E3C6289A6B766
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="SkinForm">.. <Part id="0" Name="Form" Style="1" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <Region type="Auto" />.. <Margins Left="12" Top="52" Right="12" Bottom="12" />.. <State Left="469" Top="96" Width="52" Height="106">.. <Margins Left="13" Top="49" Right="13" Bottom="56" />.. <DestMargins Scale="True" Left="13" Top="49" Right="13" Bottom="56" />.. </State>.. <State Left="469" Top="96" Width="52" Height="106">.. <Margins Left="13" Top="49" Right="13" Bottom="56" />.. <DestMargins Scale="True" Left="13" Top="49" Right="13" Bottom="56" />.. </State>.. </Part>.. <Part id="1" Name="Caption">.. <Position RelPos="Top" Scale="False" X="16" Y="20" X2="32" Height="16" />.. <Font Size="10.5" />.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="0xff646464" Style="Bold" />.. </State>.. <S

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-2IK1A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	36826
Entropy (8bit):	4.840471877048546
Encrypted:	false
SSDEEP:	192:w8ggrR7IrWJr6Y1q1wNCkV8U1pnChhP86cevaXlHeu73J9ACGNjTWIxeb3g7OrsC:HrF1q1wNCkVmDCMnXu4I
MD5:	E0AF0A9138F05AF3914E05CE99628205
SHA1:	21C01F2B64BE62916EB8125B0696B73EF42E0B06
SHA-256:	6667E0FFEE247C2B700C0FEF6EC1516FF1931AE57FDAFAEA89DA49D5D3E1D709
SHA-512:	71E94ABC546C2DF0E44F011FD5A14185B6B40AD48A53FAEE2F67E19253D26234CD0A516D5BCD6F99CEE1A53C921C11DFF86D72B1747924710F2F72D0F4DBEEA6
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="MainForm">.. <Part id="0" Name="Form" Style="1" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <Region type="Auto" />.. <Margins Left="8" Top="10" Right="10" Bottom="9" />.. <State Left="72" Top="107" Width="162" Height="97">.. <Margins Left="131" Top="80" Right="15" Bottom="16" />.. <DestMargins Scale="True" Left="131" Top="80" Right="15" Bottom="16" />.. </State>.. <State Left="72" Top="107" Width="162" Height="97">.. <Margins Left="131" Top="80" Right="15" Bottom="16" />.. <DestMargins Scale="True" Left="131" Top="80" Right="15" Bottom="16" />.. </State>.. </Part>.. <Part id="1" Name="Caption" Visible="False">.. <Position RelPos="Top" Scale="False" X="26" Y="8" X2="26" Height="16" />.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="0xff646464" Style="Bold" />.. </State>.. <State Left="

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-2PNFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5515
Entropy (8bit):	4.834575301968821
Encrypted:	false
SSDEEP:	48:cov/cZq89mMzxixe3oKKxhRHlGwLLLIGkULLL7GwLLLCGqLLLmaSIm3A2ypbYnfK:0c8gSofzRFse+uQY6ej3Tl+68J
MD5:	4DDDF9DFD88D30EEE893B510489F2C00
SHA1:	E78077C94188DBD8A4E73442C3ECEAAF93F4E837
SHA-256:	5679AABFC680DCEEBD92D25666E817EA4E2D0C0C3D98E9D0E940BC553D847D6A
SHA-512:	D675BFF732AC8A036B1ED42FC86FFDBDCCFBFF3980E7F5A0E0487EDEBD061E722837043BE8ABA1793E5D3C8D6E7945DA8A2E62A4A03ACEF7C1559F526016E400
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="waitTransferForm">.. <Part id="0" Name="Form" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <Region type="Auto" />.. <Margins Scale="False" Left="5" Top="5" Right="5" Bottom="5" />.. <State Left="289" Top="114" Width="101" Height="58">.. <Margins Left="15" Top="26" Right="84" Bottom="27" />.. </State>.. </Part>.. <Part id="1" Name="Caption" Visible="False">.. <Position RelPos="Top" Scale="False" X="26" Y="8" X2="26" Height="16" />.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="0xff646464" Style="Bold" />.. </State>.. <State Left="0" Top="0" Width="0" Height="0">.. <Font Size="9" Color="clBlack" Style="Bold" />.. </State>.. </Part>.. <Part id="2" Name="Icon" Visible="False">.. <Position RelPos="TopLeft" Scale="False" X="8" Y="8" Width="16" Height="16" />.. </Part>.. <Part id="3" Name="Restor

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-31NV3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 7912 x 204, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	221519
Entropy (8bit):	7.990344205543906
Encrypted:	true
SSDEEP:	6144:svyv1qZaWhQ1oMxhdra4c2GbHbp2if2GV8AiDmM:YpZa11o4apxbgi+GV8ASmM
MD5:	4B3D92DBCE1A698DAE34E7F8F732F0BB
SHA1:	7D46960A76C003F433340220BBB9FE36D61C036B
SHA-256:	E3A8C4912CF0C607FFF72C347201E53BE17EED937B1394DE2FAD6B2F4B5B9F5C
SHA-512:	46AEEB22C5835A1B2E7B0EAF408D63A843A788F5E9BB30AF5C4F21EAF93DA6F8E5DFB111A239289023FC4A1797C869166E8EA7E86A71499B5326D78C34066AA3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................PLTE.......................................................................yyy.............z..........vvv...............wsp.........xvu...vvw.............zzzsrr.......sss...........utt......\|\|\|......www...uuu}}}...........}}}}}}....wyyy.._\|\|\|...zzz.I......}}}................................T....................?...................Z.>.....F...B..O@........#....}........^..R......Z....!........:..j......{.n.......S.........z...\........5.....:....................(..?..C.................0...........-.......}...#........J..P.....T..G...........M.....X...............................................................................e............................q...p..............T.........c.....................................tRNS.......'.$.. *D.?0-J.O3;.T8.6.Xjp..\ae..u...m$.F...4...F..y.Z.\|./.{.j..............[..(..p.?Y.Y.>.n..A.?V.9...&..xZ.#..m.....B..........a......]mIDATx...m..0...CBb.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-3KK38.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13527
Entropy (8bit):	5.25652264096273
Encrypted:	false
SSDEEP:	192:Wai9ZrWcUKtbJn2CqkDKBq9g3gtuDcZqfVGlo/y50zuytSPPwBqssE1fcjqJ4X2t:Hi/hO/
MD5:	40CD09EB6A36C3E3787FB5AE38A858E0
SHA1:	22BEF5C79C1988BDE9824C3A5CB9561B63FE7E72
SHA-256:	04A0272A4D858B2B6B5F0D9E91ABD883B41A281F8D0800074B493BB3831703CA
SHA-512:	B22AF7F785095870AEB8D6E36859BA577ADC871EC059493E85CB139A331F7B4A32313ACC8F58B8EB086E1E660FE74EB79C68DD345B752083E0C1CC149D382D15
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. Save for Web Styles (.....png) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:1920px;..height:40px;.}..#x4f20x8f93x5408x6210-01_ {..position:absolute;..left:0px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-02_ {..position:absolute;..left:40px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-03_ {..position:absolute;..left:80px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-04_ {..position:absolute;..left:120px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-05_ {..position:absolute;..left:160px;..top:0px;..width:40px;..height:40px;.}..#x4f20x8f93x5408x6210-06_ {..position:absolute;..left:200px;..top:0px

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-3R4BD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	7846
Entropy (8bit):	5.23448861983268
Encrypted:	false
SSDEEP:	96:4V/u3/4S/eiK8lKr3KWQK9QQHKvkK5SKCpKn/IqtTGobRqsiRS6x6uRJA8fWe6Ff:4dkbvdHJ2Gf
MD5:	356E48CE70E83F085162B5AC5A8E4689
SHA1:	A2E37D3E0A2EF7C54C57B0F51FD40CE3C2ECEB11
SHA-256:	D58A66F74B6D39ABA5D994F4C5FB2AFD9318F1EF648A11BC52004275663206D1
SHA-512:	E0090D205C937F146A4DB80E18DFEB894CECA23D8ACB81D484010F50274AD4ED0EDDAE635487141FF07E11CAD5D72C14FB8D718DCDF0CCB39634B713F9F565A2
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>Instructions</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (Instructions.psd) -->.<style type="text/css">. ..#Table_01 {..position:absolute;..left:0px;..top:0px;..width:1205px;..height:932px;.}..#Instructions-01 {..position:absolute;..left:0px;..top:0px;..width:1205px;..height:15px;.}..#Instructions-02 {..position:absolute;..left:0px;..top:15px;..width:18px;..height:917px;.}..#Instructions {..position:absolute;..left:18px;..top:15px;..width:50px;..height:50px;.}..#Instructions-04 {..position:absolute;..left:68px;..top:15px;..width:50px;..height:50px;.}..#Instructions-05 {..position:absolute;..left:118px;..top:15px;..width:50px;..height:50px;.}..#Instructions-06 {..position:absolute;..left:168px;..top:15px;..width:50px;..height:50px;.}..#Instructions-07 {..position:absolute;..left:218px;..top:15px;..width:987px;..height:100px;.}..#Instructions-08 {..position:absolute;..left:18px;..top:65px;..width:50px;..heig

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-5U5RB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 589 x 2720, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1171475
Entropy (8bit):	7.992754767199659
Encrypted:	true
SSDEEP:	24576:piyZumWPg781slc8JwB0IEfVX8ia4L+jKsmmT627zX5zs:EyZA47wslc/OIEB8ia4ijKr2q
MD5:	15025A5BB6C7DA527CC7F600C83BC405
SHA1:	3D6BDC6C471D39A699E7BD20091626EA6E8C3680
SHA-256:	787F1CBA3775805C57405A2D1FCB92577BEA44C2EAD536EACBF85236598016B4
SHA-512:	6CD0EF4182425CF6EEF99F6D337EFAD05A9D7F4E92361576E7C655C6E16B6ED3A80CC3EC481E270E27BC934FC80F3CF7EE3548B446786DC2D988F5DCE4E31745
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...M............c.. .IDATx..w.]Gy...9..]..lY.%..ml.;.b0........@BI.I..`0$.o..fb.8.7\q.l.X..VeUV.....2....{..........S.<g..S..(..2.(..2.(..2.(..2.(....1..Z.3.2.8i.!FvXq..O....+.;. .#.}U.Nu\|...,U...6V.AY...F....Z.3.2.x.(L,.....cMx.:.T..fx.RF...QF.e.T...G.........c4'.7.{.2...2.D(..2.h8Y..h.K=..fy.RF...Q..e.TF.G.&.7".,.Y.(..2..#.g..e.....w.....=K..oPF.g.eOS.c.z..!..sJ.tl.0..z..g)....(..r.2..Jm)....J...9..K....>.uv.ot...;.....$9.N.&.....%.c......<~8)y..\|.e..0VjX..=.;Wi.KkF/c.q....]...#......z..V..t.v)+..G....D...1..k..T.[N./.r..Z=.#...-....>.dv$.w4..~.x.u.e\|"...a.=Y..h..H.?.7=..L...G.X.....88.}.wm.b,.c.Xd...[.8I.(i:........y.....H.v..k....'"....#..t.d,.....xc.X..Xr+%....y...O..88......h..._.CT.).L..;.....m..u..3..>.3Fz!N....>..cy..o.........#..:q2.....W.....-...D...8Q.....M...G..D.}.a4t.k..X".e.f......Ne..M.W).d.n'..;..v~..T=.'...v.h.L....J....D.v"...9.2>..{:..F..F...29.U8.i.#~..l}.."?.8.^..}$...py.... ....#..T.}...I....H

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-68N6K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1920 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	24101
Entropy (8bit):	4.787657887290745
Encrypted:	false
SSDEEP:	192:jS/kt1+VE2U9WVaZXW+zgRl3WuaC7zHegFWNIGJTR13DJORpKxkVd:Wst1+VE2U9WgZGEiBWSv+ZNIm1FsL
MD5:	FD5D3622DF1C4B5356326C782670D533
SHA1:	608F470BE9798F655B47A3AEAD55D5E7FADCCEE9
SHA-256:	B366EA73A6B4EA78177A22C8AD3931BDFB7521F606238590BB50802B36B1922C
SHA-512:	8979BFAE953E2FFC8820A86A89786CE91D174FFCC8FB0EC43735A32443B269EE518D4FCF4CBFE814E13B7594CF7714B6B1FA64C86F83B5CCE6F92D3DC617782D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(......J......pHYs...............8*iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Macintosh)</xmp:CreatorTool>. <xmp:CreateDate>2016-12-05T06:02:46+08:00</xmp:CreateDate>. <xmp:ModifyDate>2016-12-05T14:15:24+08:00</xmp:ModifyDate>. <xmp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-7SDP5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1500 x 1400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	936804
Entropy (8bit):	7.995236125937523
Encrypted:	true
SSDEEP:	24576:eCcKVyh02hJkPtG1JbPqp/JP7BXPeg4QritdjXsLsMKNfh:eCJyh0ikgHb+JP7hPegxitJsAMKP
MD5:	453989E991DB403A456FEDA4B90AEE77
SHA1:	AC5C7C047DA0228146B4E22C9647069A26AAED43
SHA-256:	DFEA7AE194735B289E31A2679531EDAC3B2F0ABEAAC09AF6DF56F51293EFF78D
SHA-512:	BDDDC85D1EBF6385E943459D299FFDD2C6F5A4D854BCD2053AD6998FDB5BE65F3BA8D4286F4F2C87FC2AB9850E9F174C63EA200085E10133CCCAA39135758D8E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......x.............tEXtSoftware.Adobe ImageReadyq.e<...siTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:93246b56-7bd2-4591-a16e-4f5a1643df9c" xmpMM:DocumentID="xmp.did:0A7B2F9905CF11E69846901317E4037A" xmpMM:InstanceID="xmp.iid:0A7B2F9805CF11E69846901317E4037A" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:66e62c5c-104b-4b13-afd1-794bd56f52df" stRef:documentID="xmp.did:93246b56-7bd2-4591-a16e-4f5a1643df9c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......G.IDATx...`TE..o{.M....t......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-8FOAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4846
Entropy (8bit):	4.817376292428456
Encrypted:	false
SSDEEP:	48:coaiVsPHYKTWenZvktHWiI9ubSo94Y1iTPIMK0Yf+OQQmHSQHdQ:uTkt6/9Q
MD5:	D38CF7F420DAF08F154F0FD10C11780E
SHA1:	991EB586A28DE5E936BB376B800237BAEA1BDA5C
SHA-256:	CFAE5D757A37119A3237F1D5EB80600314F9BF1036057FE405AE1BAF8E11822D
SHA-512:	FAA2E832F790EAA93F3BF4A94D0C6B596E674559170583BE0E1865DD6503606DFC37C278322503F74537B5982748402180E02B5BF43E4C5A2379A8317390B467
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="SupportSite0">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="SupportSites.png" />.. <State Left="34" Top="77" Width="46" Height="46" />.. </Part>.. </Item>.. <Item Name="SupportSite1">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="SupportSites.png" />.. <State Left="87" Top="77" Width="46" Height="46" />.. </Part>.. </Item>.. <Item Name="SupportSite2">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="SupportSites.png" />.. <State Left="140" Top="77" Width="46" Height="46" />.. </Part>.. </Item>.. <Item Name="SupportSite3">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="SupportSites.png" />.. <State Left="193" Top="77" Width="46" Height="46" />.. </Part>.. </Item>.. <Item Name="SupportSite4

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-8QRLF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11348
Entropy (8bit):	4.822067181534186
Encrypted:	false
SSDEEP:	192:i9UsSIcniOebzdE+tIVb5OGB5L8g5IzR7lkNb:h+tIVtOGBev0
MD5:	5CCE26C974F28E3CD20EFD0660D65AD2
SHA1:	FDF88979FA53BF9FE6917D696C288165492EA727
SHA-256:	1387519CCE0D1D6813E82B4049571533AAC2D1EA1BE63BB0639898FF1DD4D80B
SHA-512:	0538F7FFCBABAF2F4F65EFC5D702830C3E2690E61CDAF11146CF70AE4ADA2A666B89F8E6194ABDE523EFA2035D9EA5DD48CD4BBA0CA4AA8CFEB8E46BB036DEC6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="btnPre">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="Play.png" />.. <State Left="233" Top="69" Width="30" Height="29" />.. <State Left="263" Top="69" Width="30" Height="29" />.. <State Left="293" Top="69" Width="30" Height="29" />.. <State Left="323" Top="69" Width="30" Height="29" />.. </Part>.. </Item>.. <Item Name="btnNext">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="Play.png" />.. <State Left="245" Top="104" Width="30" Height="29" />.. <State Left="275" Top="104" Width="30" Height="29" />.. <State Left="305" Top="104" Width="30" Height="29" />.. <State Left="335" Top="104" Width="30" Height="29" />.. </Part>.. </Item>.. <Item Name="PlayProgressBar">.. <Part id="0" Name="Frame" TransparentMode="Alpha">.. <Graphic Name="Play.png" />.. <State Left="373" Top

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-92UJ4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1920 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25049
Entropy (8bit):	4.9309471608672215
Encrypted:	false
SSDEEP:	384:WstDaCKk7slOhbMDEnBs/rmg5zVCCrjbiQ:vteYQ4hYAun5BCCPbiQ
MD5:	B989180705873F7B133FB4E1C7D2AFBE
SHA1:	6392B9F2BCAFE6425BC241F983B21EB127DF7E1F
SHA-256:	367E9D1E6D743F00941414CA552F179FB2264E560066045270FCBD336010E498
SHA-512:	08E1A7F28B8A9AE42B8CA9F291F3AA0D8833F9EA40913C60B59BB68213B89439E0EF5610B13989006E78578097816D95ACE425EF5B1EC09D3A23ADFF74E5FBAF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(......J......pHYs...............8*iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Macintosh)</xmp:CreatorTool>. <xmp:CreateDate>2016-12-05T06:02:44+08:00</xmp:CreateDate>. <xmp:ModifyDate>2016-12-05T14:14:55+08:00</xmp:ModifyDate>. <xmp

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-9MMBT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2194
Entropy (8bit):	4.829570024692189
Encrypted:	false
SSDEEP:	48:codtC2g2A7232xRtoyAFhxtxtOwAHbxxt82Alxx2G3/wH+:62g2A7232KyAFhewAHb22AlxCe
MD5:	A57012EFE8965C829786E2C54B94F9FD
SHA1:	C34A8D0BA9FB4F005B6DDA952936D447C68FC187
SHA-256:	62EB0DD9B67B70928FE652DE8994575EBE1A735E2C7A10A4E4CB4504F3F6E300
SHA-512:	1DE4CA3DC493C2A98F3268A0762BC0447027ED23B581F7A4B8327C2D9F4F6CE61F1B55D4A69C7769219CA15C663F4FF6C98C489B36ABF2D4B98AA0697BDB140E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="BtnHome">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="129" Top="486" Width="28" Height="28" />.. <State Left="158" Top="486" Width="28" Height="28" />.. <State Left="187" Top="486" Width="28" Height="28" />.. <State Left="216" Top="486" Width="28" Height="28" />.. </Part>.. </Item>.. <Item Name="BtnBack">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="129" Top="515" Width="28" Height="28" />.. <State Left="158" Top="515" Width="28" Height="28" />.. <State Left="187" Top="515" Width="28" Height="28" />.. <State Left="216" Top="515" Width="28" Height="28" />.. </Part>.. </Item>.. <Item Name="BtnForward">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="MainForm.png"

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-A7LE6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 781 x 394, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	43981
Entropy (8bit):	7.945709131170903
Encrypted:	false
SSDEEP:	768:3H0ejgnhe8FbGwXDU/BpTFGhPxl7/tGY183CtkngBLZZ:36Q8hF+HeP/M13CvDZ
MD5:	62DCEE4268496C723B627683504A65A5
SHA1:	EDDBA8FE85A9A74744ADFA9D3D688381424A189D
SHA-256:	D571A9AECBD2BF4D40FE97AB4BDEEA3EBE49AB44C44D7998397382BA7A0822BF
SHA-512:	2282D9409D90D39C5AF957ADB76494BEF75540A7754A80D8EE43EBBE7A6E32D23BBF91299016EF0E3306F180DB48654F4D719E7EE885D4FBEA1EE8874DD5C4E6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............N......tEXtSoftware.Adobe ImageReadyq.e<...giTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F7777B9D3F206811822AE92A6C9DEA14" xmpMM:DocumentID="xmp.did:DAAAC5FACF6C11E4BB68E94A2864D510" xmpMM:InstanceID="xmp.iid:DAAAC5F9CF6C11E4BB68E94A2864D510" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EE4AC125CAF711E486EEA5BDF7AAC3A8" stRef:documentID="xmp.did:EE4AC126CAF711E486EEA5BDF7AAC3A8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>E..X....IDATx........I.,[....bCE.("vT.z..".kA,W

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-AAF1P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1205 x 1600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	167704
Entropy (8bit):	7.934788657942961
Encrypted:	false
SSDEEP:	3072:VDoco4OZzqJU3AQ3Y+4jKuJwm4Tl6n4Sp0SAq6Tf4ToaBRTIiBjz:xyZzqJAY+4jtwDG4w0y6c9bTIiBjz
MD5:	4558AB28E891CB5F7304DBB066693772
SHA1:	E7B91513A39A2E55C56B4535F599596D1272C91B
SHA-256:	F4D646490F6BEEB22A46C27A9816959069B52AE7BA950E94D5AD25BC177DFD61
SHA-512:	7AF4B7DD40EF45E9DD13C2C8396A7A439B2CB61CC56990443EDC351A1C1DF4D7D631E67DEE10EB58FE6DCB7C03CA9A6E2F1F77941C466E342127EA409EFA3731
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......@.......p.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-B1FV3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 633 x 289, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35253
Entropy (8bit):	7.944914254275826
Encrypted:	false
SSDEEP:	768:ersS4F42BDQZAZxW4ATDBGdpdVd1I66J2YygfXUdp3he2:HS4F4KxDJATDUdbfEJcgfXo3r
MD5:	FDC0A760D95A3FA51062C8D8F914872F
SHA1:	7255664DA44C9F5E169E54B9F81B151D4EE5F07E
SHA-256:	AA0D4353C6D01292C75E07FB3E51CE236F3CDF91B9FC0FFB182532E6692A93A5
SHA-512:	0716158B58587FDADD005ABD23FB169A25328869D3B6B6687FF5539831E09D4BA9E5B85C96A9E1CD7885BE733A328DBCAEF8C039CB9E96D66C469D3D3F50210F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...y...!......<......pHYs............... .IDATx..yxT....n.d_HB......"......V........].Zmkk[.m..Z..XPP.".....B....@.e.....w.C.If&../}?....{.y_....s..~....A..A.D.B... .. .. "..<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. .....K...X.~.z.......:....-.>.....tn.Q.8vGi..U.~.u....=..c..(Bm.".f..z%Z.....eDF..V.]............=PT..Xyu.Z.'....Yj..Jm..c..$....-....M..In...0b..l.s+..s.2.t.:c.%..S..zA.....(7. ......9td..,.0.........(.....H...@...Z

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-CDTP0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 534 x 296, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26634
Entropy (8bit):	7.950122865042636
Encrypted:	false
SSDEEP:	768:0QSi7zd742Z+/Rxbgg7SN8OSR4l4yZLRlF+g:0QSqd82+BQSGO0nFP
MD5:	F4D30A703138A89B3BCABB93C5D2C641
SHA1:	644E257EF78EC6A81CA350C4C849340D28A8E012
SHA-256:	1333FE1DDB8D6DF84E780B8ADD34EC6653F922640E65CC3825236D4B15FED499
SHA-512:	28ADFA9F10363C94B7804CC208E527BFB4AFDDC0893C1236EBE0F59774B66DB7BD530543FE575B2DB8C84BAF5998643A3E66852EFCFF2E39D4616C03E799C731
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(............tEXtSoftware.Adobe ImageReadyq.e<...ziTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e6f266e3-7ba6-41e9-8795-6fe12523b5ca" xmpMM:DocumentID="xmp.did:76CAF8FA9FFB11E68FF6AC6959A19A33" xmpMM:InstanceID="xmp.iid:76CAF8F99FFB11E68FF6AC6959A19A33" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fc72e23a-544c-4924-942c-360111a5dca8" stRef:documentID="xmp.did:e6f266e3-7ba6-41e9-8795-6fe12523b5ca"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Z.....d&IDATx....\.....q.{r..(

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-CUFIC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 94 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4284
Entropy (8bit):	7.921705976234661
Encrypted:	false
SSDEEP:	96:DllcHitlIxv9vk7C1+I4wWHLihk/xNbwwiOSUvmc5SM4n:QIIHUCD4waHbwhGE
MD5:	FB46664AE3F903038AA92A04B88A7BE1
SHA1:	2565FB78DCB231A710140148CFE0D1C682EE7112
SHA-256:	6D21424BB92976E74B68E149FB748C24D5C35E59379724A25B89ADD7BC01DFBD
SHA-512:	E8FDC64A148582D287F64166840F81FA53681F2D3ABA836E07B29CCDEA553812BE222DF732F0FC5502B728697D64572C0F8B88A3A552947490FBBC3496C2994C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...^............r....pHYs..........+.....MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-DSVMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3982
Entropy (8bit):	4.915183637013446
Encrypted:	false
SSDEEP:	48:cohYLWSfY2WSdYYYWSRYHKWSZLY8Aj+Y2AjiYYYAj8Y89j/Y29j9YYY9jxYHK9jx:KOAT3HoUbyTBFAT3HEILqTZHKM
MD5:	3A70E35CA61ABE34CEEE8D3B7FC9008E
SHA1:	9BE70FD35AC7CFDECE9C3F09617E23AEAF5CBF5E
SHA-256:	E06D43355810ECE07B4C1646240448341C7F399CFC5455DD0C66DA2D3B92EE1F
SHA-512:	A08A3F2A89B87CD0A9C33F2B79F2A88E662428877DB1F966A0955FCF3B249426C2BE7BA77FC9123DF76527B5323733812DE83DD52106EE41690E9A91F0F83BA4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="imgDebugVersion0">.. <Graphic Name="pic.png" />.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <State Left="30" Top="30" Width="190" Height="317" />.. </Part>.. </Item>.. <Item Name="imgDebugVersion1">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="pic.png" />.. <State Left="230" Top="30" Width="190" Height="317" />.. </Part>.. </Item>.. <Item Name="imgDebugVersion2">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="pic.png" />.. <State Left="430" Top="30" Width="190" Height="317" />.. </Part>.. </Item>.. <Item Name="imgDebugVersion3">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="pic.png" />.. <State Left="630" Top="30" Width="190" Height="317" />.. </Part>.. </Item>.. <Item Name="imgDebugversion_3_0">.. <P

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-E7B24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13527
Entropy (8bit):	5.258625900025772
Encrypted:	false
SSDEEP:	192:UaAPxL8yguRbA324gID6lIbwjI9S3cRm7dmxMfSl4ju+1WPjARWOOsdLoDSt0n+L:hAJeO3
MD5:	6E446AC2FCFB4B905C68D03C44D10EA3
SHA1:	04165FED6545A5CF558877088869A42DFE22F1CF
SHA-256:	ADDF5BABD346499893B3C11FF8DB04D4F6A71461A5694A1D397CA338B254F860
SHA-512:	F08E36E039A01B54B6E411A075BCAB97D4B63DF09850E3C6CF2921B654DC99871ADE585305DE5F1771CF9F1BF3335A5C6EA74E656AB35A76911CBAAF3E178AB4
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. Save for Web Styles (.....png) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:1920px;..height:40px;.}..#x8f6cx6362x5408x6210-01_ {..position:absolute;..left:0px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-02_ {..position:absolute;..left:40px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-03_ {..position:absolute;..left:80px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-04_ {..position:absolute;..left:120px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-05_ {..position:absolute;..left:160px;..top:0px;..width:40px;..height:40px;.}..#x8f6cx6362x5408x6210-06_ {..position:absolute;..left:200px;..top:0px

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-ENKNT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1920 x 40, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	7.788489466854337
Encrypted:	false
SSDEEP:	96:EtIezmo75N97iB33DE6FzoH/fLUbUyYkVJ+KqVNTFMr2E1F:IIezX75Sh3VFAfYY+VJ+XNTF/E1F
MD5:	1E649B1011948206021613F2538F46FA
SHA1:	E9F1DC24E3A85E24D77E2075EC48EADE970179E9
SHA-256:	3B0B5C2D86E4BB572992F1991445DD16A1B82628515121C2B48A25D1A85BE966
SHA-512:	24A14AFB9BBE31A5DBC85E5673EB60A638FADF3BDE5C475139547594519348CB422EC53A21B41F8659CA2BA35D177CFAADC9520C20E041FC5BB4198953CD79AD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(.....(.......PLTE....................................................................................................33...........................................33.......33.............44.......33.......33.33.......33....44....33.88....55.......44.......66.33.33.33.......55.88.44....44.33.44.55....44....44.44.......33.44....33.......66....44.44.44................>>............NN....44.ZZ.aa.QQ.gg.~~.oo.GG.......==.................E.....{tRNS.....4.....1..;x.......%l.6.AW.g....b/..........B.>}.s......%.'....a..~RC5..OF.].....t..lX.G......K..#..O9.D....=qQ....tIDATx.....@..p...{.....XP.8..(3.......E@...&O}..G{!....u\..o..<.&..%....S.b...$1..1I.0HN..4..y&..FvT.P._.(pM.K.u=.F.V..^.......gn.C..Pg&K..m.5Q....o8^....Z.B.w.d>.n.n..+vq..jU...N.7...z.....V..j..iE"...e..h/.....\9.;.Z....Aq.8o:E..sz9.o6_*.q.g.]...8<_.}.wb.U. F3.n.XB......A[D......&gf.u.&.Z..a...V...K...\|3!.E....:..%.0.}...-.._.+.."..r.6...6W..w..i..Lp..8R.....

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-ERN7G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8802
Entropy (8bit):	4.831823982385328
Encrypted:	false
SSDEEP:	96:bmOQ8gSofzRFseGYDPqpGghYn6FNyQ2wzjmBtl:bmh8gSIzRFseGFB29l
MD5:	C4D3E922B75B8693E8D837FB5D7EC15A
SHA1:	E2ED4E51495CBC53921A01CF55B6B034BBD6840F
SHA-256:	1A5BB8F60A618E38C9D209C4249748490BAE3744164F62AC63C26822DCB99E48
SHA-512:	6349EAF9E1395647A10B968978B821271E1D47E00BC97FBCF6D28EB4F6DA3F8CDA695F19F94BD55902E09C5BBE748D19E31A070741C1B0F62F03C2F8E336792E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="imgFormatFrame">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <State Left="0" Top="0" Width="0" Height="0" />.. </Part>.. <Part id="1" Name="hot" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="851" Top="419" Width="127" Height="183">.. <Margins Left="39" Top="67" Right="36" Bottom="81" />.. </State>.. </Part>.. <Part id="2" Name="press" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="978" Top="419" Width="127" Height="182">.. <Margins Left="51" Top="65" Right="53" Bottom="52" />.. </State>.. </Part>.. </Item>.. <Item Name="formatSelectForm">.. <Part id="0" Name="Form" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <Region type="Auto" />.. <Margins Scale="False" Left="5" Top="28" Right="5" Bottom="5" />.. <State Left="661" Top="67" Width="75

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-FLFD6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	4.89567144245996
Encrypted:	false
SSDEEP:	24:2dojGv4Q324QlBl/4Q5lyZ4QRJe4QUsNJpZ4QMDW4QoDP4Q8967jIr:cojMUjfwdePjX36FH8
MD5:	3B24D82CB24AF90EC29A9DC54F701A47
SHA1:	87BE6E53AF344B2CBE32675211107BEA5C338971
SHA-256:	AFD6E25803DC89515D274E8E9DC500EA5BAA0356EEB29CBC4ECC2DDAC225A893
SHA-512:	1D319E716F680F8EBEE023187D9EA558FBCB0CFD9E65E418B65F99CD698A1EE612C5CA9FDDEF1BFBD3706772CA8DB43072CAD521BE43875DAACC9D87E158F61E
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="ImgGuide">.. <Part id="1" Name="ConvertGuide1" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="631" Top="267" Width="264" Height="218" />.. </Part>.. <Part id="2" Name="ConvertGuide2" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="926" Top="267" Width="264" Height="218" />.. </Part>.. <Part id="3" Name="TransferGuide1" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="631" Top="494" Width="264" Height="218" />.. </Part>.. <Part id="4" Name="TransferGuide2" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="926" Top="494" Width="264" Height="218" />.. </Part>.. <Part id="5" Name="RecorderGuide1" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="Guide.png" />.. <State Left="57" Top="4

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-HKH1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10351
Entropy (8bit):	5.01938112085905
Encrypted:	false
SSDEEP:	96:xAk2vCI4UydEzFrEOllkCoXMFMSAsHYVd737gngbqd7d8lK+h4lwdMx/wLgzjxOQ:bVGPH2WGFYBfmM
MD5:	A2D100F028F0F59730EE3459A8B4E738
SHA1:	E243382AF358F012F05D37EF1721E8B35EFDC800
SHA-256:	40FBA113882FD4F16DBDF47B8B74A95348CE1277EF507518F1B1074013BF7024
SHA-512:	EE33A7451DFBA536F92BE39E2FD497BD520578107B9865C73CEFA4A05CFAA5DBED583E865BC41B3A1450602E17EB88908659B437434DB6E38132C25831CAEC86
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Graphic Name="ProfileIcons.png" />.. <Item Name="ProfileIcons">.. <Graphic Name="SmallFormatImage.png" />.. <Slice Id="IconAsf" rect="239,2053,74,74" />.. <Slice Id="IconMov" rect="239,1695,74,74" />.. <Slice Id="IconM4v" rect="161,2053,74,74" />.. <Slice Id="Iconmp4" rect="5,1695,74,74" />.. <Slice Id="IconWmv" rect="395,1695,74,74" />.. <Slice Id="IconMkv" rect="5,1810,74,74" />.. <Slice Id="Iconavi" rect="161,1695,74,74" />.. <Slice Id="IconDV" rect="317,2053,74,74" />.. <Slice Id="IconMpg1NTSC" rect="395,1972,74,74" />.. <Slice Id="IconMpg2NTSC" rect="473,1972,74,74" />.. <Slice Id="IconVobNTSC" rect="395,2053,74,74" />.. <Slice Id="IconHDTs" rect="5,1891,74,74" />.. <Slice Id="IconHDTRP" rect="83,1891,74,74" />.. <Slice Id="IconHDAVI" rect="161,1810,74,74" />.. <Slice Id="IconHDmp4" rect="83,1810,74,74" />.. <Slice Id="IconHDMpg" rect="317,1810,74,74" />.. <Slice Id="IconHDWmv

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-I90IT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	154673
Entropy (8bit):	5.210735921013266
Encrypted:	false
SSDEEP:	768:4I6ZHkuphca8ns+KwZv41NvN6TczPLtOeMWm79:7dKqvCN6TczPLtNMWm79
MD5:	6DC932E981277AEC10C391A97C34633F
SHA1:	2078CD24AE2D6F2D7B4FB935A46A33A840BB0387
SHA-256:	801F0658312BF672298E81B8AB27A8F9B61A92178A2378C65513002DA14014E6
SHA-512:	CF681CBE6B5C4208DA21A2374A2D4D8C17DB3F6DE6124D7D9F9933506AEB6BFE4B5695511C21FB9970E1AC2163CFF651568F67D27FD7689B363F49C0BE51464F
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>mainform</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (mainform.psd) -->.<style type="text/css">. ..#Table_01 {..position:absolute;..left:0px;..top:0px;..width:1205px;..height:1232px;.}..#mainform-01 {..position:absolute;..left:0px;..top:0px;..width:1205px;..height:67px;.}..#mainform-02 {..position:absolute;..left:0px;..top:67px;..width:661px;..height:29px;.}..#mainform-03 {..position:absolute;..left:661px;..top:67px;..width:75px;..height:164px;.}..#mainform-04 {..position:absolute;..left:736px;..top:67px;..width:469px;..height:2px;.}..#mainform-05 {..position:absolute;..left:736px;..top:69px;..width:37px;..height:180px;.}..#mainform-06 {..position:absolute;..left:773px;..top:69px;..width:102px;..height:122px;.}..#mainform-07 {..position:absolute;..left:875px;..top:69px;..width:330px;..height:6px;.}..#mainform-08 {..position:absolute;..left:875px;..top:75px;..width:211px;..height:28px;.}..#mainform-09 {..po

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-JJK24.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	26948
Entropy (8bit):	5.238250418609292
Encrypted:	false
SSDEEP:	384:EIrPX9bRmYtcL5MVXcsWGS2Tjvz3JbtD7V7kzj:ZNbRmYtcL0Xcsx7y
MD5:	0CC089CADFC3A6DF7C8A6D2DA6668353
SHA1:	3D2E87B4AB29A2400E36C068E1829F107FDFD79F
SHA-256:	C7295201A8765878091D28D802C2868ECF12F93D99698CE5CE0C3350483F2558
SHA-512:	CED7860BF16F0C73248AD3AEC809FF1C20FD6E5E65EA01E7D5DE95B51433F4E552B911FEEB105F1E3F8B3CE6C9A7F446D4A88704FAF000A8346FE70082EAD063
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>Guidancemap</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (Guidancemap.psd) -->.<style type="text/css">. ..#Table_01 {..position:absolute;..left:0px;..top:0px;..width:1405px;..height:1765px;.}..#Guidancemap-01 {..position:absolute;..left:0px;..top:0px;..width:1405px;..height:78px;.}..#Guidancemap-02 {..position:absolute;..left:0px;..top:78px;..width:74px;..height:189px;.}..#Guidancemap-03 {..position:absolute;..left:74px;..top:78px;..width:569px;..height:5px;.}..#Guidancemap-04 {..position:absolute;..left:643px;..top:78px;..width:762px;..height:71px;.}..#Guidancemap-05 {..position:absolute;..left:74px;..top:83px;..width:569px;..height:5px;.}..#Guidancemap-06 {..position:absolute;..left:74px;..top:88px;..width:569px;..height:5px;.}..#Guidancemap-07 {..position:absolute;..left:74px;..top:93px;..width:569px;..height:5px;.}..#Guidancemap-08 {..position:absolute;..left:74px;..top:98px;..width:569px;..height:5px;.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-KQMQP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	19401
Entropy (8bit):	5.229326792226139
Encrypted:	false
SSDEEP:	384:4AOTyGEENDKNqcMj/ejiqO2F/iONkFnV4sJ2kr4rRr+x4Uyq26WvrEYU6goqy6+x:+yGhNDKNqcMj/ejiqO2F/iONkFnV4sJs
MD5:	A1E0B6B63F51852D3FB879B1BE7443A9
SHA1:	A217F49132E87C1EA3F792530A06C756CCE450FD
SHA-256:	7BB2F989C426EC25E9B81B8CBA437AEC8E6C121FFA4322D87A19E4C1E5C65D1D
SHA-512:	6B10B00B6293D4AD373874984316FE164B9F214A8DC16C8753A70C4681E1344C3F25E0946A6A65CC153733CB2FF87DE01A6A60D5D4B22062769C91B8FBA69391
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>play</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (play.psd) -->.<style type="text/css">. ..#Table_01 {..position:absolute;..left:0px;..top:0px;..width:633px;..height:289px;.}..#play-01 {..position:absolute;..left:0px;..top:0px;..width:633px;..height:59px;.}..#play-02 {..position:absolute;..left:0px;..top:59px;..width:76px;..height:45px;.}..#play-03 {..position:absolute;..left:76px;..top:59px;..width:39px;..height:39px;.}..#play-03004 {..position:absolute;..left:115px;..top:59px;..width:39px;..height:39px;.}..#play-03005 {..position:absolute;..left:154px;..top:59px;..width:39px;..height:39px;.}..#play-03006 {..position:absolute;..left:193px;..top:59px;..width:39px;..height:39px;.}..#play-07 {..position:absolute;..left:232px;..top:59px;..width:401px;..height:10px;.}..#play-08 {..position:absolute;..left:232px;..top:69px;..width:1px;..height:58px;.}..#play-09 {..position:absolute;..left:233px;..top:69px;..wid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-L952C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11075
Entropy (8bit):	4.852400944895557
Encrypted:	false
SSDEEP:	96:+eBvDvidl+HCijldzlUL4vTcEMX2EVY4mR7Mp+VbXlMx2elpPnyZQ0p+:iT
MD5:	E19AA44DA2D3DC9B8A9A369FC3689F24
SHA1:	DBEC608C5CE3679EC7E91C3BDD93F968A398A4A6
SHA-256:	08F61C5F5D579CDF32566A6AB69D8F26BF028D610BDE5CF7448118746DD03902
SHA-512:	A31E2A5C8317496165C09B04C0588266C4808D119497ECAC1D2BCE17242DC9DB097D8EF7A563D39A87438EF3AE9CFA3F4DE2F864D3AD3E53D9D45611B510137E
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="IconMP4">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="SmallFormatImage.png" />.. <State Left="239" Top="1891" Width="74" Height="74" />.. </Part>.. </Item>.. <Item Name="IconMpg">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="SmallFormatImage.png" />.. <State Left="317" Top="1695" Width="74" Height="74" />.. </Part>.. </Item>.. <Item Name="IconMOV">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="SmallFormatImage.png" />.. <State Left="239" Top="1695" Width="74" Height="74" />.. </Part>.. </Item>.. <Item Name="IconM4v">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="SmallFormatImage.png" />.. <State Left="5" Top="1695" Width="74" Height="74" />.. </Part>.. </Item>.. <Item Name="IconWMV">

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-NPVG9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 318 x 83, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16042
Entropy (8bit):	7.963506286823883
Encrypted:	false
SSDEEP:	192:2potGfri2N1I71EXLaSkE83rFY7+hOmHJansJRF8IccznhZA14xIftYRPssWRjr:APO23I7C2/9YMO0vTF8Iccj+0KtYFJqr
MD5:	87858E205B7D46DAD12962A92E867A1B
SHA1:	2DCF60D63C3A8672E030EB7DC34B2218F6BB0177
SHA-256:	EF3D34EA7BBF4D85815AF448B178C95E016EA7A7F73E33A645A493EB8B08E350
SHA-512:	9F593F90B0A50069FC8E232626381B53CFC38C499F75214BB215F5293779C81DBD1A50C6CCA86C421AA1D9CE8110B2FDF2FB6A58D640264D5005437314C3DF37
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...>...S......%k.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a6afa1f8-2527-4354-8a80-38bca9f2a77b" xmpMM:DocumentID="xmp.did:5B053F7ED90311E89D9693CE6517A5F2" xmpMM:InstanceID="xmp.iid:5B053F7DD90311E89D9693CE6517A5F2" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c95e305d-0b65-43db-bfbf-858d553856ac" stRef:documentID="adobe:docid:photoshop:b48f5a09-2163-117c-a8fc-b7944222f4cf"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>$O\...:.IDATx....

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-NRNL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13527
Entropy (8bit):	5.256721441016642
Encrypted:	false
SSDEEP:	192:BkaiZJTaM4Gtb/F0oa2ZIrw9i9C/MJm7AVX0fK1A7Wx843sP9aroMe2PteBorqdc:Bxib3wd
MD5:	9734795701ADD24907EC0A9F7C951651
SHA1:	A0CDC08AA340C11D6FBC75DCD9954F85AFA2C769
SHA-256:	B59CD8B5277FA4014DFF39F340B855C4E55F89070EF83F664FCC3ACB9BDA8E49
SHA-512:	10B68C9A5FD5812C03F886E1F653799F97BA5408313E0F539B4EC79AA3E580FCDC427D98E31B7AACDCA3FDD533696AEB115D76179D7CDC6A8F4C80600346F825
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. Save for Web Styles (.....png) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:1920px;..height:40px;.}..#x4e0bx8f7dx5408x6210-01_ {..position:absolute;..left:0px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-02_ {..position:absolute;..left:40px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-03_ {..position:absolute;..left:80px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-04_ {..position:absolute;..left:120px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-05_ {..position:absolute;..left:160px;..top:0px;..width:40px;..height:40px;.}..#x4e0bx8f7dx5408x6210-06_ {..position:absolute;..left:200px;..top:0px

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-OFUGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1205 x 932, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	368308
Entropy (8bit):	7.994457042343119
Encrypted:	true
SSDEEP:	6144:JE5TL8lH+g/e8L3FOCFlgUMhI1+gaj2da/DqksAmdzrIUqvrmuWNMe6f+PEE7nYj:q5TLaHh3kCFlDMhI1+ge2+D/hmdfId1/
MD5:	91D1F4DD4A4E58FFB475B11CAEF56A0F
SHA1:	AB2CEDAFEDF34C022EE3227DCD0524BB4CF468B5
SHA-256:	BD063FAB6E5BDE32FB0F88199CBA65609AB35BAA57EFEE0A443D5F4C3E435FC1
SHA-512:	20DEC6585C4417EF740BE9B3E2AAA24785FD21AEEDB4CA8FC3209EAD6AD59BEAECC800E61ADACB821DDEC933E1624B2A407D386C3F2E39134EAFE5CB563B0B94
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............P.......pHYs............... .IDATx...y\|T..7..9s.Lf.d'+[.].A.....R.......}......>..V...&.E[.;.,.QA...-aI.F..d.s..IB..e.,..w_.a2.=.3......F.u.DDDDDDDDD..... """""""":],.........h.a.EDDDDDDDD..K-"""""""".pXj..........R............ZDDDDDDDD4..""""""""..............8,.........h.a.EDDDDDDDD..K-"""""""".pXj..........R............+.TU-..BS...DEQF..:$....n. ...3.L-.$.ey..b....I...T.{o.~....../..&.t.G..)C.C....u..].}Y...b...X.e.y.[.(.m..i..p0Z..52u.G.X.SG5..C:"Zn(..u@..._.Yl)....:.]#...9.MyVSZ.m.,..n..M.w5.....9..3...+v........q..U..k.-SG.l*.v.U."""""""..t]O.9@U.2..7....V.el.f.\.p8V;..e.$.0..OE.O){aO.Wk...z...Q.T^;.......rJr4..eo...]..}.S.W..N.rJ.u..R...)%9..v.=.a....]Y...c..+g.?j....,...LI."""""""....Z.H.l..s....@4h.f......f.v.f.PU[......~.LM7&.(@.r.k...<4&;#)9j...+...{.!4S7(. @..0c.-#...s.I.....^..5[...t..C.fN,_s..=tvinRr..........F..mmm..\|......Fw8.....1.L.8@kP..ts.c...1WOP...o.....I...X.......g......&4..R...q..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-OGDFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 280 x 221, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10126
Entropy (8bit):	7.939699979067955
Encrypted:	false
SSDEEP:	192:xHUNvJw63+gkSCwzOWV1c9IouUDYV3e9Vd/OvFeQWJR0dM2sJYpO:lIB7+gk/wfBouUq3eJSQ30W2sW8
MD5:	A638A3909C0323CE8DF0AC08715C5509
SHA1:	78BF68DEE61162A9C5AE3B22B6FCD49809F655F9
SHA-256:	8A8AFF8B99C124EC3B868579AAB8E3484A440647B726BD6159399FA81A0B098A
SHA-512:	D7B9B34709DC8426EAAD21CFAA519505BB77333AD13EAF38FEF2DCBFC1E3BA768C8E112CE6B75867E84CF4C6BF71805A07DC02D8537235C4BCB09841E47136E4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............].....sRGB.......'HIDATx....U.y...y.~....``f...H.m.d...^.Dv${+."..T6..]Wm..VmYPJR%..r.%[...UYml.N4....k-.$KF... ..FHF ......p.r.}..}.z.t.....>=}.W)...I....l.....E...v'...\<8..R....@...d.....%SA..;...._...m]oOo....a...O..]GoK.G.......&......6..o...?.S.H...h...khK..7...jr...n.,.!...e....@z....A...g.n_...D.M..f.6&.n.<qB....MV..+2..w3.x.\|u..i..p.._...4..v3......^...Hf.....T}].UW....`....!..\|.d..B.^.fZ..V..E..e~~.9...3.z.Ifs$.k.w...........\...o...<&.. eP.G..s....w.]..$.....pO..n.b...o..3I\p0_.H;,...uC.Z.....u..fI.mO5s..E...*.]V$.7.XsE...b.`.......V....u.x."'p. .Snu&..e........,.^..m..h....n..........iJrR7}.\}..g.Q..l...o.Z..H.t....@.Yd...5.....!"kq.....&!..1.V.Iy..w.)'y}N:.....}. .".....r.p....../.....'E.....\.i.2<.u...R.4..u....xB.?.l....W.."A/.........3.`{O.7u. ...-:.t.N............$.J..I_.b...j?t....Td..!I...S...3.S.k...j{.n@o..e.W..(.H[O..XR..W..........Y.....)c.........s>..i).r`.'....x.9.0K.7.d.c..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-Q402J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1405 x 1765, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	129439
Entropy (8bit):	7.835689459657122
Encrypted:	false
SSDEEP:	3072:l256Cvrt7ev7hXLr5hzOKEYhukja/tPRsNVaSXhsymGHaGo:lzUrt7ev7PhqKEYhukjKtPRsNV///6Go
MD5:	FF0C55A134F86496BF739F549129738D
SHA1:	C0D898B7645B91F6C382D82C4221AE303ACEFD75
SHA-256:	20B70F35C114C0DED10EBA1F19A572B22A8EE5833824B593F4BD5ED8CABD7895
SHA-512:	5068F9CBA7FA67921348D244FD259B685336C1F05421E91E378BBDD66B6C680D1BCB9E03CFB0266843782C168B999CC09BEF16162F2C8442A7BD9CA1871FBC59
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...}.........l2as....pHYs............... .IDATx...y...]'..{.J*.Vk)y.l.b'...QV.0i..$.4...zXz`r.e..p..........$9..Y..n'!d.v.;.B.x.l.v...JR.u.}..Y.%.t...T..>.srNb...O.}....>....<........2.......`..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_......................@........"......(../....@..}......D......P B_................7.x=...W.......'.....:........x.......{...x.....wx...{.?j...\.....bQd........cp....M....=.\>.I...........,.....=..Znx.}...#............qO

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-QNCEF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	21733
Entropy (8bit):	5.266673941035247
Encrypted:	false
SSDEEP:	192:0a7jLCGp3A2Lo2eF/WGaNG6aKeXcdvZ6qSGIDFzVGyyipwfYOD9eueKjzm71TdFp:B7juOguDsj
MD5:	7D678606E17A96578311B6C62CE53E84
SHA1:	FED05C3A3B3650ED12E1993D3F02597AEBE9EC5D
SHA-256:	C67AC4B9C06FE01801AA2D8B9544E344FE2478D9A572389746EDCA07D609F91F
SHA-512:	7B6873A51F59CE32A47D914557F7B4DBBC18BCE73A87476A3E55CE5DC0783FE8C7DF918EAA6FBA11FE277A0156A2DDAE00BDFE567EFE047B1A0F6061D40333F3
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>....</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (.....psd) -->.<style type="text/css">. ..#__01 {..position:absolute;..left:0px;..top:0px;..width:7912px;..height:204px;.}..#id1-02 {..position:absolute;..left:0px;..top:0px;..width:184px;..height:184px;.}..#id1-02002 {..position:absolute;..left:184px;..top:0px;..width:184px;..height:184px;.}..#id1-02003 {..position:absolute;..left:368px;..top:0px;..width:184px;..height:184px;.}..#id1-02004 {..position:absolute;..left:552px;..top:0px;..width:184px;..height:184px;.}..#id1-02005 {..position:absolute;..left:736px;..top:0px;..width:184px;..height:184px;.}..#id1-02006 {..position:absolute;..left:920px;..top:0px;..width:184px;..height:184px;.}..#id1-02007 {..position:absolute;..left:1104px;..top:0px;..width:184px;..height:184px;.}..#id1-02008 {..position:absolute;..left:1288px;..top:0px;..width:184px;..height:184px;.}..#id1-02009 {..position:absolu

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-RREAG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1875
Entropy (8bit):	4.854469893271774
Encrypted:	false
SSDEEP:	48:coJYcqAjTYcQUAjRYczAjjYcWyAjIYc9AjQYcJHKYczEwYcKU:yTy+Bjr6lZK
MD5:	197A18B99F21E2FFFDC6C484BA75AA21
SHA1:	94201EFC1E3965386116CA4B10ECB047B5D3364C
SHA-256:	E73BB676505A29B90E0BF2594723D8D1C93B006C0B1D53885E516A6C575C0BDD
SHA-512:	78C4C522268E7FFA175C3BF05CCA60F3F87CA3C458027C50B3B56FFFE9F4E33F70BF393524CF619A925DF275AB2CE2F9E92C728E7F3447F9874A5E19983A70B3
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="InformationIcon">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="322" Top="690" Width="42" Height="42" />.. </Part>.. </Item>.. <Item Name="QuestionIcon">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="365" Top="690" Width="42" Height="42" />.. </Part>.. </Item>.. <Item Name="ErrorIcon">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="451" Top="690" Width="42" Height="42" />.. </Part>.. </Item>.. <Item Name="WarningIcon">.. <Part id="0" Name="Frame" FillMode="center" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="279" Top="690" Width="42" Height="42" />.. </Part>.. </Item>.. <Item Name="SuccessIcon">.. <Part id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\is-VNKLF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	4.846047834142827
Encrypted:	false
SSDEEP:	24:2dou59qBRrq7CpODp9q2rq7CpODOB9q3Zrq7CpODgbZFeld+BlSrICrqeBcCrq1A:coKw+ms3v+msw2+msgirUIF+er+uFc+v
MD5:	98703E22D956991909C2FC07C7201662
SHA1:	E4835B4ADE2D0722C8B8ADA9968FD82248FEA470
SHA-256:	356B10F2924B90F26D27F06723D2054299828046D9F1D9EF8B10BC80C7B17233
SHA-512:	257F007BBABB97B243940A2355A1F71402D0AA95FB3A670930AE090F025E983E4CCEE912D6E456A3FA6A7BA0D6EDF6E02F2CB659A496409D4EF913368B4B0DF1
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="imgAddTransferAnimate">.. <Part id="0" Name="Frame" TransparentMode="Alpha">.. <Graphic Name="AddTransferAnimate.png" />.. <State Left="0" Top="0" Width="40" Height="40">.. <Animation FrameCount="48" FrameDelay="24" />.. </State>.. </Part>.. </Item>.. <Item Name="imgAddConverterAnimate">.. <Part id="0" Name="Frame" TransparentMode="Alpha">.. <Graphic Name="AddConverterAnimate.png" />.. <State Left="0" Top="0" Width="40" Height="40">.. <Animation FrameCount="48" FrameDelay="24" />.. </State>.. </Part>.. </Item>.. <Item Name="imgAddDownloadTaskAnimate">.. <Part id="0" Name="Frame" TransparentMode="Alpha">.. <Graphic Name="AddDownloadTaskAnimate.png" />.. <State Left="0" Top="0" Width="40" Height="40">.. <Animation FrameCount="48" FrameDelay="24" />.. </State>.. </Part>.. </Item>.. <Item Name="imgNewTask">.. <Part id="0" Name="NewConver

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\pic.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1500 x 1400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	936804
Entropy (8bit):	7.995236125937523
Encrypted:	true
SSDEEP:	24576:eCcKVyh02hJkPtG1JbPqp/JP7BXPeg4QritdjXsLsMKNfh:eCJyh0ikgHb+JP7hPegxitJsAMKP
MD5:	453989E991DB403A456FEDA4B90AEE77
SHA1:	AC5C7C047DA0228146B4E22C9647069A26AAED43
SHA-256:	DFEA7AE194735B289E31A2679531EDAC3B2F0ABEAAC09AF6DF56F51293EFF78D
SHA-512:	BDDDC85D1EBF6385E943459D299FFDD2C6F5A4D854BCD2053AD6998FDB5BE65F3BA8D4286F4F2C87FC2AB9850E9F174C63EA200085E10133CCCAA39135758D8E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......x.............tEXtSoftware.Adobe ImageReadyq.e<...siTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:93246b56-7bd2-4591-a16e-4f5a1643df9c" xmpMM:DocumentID="xmp.did:0A7B2F9905CF11E69846901317E4037A" xmpMM:InstanceID="xmp.iid:0A7B2F9805CF11E69846901317E4037A" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:66e62c5c-104b-4b13-afd1-794bd56f52df" stRef:documentID="xmp.did:93246b56-7bd2-4591-a16e-4f5a1643df9c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......G.IDATx...`TE..o{.M....t......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\play.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	19401
Entropy (8bit):	5.229326792226139
Encrypted:	false
SSDEEP:	384:4AOTyGEENDKNqcMj/ejiqO2F/iONkFnV4sJ2kr4rRr+x4Uyq26WvrEYU6goqy6+x:+yGhNDKNqcMj/ejiqO2F/iONkFnV4sJs
MD5:	A1E0B6B63F51852D3FB879B1BE7443A9
SHA1:	A217F49132E87C1EA3F792530A06C756CCE450FD
SHA-256:	7BB2F989C426EC25E9B81B8CBA437AEC8E6C121FFA4322D87A19E4C1E5C65D1D
SHA-512:	6B10B00B6293D4AD373874984316FE164B9F214A8DC16C8753A70C4681E1344C3F25E0946A6A65CC153733CB2FF87DE01A6A60D5D4B22062769C91B8FBA69391
Malicious:	false
Reputation:	unknown
Preview:	<html>.<head>.<title>play</title>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">. Save for Web Styles (play.psd) -->.<style type="text/css">. ..#Table_01 {..position:absolute;..left:0px;..top:0px;..width:633px;..height:289px;.}..#play-01 {..position:absolute;..left:0px;..top:0px;..width:633px;..height:59px;.}..#play-02 {..position:absolute;..left:0px;..top:59px;..width:76px;..height:45px;.}..#play-03 {..position:absolute;..left:76px;..top:59px;..width:39px;..height:39px;.}..#play-03004 {..position:absolute;..left:115px;..top:59px;..width:39px;..height:39px;.}..#play-03005 {..position:absolute;..left:154px;..top:59px;..width:39px;..height:39px;.}..#play-03006 {..position:absolute;..left:193px;..top:59px;..width:39px;..height:39px;.}..#play-07 {..position:absolute;..left:232px;..top:59px;..width:401px;..height:10px;.}..#play-08 {..position:absolute;..left:232px;..top:69px;..width:1px;..height:58px;.}..#play-09 {..position:absolute;..left:233px;..top:69px;..wid

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\play.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 633 x 289, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35253
Entropy (8bit):	7.944914254275826
Encrypted:	false
SSDEEP:	768:ersS4F42BDQZAZxW4ATDBGdpdVd1I66J2YygfXUdp3he2:HS4F4KxDJATDUdbfEJcgfXo3r
MD5:	FDC0A760D95A3FA51062C8D8F914872F
SHA1:	7255664DA44C9F5E169E54B9F81B151D4EE5F07E
SHA-256:	AA0D4353C6D01292C75E07FB3E51CE236F3CDF91B9FC0FFB182532E6692A93A5
SHA-512:	0716158B58587FDADD005ABD23FB169A25328869D3B6B6687FF5539831E09D4BA9E5B85C96A9E1CD7885BE733A328DBCAEF8C039CB9E96D66C469D3D3F50210F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...y...!......<......pHYs............... .IDATx..yxT....n.d_HB......"......V........].Zmkk[.m..Z..XPP.".....B....@.e.....w.C.If&../}?....{.y_....s..~....A..A.D.B... .. .. "..<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. ....<. .. .....K...X.~.z.......:....-.>.....tn.Q.8vGi..U.~.u....=..c..(Bm.".f..z%Z.....eDF..V.]............=PT..Xyu.Z.'....Yj..Jm..c..$....-....M..In...0b..l.s+..s.2.t.:c.%..S..zA.....(7. ......9td..,.0.........(.....H...@...Z

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Default\slice.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 280 x 221, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10126
Entropy (8bit):	7.939699979067955
Encrypted:	false
SSDEEP:	192:xHUNvJw63+gkSCwzOWV1c9IouUDYV3e9Vd/OvFeQWJR0dM2sJYpO:lIB7+gk/wfBouUq3eJSQ30W2sW8
MD5:	A638A3909C0323CE8DF0AC08715C5509
SHA1:	78BF68DEE61162A9C5AE3B22B6FCD49809F655F9
SHA-256:	8A8AFF8B99C124EC3B868579AAB8E3484A440647B726BD6159399FA81A0B098A
SHA-512:	D7B9B34709DC8426EAAD21CFAA519505BB77333AD13EAF38FEF2DCBFC1E3BA768C8E112CE6B75867E84CF4C6BF71805A07DC02D8537235C4BCB09841E47136E4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............].....sRGB.......'HIDATx....U.y...y.~....``f...H.m.d...^.Dv${+."..T6..]Wm..VmYPJR%..r.%[...UYml.N4....k-.$KF... ..FHF ......p.r.}..}.z.t.....>=}.W)...I....l.....E...v'...\<8..R....@...d.....%SA..;...._...m]oOo....a...O..]GoK.G.......&......6..o...?.S.H...h...khK..7...jr...n.,.!...e....@z....A...g.n_...D.M..f.6&.n.<qB....MV..+2..w3.x.\|u..i..p.._...4..v3......^...Hf.....T}].UW....`....!..\|.d..B.^.fZ..V..E..e~~.9...3.z.Ifs$.k.w...........\...o...<&.. eP.G..s....w.]..$.....pO..n.b...o..3I\p0_.H;,...uC.Z.....u..fI.mO5s..E...*.]V$.7.XsE...b.`.......V....u.x."'p. .Snu&..e........,.^..m..h....n..........iJrR7}.\}..g.Q..l...o.Z..H.t....@.Yd...5.....!"kq.....&!..1.V.Iy..w.)'y}N:.....}. .".....r.p....../.....'E.....\.i.2<.u...R.4..u....xB.?.l....W.."A/.........3.`{O.7u. ...-:.t.N............$.J..I_.b...j?t....Td..!I...S...3.S.k...j{.n@o..e.W..(.H[O..XR..W..........Y.....)c.........s>..i).r`.'....x.9.0K.7.d.c..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Recorder\MainForm.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1205 x 1600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	167704
Entropy (8bit):	7.934788657942961
Encrypted:	false
SSDEEP:	3072:VDoco4OZzqJU3AQ3Y+4jKuJwm4Tl6n4Sp0SAq6Tf4ToaBRTIiBjz:xyZzqJAY+4jtwDG4w0y6c9bTIiBjz
MD5:	4558AB28E891CB5F7304DBB066693772
SHA1:	E7B91513A39A2E55C56B4535F599596D1272C91B
SHA-256:	F4D646490F6BEEB22A46C27A9816959069B52AE7BA950E94D5AD25BC177DFD61
SHA-512:	7AF4B7DD40EF45E9DD13C2C8396A7A439B2CB61CC56990443EDC351A1C1DF4D7D631E67DEE10EB58FE6DCB7C03CA9A6E2F1F77941C466E342127EA409EFA3731
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......@.......p.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Recorder\Record2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68923
Entropy (8bit):	7.878250730718452
Encrypted:	false
SSDEEP:	1536:8r3wTs335B9Yi5cZT9J6YEvPqeRLulxZFlkSJwtfZ9t7Hh4G:K3ys335BaiqZh0qedUxiSkh7H+G
MD5:	4C9A360389DD065C32E97E5E47337FF8
SHA1:	1DD55152001E16077BB1DD353140D99D787A72F2
SHA-256:	54F5B55B201809AC598707377BB9A3152617C20BFF66E552F86BA9A5DE150376
SHA-512:	85BB0B41347BAAA6E84427B7B8544E8E266C3D4B740C845458141CBA25BCF530B0950F642B6095BAB3F3B60A73019B6C7A864C303B2F243418C22926D3EC00EC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!......tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:bb4b220e-2515-4736-96c0-e76adc321157" xmpMM:DocumentID="xmp.did:3402DC7A768911E8A332A0AE1CA30D34" xmpMM:InstanceID="xmp.iid:3402DC79768911E8A332A0AE1CA30D34" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2fb21791-e85b-4575-9a20-d0bc3055ae3c" stRef:documentID="adobe:docid:photoshop:2791c6fa-81a3-117a-8574-c8463acccec9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.X.....KIDATx.....%E

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Recorder\Recorder.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 950 x 180, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28627
Entropy (8bit):	7.927176224573868
Encrypted:	false
SSDEEP:	384:1IlaT5lky9TaazxpZEBDfcpDx6x6F+uAXB2Lvziu370cdI1cQk1bQIkRmuQo:ulan9Taw8cJFcRwiy70cee31wmu1
MD5:	DFD5F0B09D83D1283B07BBEE972E5D87
SHA1:	8C533A640B0FEEF986C187B2E99FA3BDF7A5D7C6
SHA-256:	21E26F3F36A425B1F4C667B4FF493E69F0B1CC0E6DFE6963A50D6416838E9075
SHA-512:	16168585CAEEB8F98B2F093D2B38017E4478304AC02F90BC17F1C8F5EDC01E303D5D7A84EB2DFEC5D246115693875C2D8DE0329A3AEBDB06FAC23E394B197E90
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ec3cd190-6f03-4075-96d4-4d478733f922" xmpMM:DocumentID="xmp.did:563C2DC372DA11E8BDCEDF4D5BFEC9ED" xmpMM:InstanceID="xmp.iid:563C2DC272DA11E8BDCEDF4D5BFEC9ED" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:37ba0dd1-5c93-4117-8dc5-37a6850dd6e2" stRef:documentID="adobe:docid:photoshop:e6b03e7a-1868-117a-b098-88ddceadecb0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......k.IDATx.....U

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Recorder\is-7CMFC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 950 x 180, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28627
Entropy (8bit):	7.927176224573868
Encrypted:	false
SSDEEP:	384:1IlaT5lky9TaazxpZEBDfcpDx6x6F+uAXB2Lvziu370cdI1cQk1bQIkRmuQo:ulan9Taw8cJFcRwiy70cee31wmu1
MD5:	DFD5F0B09D83D1283B07BBEE972E5D87
SHA1:	8C533A640B0FEEF986C187B2E99FA3BDF7A5D7C6
SHA-256:	21E26F3F36A425B1F4C667B4FF493E69F0B1CC0E6DFE6963A50D6416838E9075
SHA-512:	16168585CAEEB8F98B2F093D2B38017E4478304AC02F90BC17F1C8F5EDC01E303D5D7A84EB2DFEC5D246115693875C2D8DE0329A3AEBDB06FAC23E394B197E90
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:ec3cd190-6f03-4075-96d4-4d478733f922" xmpMM:DocumentID="xmp.did:563C2DC372DA11E8BDCEDF4D5BFEC9ED" xmpMM:InstanceID="xmp.iid:563C2DC272DA11E8BDCEDF4D5BFEC9ED" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:37ba0dd1-5c93-4117-8dc5-37a6850dd6e2" stRef:documentID="adobe:docid:photoshop:e6b03e7a-1868-117a-b098-88ddceadecb0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......k.IDATx.....U

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Recorder\is-A1082.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	26498
Entropy (8bit):	4.73938307565904
Encrypted:	false
SSDEEP:	768:+jYW6vsHHwQzfaSccuYSinc99OGs8vPXGgN3:bhp
MD5:	74122CEC5B1E0A1DBE97E468A2487763
SHA1:	96A4426BDA4712834A8C50602FC5C0CC8C7551EA
SHA-256:	AE6273E09AEF24D9A0F17068D32C176F9A705CA81C97318783F9818546AF52F2
SHA-512:	16956EB8BB880D5F6674B0057A5076D8074208FFBE9FB0A11EBEC29514C4B682A12D0F78E0ACEAB58B1AD9735EC9974560D3A5A12E7778C103BAF5FC1B9A5C59
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Skin>.. <Item Name="Button">.. <Part id="0" Name="Frame" FillMode="stretch" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="565" Top="210" Width="18" Height="30">.. <Margins Left="6" Right="6" />.. </State>.. <State Left="585" Top="210" Width="18" Height="30">.. <Color>clBlack</Color>.. <Margins Left="6" Right="6" />.. <Font Color="$00CA8208" />.. </State>.. <State Left="605" Top="210" Width="18" Height="30">.. <Margins Left="6" Right="6" />.. <Font Color="$00CA8208" />.. </State>.. <State Left="625" Top="210" Width="18" Height="30">.. <Margins Left="6" Right="6" />.. <Font Color="$00CA8208" />.. </State>.. </Part>.. </Item>.. <Item Name="CheckBox">.. <Part id="0" Name="Checked" TransparentMode="Alpha">.. <Graphic Name="MainForm.png" />.. <State Left="644" Top="356" Width="15" Height="15" />..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Recorder\is-HIEV0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68923
Entropy (8bit):	7.878250730718452
Encrypted:	false
SSDEEP:	1536:8r3wTs335B9Yi5cZT9J6YEvPqeRLulxZFlkSJwtfZ9t7Hh4G:K3ys335BaiqZh0qedUxiSkh7H+G
MD5:	4C9A360389DD065C32E97E5E47337FF8
SHA1:	1DD55152001E16077BB1DD353140D99D787A72F2
SHA-256:	54F5B55B201809AC598707377BB9A3152617C20BFF66E552F86BA9A5DE150376
SHA-512:	85BB0B41347BAAA6E84427B7B8544E8E266C3D4B740C845458141CBA25BCF530B0950F642B6095BAB3F3B60A73019B6C7A864C303B2F243418C22926D3EC00EC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!......tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:bb4b220e-2515-4736-96c0-e76adc321157" xmpMM:DocumentID="xmp.did:3402DC7A768911E8A332A0AE1CA30D34" xmpMM:InstanceID="xmp.iid:3402DC79768911E8A332A0AE1CA30D34" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2fb21791-e85b-4575-9a20-d0bc3055ae3c" stRef:documentID="adobe:docid:photoshop:2791c6fa-81a3-117a-8574-c8463acccec9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.X.....KIDATx.....%E

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Skin\Recorder\is-RLURJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PNG image data, 1205 x 1600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	167704
Entropy (8bit):	7.934788657942961
Encrypted:	false
SSDEEP:	3072:VDoco4OZzqJU3AQ3Y+4jKuJwm4Tl6n4Sp0SAq6Tf4ToaBRTIiBjz:xyZzqJAY+4jtwDG4w0y6c9bTIiBjz
MD5:	4558AB28E891CB5F7304DBB066693772
SHA1:	E7B91513A39A2E55C56B4535F599596D1272C91B
SHA-256:	F4D646490F6BEEB22A46C27A9816959069B52AE7BA950E94D5AD25BC177DFD61
SHA-512:	7AF4B7DD40EF45E9DD13C2C8396A7A439B2CB61CC56990443EDC351A1C1DF4D7D631E67DEE10EB58FE6DCB7C03CA9A6E2F1F77941C466E342127EA409EFA3731
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......@.......p.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\VanMail.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	193776
Entropy (8bit):	6.763656771383948
Encrypted:	false
SSDEEP:	3072:W/IWFsvdzzPARtTALlwejovffj4xj6Nkqmq3HbcO36w/lvGTBfeT+OiseV0zM0D:i8GtRejifj46Nmq3HbcOzlvGTBO3emlD
MD5:	153C6AFF1A3841CEBB112C27D2C7DE66
SHA1:	8ED00F86D0AF897DD85A7FB54DB768A065EB9017
SHA-256:	7CBC0994FD2980BF3A1D83FB54FF758BEB8F421DB8BB62CE6EE5C408798748DD
SHA-512:	B9ED432C62BC9B04B730E78CA653FFC57E3D5AB01DC51FEB6524D3651AEFE9ED4D97A50323257EB1A9E2DAAC7F21888C1DB1DB930E4BD7988CD044FFA618A34D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.._.a._.a._.a..Y..W.a.Vn..n.a.Vn..G.a.Vn....a.Vn..X.a._.`.*.a.Vn..E.a.Vn..^.a.Vn..^.a.Vn..^.a.Rich_.a.........PE..L......M...........!.................)....... ............................................@....................................P........................4...........".................................@............ ...............................text............................... ..`.rdata...~... ......................@..@.data...............................@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	779264
Entropy (8bit):	5.71058373598344
Encrypted:	false
SSDEEP:	12288:HfA1S/ufXxLkW6ktCOK7yG3JNL0tXxDXO:HfduP9kr17HJNyX
MD5:	E6412D28466F5F41DC25E3C8985FDAAF
SHA1:	F012CBFBF0F60FFCC85CC27E960EC60B9CA83290
SHA-256:	C6F8BCBA87F718213FE463FC081F45636860593483839297514D8F6742F7CB7A
SHA-512:	4CF6D6479892C5A637F75DFAE57C782A76E738419A09596A3B2AE0C0EAE5FD5865645B7520C46C0F6258C7D06BD98B27246AF604B2D0F670FF1B98517D9A11E9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.Z...........!..................... ........... .......................@......T.....@.................................t...W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......<}..8~...................+.......................................B...B... ... ......B............B...B... ... ......B............B...B... ... ......B............B...B... ... ......B............B...B... ... ......B............B...B... ... ......B............B...B... ... ......B...............................B...........E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E...E...E...E...E...E...E...E...E`..E`..E`..E`..E`..E`..E`..E`...............B..........

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Ctrls.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1872384
Entropy (8bit):	5.430226004217751
Encrypted:	false
SSDEEP:	24576:iw2pXGmfWF+YnbQC2pS/qm/f6aDYp5WlpF+5:6pXGpQC2A/qp5p
MD5:	0BDEF150B51E8CDC6547D33E8EBE21F5
SHA1:	C4F2EDD3890AFBF35042BE34EB38EDE0ED2591BF
SHA-256:	1D84CC9A239B3CA8E0ADACC9251A55C03E86B0A712E70AB692C4D0B9C8293ABB
SHA-512:	EC052AF1C1F8EEE04C2DF1CB053C73AE12B9C151514FEDC6426C1C7E6B041176584D7735BCD4F407C0275C5DF7CD8C755664C5B524B99FF4025BC5652D8CDD24
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.Z...........!................>.... ........... ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......,>...X..........@.......` ........................................UU..UU..UU..UU......f.!62.`P.T,.h.....X...z:.....&....#u.v..Y.A.. .&E.pA0b..t....w..#.O9..>.......J.Fw..B.I.....{k....S.!......M.Q..[.0...........(......0...........%(.....}......}......}.....0...........{......0...........{......0...........{......0...........(......0..%.......(....,.+..(....~.... ....oH...(I.......0..#.......(....,..+..+.,.+....(.......(....F...........(....*....0..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Localization.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.4040927972043145
Encrypted:	false
SSDEEP:	768:yTF16vwRNBLYNbH1/pco+1EJbNryJ4Tnz6DhjbpLZXbVtWPt:6LAwbMHTmaJQKjz6lHpLA
MD5:	84F273D123273E8DDB14A9688CDC3464
SHA1:	B8AC3518A68762B08987351CC0F45CE393D894EF
SHA-256:	87CC3159FCD9DA86DAD5E99D4EFED8A343EC8CDBEA32D4A1F3B22BA036123D25
SHA-512:	2AA09160D7A1D6A6D98DADC2293EBE0BFD848742EA258FAA4815026D1E9791DF3B423524F3F964A1104816125CA0FA38FD4F9C952601F11F280725C559EA5861
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.Z...........!................N.... ........... ....................... ............@.....................................K.................................................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H...........lJ..................P ......................................O......O.0.bh.....D.(.....a..).L.......1`...OL.."'L..`o~.[Su[I9.k'.~4.....u.bI.......kg..$......L(...0...i0e.i..y..../q .....[.0...........%(.....}......}......}.....0...........{......0...........{......0...........{......0.......... ........+.+.....E............6.......E....+..+.,..#........3. ........+.+&..Y......* ........+...6H ........+.+..(.....(....(....#.....<Z#.....<(...... ........8c.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\WUL.Zip.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	188928
Entropy (8bit):	5.408092359269396
Encrypted:	false
SSDEEP:	3072:rFIjBE43VkP3hsCYCIVeb4F9zrqNr+2d0mPAe6o43sa8SBvGVPx7FIHp:rFIVj3GP3hQdH/qD2y/SsS
MD5:	04CA484D8C7E663196AB83EF810C95E1
SHA1:	FCEA2AEDEA570FB16A814645D91987D8EE6911AA
SHA-256:	A3B0F42188777514D6DD3EC47EF1DE02A978765F24E4458123532B16765CF863
SHA-512:	B2C7317C5F12D68B5325836D48E3122D82370E8B8C079A329F9EE0BF83B69A28BF08B389DD07A513C4F821C5A17598124CB3C7FDE731B42FA780C6CA6AFEF4F1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.Z...........!..................... ........... .......................@...........@.................................h...S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H................................'...........................................0.w,a..Q....m...jp5.c.d.2......y.......+L...\|.~.-.....d.... .jHq...A..}......mQ.....V.l...kdz.b...e.O\...l.cc=....... n;^.iL.A`.rqg....<G..K....k......5l..B...@....l.2u\.E....Y=..0.&:..Q.Q...a....!#.V...........(..._....$....\|o/.LhX..a.=-f..A.v.q... .*....q......3....x4............j.-=m..ld..\c..Qkkbal..0e.N.b...l{.......W.....eP....\|......bI-...\|.eL..Xa.M.Q.:t....0..A..J..=

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2363968
Entropy (8bit):	7.995350140766164
Encrypted:	true
SSDEEP:	49152:3XduYldqwamy35tTfIR4ndvlPF8PnDMsjMvN8jhPp5RoFeVbFAZLCgvhX:nduYKP35uR4dddG4sMK9p5Rq8bC1vF
MD5:	44E68F722BBF4530E230B930655DCBD9
SHA1:	E28009E42CF5E697F9867CCF809EBD7F02D7EE00
SHA-256:	35E720F9F516D71C8171AEE484D98FC7A0176AD945FB03CAC89007EC1C846DE9
SHA-512:	40471BE21017DB189B63135D73406367FD65011AF8505A6CEEA57926E145E0B591A1B8285B5B52181387AEEDB884B7FB055BA231DB54659523AF01FDBCE76BC5
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@........$..........@..............................P........,..........P.#..4..........................................................................................CODE....<........................... ..`DATA....L...........................@...BSS.....L................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\dict_384_747.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	684
Entropy (8bit):	4.671671073278316
Encrypted:	false
SSDEEP:	12:OebWVBxhnPw9+efLr6yx9U9aVuNJ7HP7AoJotvdNV4n+SB3jRkJ7:tWfxhPKBzrDpgJ7HP7AoatXev65
MD5:	A663B1C1630D1039252DB7D4FC347AB5
SHA1:	DFC245B9B38FBA9C007EAB2A0F76C58D14A9C135
SHA-256:	10E5B31C3FA326C34D87EE522A08CC7B2809186882EFC2B1ED1ECFBE0E1BEA63
SHA-512:	7D2D6A4E6741E360B95C3A38A1AE21EC518EB7FC31A595D183C9E5DF9BF016621FB52D2C7C979AB9B1F20188CFFEB612A6F1D57A73FDBA6981005CFB8DC95FF3
Malicious:	false
Reputation:	unknown
Preview:	[DataAcl]..start_system = 001;..download_finished = 002;..limitation_buynow = 003;..user_download_times = 004;..convert_complete = 005;..transfer_complete = 006;..record_complete = 007;..online_complete = 008;..connectd_complete = 009;..new_device_connect_total = 0010;..new_device_connect_success = 0011;..new_device_connect_failed = 0012;..deviceconnection = 0013;..duplicatedeviceconnectionsuccess = 0014;..duplicatedeviceconnectionfail = 0015;..start_download_startdownload_downloadsuccess = 0016;..start_download_startdownload_downloadfailed = 0017;..start_limitation_buynow = 0018;..start_user_download_times = 0019;..download_newplaylist = 0020;..addfiletoprivatelist = 0021;..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\dict_384_747.proto (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6617
Entropy (8bit):	4.442808179295516
Encrypted:	false
SSDEEP:	192:C3f3b2gI0FT4fScXz6HhzRdxTTeRJOkjvLBnneseGiClCHJYOhIhrB5nT4MS6:OJ4HarHJeJ
MD5:	578B5516677A7E957EAD5C9A78A795FF
SHA1:	E6340AB25D4120D03A9434254821F6D8227C9F44
SHA-256:	83E7545549668145C0F5A8E439130735A3096F183DB98365A83BBAB2D1125812
SHA-512:	60673484DCFFA9275BD368B5961D0741018F4D649F14291BCE24D6F0BA11626180AAEB4D3A6C4747336E775475BC55D3CFEC1A4A8463BCA61DA64B0506E30B73
Malicious:	false
Reputation:	unknown
Preview:	message Datetime {.. optional uint32 time = 1;.. optional int32 zone = 2;..}....message Start_system {.. optional string pcsystem = 1;.. optional string pclanguage = 2;.. optional string pccountry = 3;.. optional string screenresolution = 4;.. optional string pcdpi = 5;.. optional string hasitunes = 6;.. optional string start_from = 7;.. optional string itunesversion = 8;..}....message Download_finished {.. optional string download_chooseformat = 1;.. optional string download_mode = 2;.. optional string download_sourcefrom = 3;.. optional int32 download_videoquality = 4;.. optional int32 download_musicquality = 5;.. optional string download_youtubeoneclickdownlaod = 6;.. optional string download_oneclickconvert = 7;.. optional string download_oneclickconvert_foramt = 8;.. optional string download_sourcebroswer = 9;.. optional string download_playlistcount = 10;.. optional string download_state = 11;.. optional string dow

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-0UKF9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7787
Entropy (8bit):	5.117427652603937
Encrypted:	false
SSDEEP:	96:W+7ljqw/nd8B9Utp7yFeWbrq33H6jO5CLUOiRXai:W4T/dY9Ip7su33H63LWH
MD5:	77DA4F386DD954F50D1754CB04887E8A
SHA1:	22758E90117ED52EA65A8238D24D009CC77093EF
SHA-256:	0BAAD9F42286120F7C25373E82E92F95C9D2AC1FBBD720D2FACE0012DE7D1B5C
SHA-512:	3D866B84F53CD2675994F49744A7612624166E3A1197002B9B74564E2E83D7031857D69EABE1C2E4DF96C8CAAA3C5B9797668E2733EE62274941B305BB36D2C5
Malicious:	false
Reputation:	unknown
Preview:	<Product>.. <EncParamInfo ID="100040001" Icon="IconiPhone8" DisPlayCategoryid="1" FourCC="IPAN" FormatID="100040" KeepSrcParam="True">.. <Name>iPhone8(P,X)</Name>.. </EncParamInfo>.. <EncParamInfo ID="10001001" Icon="Iconipad4" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10001" KeepSrcParam="True">.. <Name>iPad 3,4,Air</Name>.. </EncParamInfo>.. <EncParamInfo ID="10002001" Icon="Iconipad1" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10002" KeepSrcParam="True">.. <Name>iPad 1,2</Name>.. </EncParamInfo>.. <EncParamInfo ID="10003001" Icon="Iconipadmini" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10003" KeepSrcParam="True">.. <Name>iPad mini</Name>.. </EncParamInfo>.. <EncParamInfo ID="10004001" Icon="IconiPhone7p" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10004" KeepSrcParam="True">.. <Name>iPhone7(P)</Name>.. </EncParamInfo>.. <EncParamInfo ID="10005001" Icon="IconiPhone6s" DisPlayCategoryid="1" FourCC="IPAN" FormatID="10005" KeepSrcParam="True">..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-1UPAE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50688
Entropy (8bit):	6.0076995939706075
Encrypted:	false
SSDEEP:	768:+Jt4t4DXcLSx6Ujk/ttUYWFRviuqJZ4b8kAe9J6JHcOAW:IWt4DXZNiiRqugpeiJHcO
MD5:	7C486EBD00D5D93FCEAD2609FC26D1FC
SHA1:	A65D55E907F02229BC2F16535A2B24786C0FCCEA
SHA-256:	5382563BC653B5F2035E2B79B2BA8584468F2FAEC08285B671852D0345B17D4C
SHA-512:	D737FDD712FF5EE0DD58FD6BFFFF9ADE30F457376C201EBC8467393B8F229D0472B0FA29127C84CE675E2911469C8F1D6F102CA5AE562254A9727EC4E3F44AF4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FM..'#..'#..'#.._...'#.._...'#.._..'#.._...'#..'".'#.._...'#.._...'#..u...'#.._...'#.Rich.'#.........................PE..L......[...........!.....n...T..................................................................................................P...................................@...............................P...@............................................text....m.......n.................. ..`.rdata...+.......,...r..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-5ET8N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	684
Entropy (8bit):	4.671671073278316
Encrypted:	false
SSDEEP:	12:OebWVBxhnPw9+efLr6yx9U9aVuNJ7HP7AoJotvdNV4n+SB3jRkJ7:tWfxhPKBzrDpgJ7HP7AoatXev65
MD5:	A663B1C1630D1039252DB7D4FC347AB5
SHA1:	DFC245B9B38FBA9C007EAB2A0F76C58D14A9C135
SHA-256:	10E5B31C3FA326C34D87EE522A08CC7B2809186882EFC2B1ED1ECFBE0E1BEA63
SHA-512:	7D2D6A4E6741E360B95C3A38A1AE21EC518EB7FC31A595D183C9E5DF9BF016621FB52D2C7C979AB9B1F20188CFFEB612A6F1D57A73FDBA6981005CFB8DC95FF3
Malicious:	false
Reputation:	unknown
Preview:	[DataAcl]..start_system = 001;..download_finished = 002;..limitation_buynow = 003;..user_download_times = 004;..convert_complete = 005;..transfer_complete = 006;..record_complete = 007;..online_complete = 008;..connectd_complete = 009;..new_device_connect_total = 0010;..new_device_connect_success = 0011;..new_device_connect_failed = 0012;..deviceconnection = 0013;..duplicatedeviceconnectionsuccess = 0014;..duplicatedeviceconnectionfail = 0015;..start_download_startdownload_downloadsuccess = 0016;..start_download_startdownload_downloadfailed = 0017;..start_limitation_buynow = 0018;..start_user_download_times = 0019;..download_newplaylist = 0020;..addfiletoprivatelist = 0021;..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-5SP36.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	276480
Entropy (8bit):	6.6647829510204755
Encrypted:	false
SSDEEP:	6144:kHoEU65E8bGug33G2vqzFc6s1uoeawThG21JrAhOUk:ksH33G2vqK6sktakhau
MD5:	490F436D6FD3FB799C60DB79BB226190
SHA1:	D1E55D6B3B84EA2F151BAEE06A550B9A00086526
SHA-256:	955DC0785664CFCE105A01F742358D2065AE42CD8A3FFB53E501D2624418A8F4
SHA-512:	8E59223675D3605D381198499F4546246A621B4FF7FB836339606E45718C20BA8ACB3A7721B3BA29B20DA83839D3B13973F3DC715256F336A4DEDE2D91E64ACC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z\|.W...W...W....T.._...^c..k...^c..L...^c......^c..^...W...!...^c..X...^c..V...II..V...^c..V...RichW...........................PE..L.....[...........!.....P...................`............................................@............................._.......d....@.......................P.......a..............................H...@............`...............................text....O.......P.................. ..`.rdata.._u...`...v...T..............@..@.data....X.......4..................@....rsrc........@......................@..@.reloc..@2...P...4..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-6090L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2363968
Entropy (8bit):	7.995350140766164
Encrypted:	true
SSDEEP:	49152:3XduYldqwamy35tTfIR4ndvlPF8PnDMsjMvN8jhPp5RoFeVbFAZLCgvhX:nduYKP35uR4dddG4sMK9p5Rq8bC1vF
MD5:	44E68F722BBF4530E230B930655DCBD9
SHA1:	E28009E42CF5E697F9867CCF809EBD7F02D7EE00
SHA-256:	35E720F9F516D71C8171AEE484D98FC7A0176AD945FB03CAC89007EC1C846DE9
SHA-512:	40471BE21017DB189B63135D73406367FD65011AF8505A6CEEA57926E145E0B591A1B8285B5B52181387AEEDB884B7FB055BA231DB54659523AF01FDBCE76BC5
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@........$..........@..............................P........,..........P.#..4..........................................................................................CODE....<........................... ..`DATA....L...........................@...BSS.....L................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-6SBON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	339002
Entropy (8bit):	4.451625738365634
Encrypted:	false
SSDEEP:	384:yf+/DTkoQtICOsDef/tv15s7ZTFzICOsDef/tv15s1NnHGIMpi62EKX6qBYwH+vX:yc7c2mzYks
MD5:	B475D385EE13BA5122C960250B2BE3E1
SHA1:	0276D37AA005D4FAB9E6E4D42B1F60CFA1CC5904
SHA-256:	7AE90D3D7E8D8558BF83BC1862F98FB814A533F4B6A2BC69010A50231AB290EB
SHA-512:	4671722996621C54F367D2923F619289F7A3F2F95DB0E9733FDC62825A0C93BE64D3098B153A49B5F3C3D87B6375AAF5BA85CA87F3D48C551A04614B00E1AC03
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Wondershare_XML>.. <FILEFORCC>.. <_ac3>.. <AUDIO>.. <_AC3 EncName="AC-3 Audio">.. <NAMES _TYPE="CHAR"></NAMES>.. <PARAMS>.. <A_BITRATE _TYPE="INT">{32000, 40000, 48000, 56000, 64000, 80000, 96000, 112000, 128000,160000, 192000, 224000, 256000, 320000, 384000, 448000, 512000, 576000, 640000}</A_BITRATE>.. <SAMPLERATE _TYPE="INT">{32000, 44100, 48000}</SAMPLERATE>.. <CHANNEL _TYPE="INT">{1,2,6}</CHANNEL>.. </PARAMS>.. <RULES>.. <RULE_1>.. <CONDITIONS FLAG="AND" EXPECTATION="0">.. <CHANNEL _TYPE="INT">{6}</CHANNEL>.. <SAMPLERATE _TYPE="INT">{22050}</SAMPLERATE>.. </CONDITIONS>.. </RULE_1>.. <RULE_2>.. <CONDITIONS FLAG="AND" EXPECTATION="1">.. <SAMPLERATE _TYPE="INT">{32000}</SAMPLERATE>.. <CHANNEL _TYPE="INT">{6}</CHANNEL>..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-73IGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	96768
Entropy (8bit):	6.344139102794927
Encrypted:	false
SSDEEP:	1536:POZCF1i6ZVhZ65PUxXH0p3NmErvZ7uSklS3uKKGJIXQphJVJTzt3hgl:Pd2EVhZ69Jp3VcvI0GegDDJtQ
MD5:	4E4D180E5D7AB102E939B9E0A2081966
SHA1:	EE598DAC2AEC23192DAC5495A203C68014C99C26
SHA-256:	810054E978261E1E3AF4F20102107C6CBF37072DBEC21D34793A2E3231470828
SHA-512:	A73152E21A1DAA7EB95BBC89CC492A8B446E149445D90102CD49A76E6302896E8788DA5199D1F7D2D88E3B11A6ACC2EB2E3EBBF1041B33AE6F8AAF141ABB37AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.d.........................(.......r...............w...........................Rich....................PE..L......[...........!.........r......8D....... ......................................s.....@..........................X..T....N..................................(....!...............................A..@............ ...............................text...'........................... ..`.rdata...9... ...:..................@..@.data...@T...`.......B..............@....rsrc................V..............@..@.reloc...!......."...X..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-7FPIH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	6.200709365990904
Encrypted:	false
SSDEEP:	768:gQYBNH5k3KufrIfpE2KQwSd0GC0rN1F3xmtT/sk+HSqgB8OvFdk7iUJsvja8ON4:ZYlUKuzIfPKpSd0f+ypHvFuxJsvja
MD5:	EDCFD58D9E3FDF9D218C4B324E2CDD7A
SHA1:	9AA309AA95E92E819C118B6B656D0C1847A83D51
SHA-256:	67C1C178F263DEEC709492B02BCF1D66B96978A2F4FF3C43DB8B1E118BB13999
SHA-512:	E9A67765521CC7347C2DE02ABE567490822D343A93EE48A586BD747A260CD916A52FD735088974F66FC159CB1B7FA1C6D8E5339D96118F50A5AD2C3354E2F5D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..UN.UN.UNf..N.UN...N.UN...N.UN...N..UN...N.UN.TN..UN...N.UN...N.UN...N.UN...N.UNRich.UN........PE..L.....[...........!.........\......J*.......................................P............@.............................j...4...P.... .......................0..........................................@...............L............................text............................... ..`.rdata..J/.......0..................@..@.data...@,..........................@....rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-80KG4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103152
Entropy (8bit):	5.943481126273832
Encrypted:	false
SSDEEP:	3072:qjlPKLVeoAom9888888888888W88888888888xb01Y0E:qBP48Xl888888888888W888888888883
MD5:	65480BED6241E4B73F3F7AC0DA23F237
SHA1:	DBC2BE4CC55A721963086B90D0300231F6202FDF
SHA-256:	29B9C6F2EAE188331A91E6F4699C2121E0C5F9E20764A18946B64579819CD309
SHA-512:	66EB8A4BCBAAC747691847D3729170AAD63AAE15BC6192E4AD44A719070E949746643677732811EA37550B89158719171DFC98EA19966EB7DEBB902C73C3C30E
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-80KG4.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....h.]............................X.............@..............................................@........................... .......`...............^...4...P...............................@......................."..T............................text...h........................... ..`.itext.............................. ..`.data...X...........................@....bss.....M...............................idata....... ......................@....tls.........0...........................rdata.......@......................@..@.reloc.......P......................@..B.rsrc........`......................@..@.....................^..............@..@................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-ABAD5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.4040927972043145
Encrypted:	false
SSDEEP:	768:yTF16vwRNBLYNbH1/pco+1EJbNryJ4Tnz6DhjbpLZXbVtWPt:6LAwbMHTmaJQKjz6lHpLA
MD5:	84F273D123273E8DDB14A9688CDC3464
SHA1:	B8AC3518A68762B08987351CC0F45CE393D894EF
SHA-256:	87CC3159FCD9DA86DAD5E99D4EFED8A343EC8CDBEA32D4A1F3B22BA036123D25
SHA-512:	2AA09160D7A1D6A6D98DADC2293EBE0BFD848742EA258FAA4815026D1E9791DF3B423524F3F964A1104816125CA0FA38FD4F9C952601F11F280725C559EA5861
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.Z...........!................N.... ........... ....................... ............@.....................................K.................................................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H...........lJ..................P ......................................O......O.0.bh.....D.(.....a..).L.......1`...OL.."'L..`o~.[Su[I9.k'.~4.....u.bI.......kg..$......L(...0...i0e.i..y..../q .....[.0...........%(.....}......}......}.....0...........{......0...........{......0...........{......0.......... ........+.+.....E............6.......E....+..+.,..#........3. ........+.+&..Y......* ........+...6H ........+.+..(.....(....(....#.....<Z#.....<(...... ........8c.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-D0T43.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	950272
Entropy (8bit):	7.311653354701022
Encrypted:	false
SSDEEP:	24576:8AGf2Ffyl8KuZGavkg3NyIEbbT9oIBAUZLY:y+w8KuZGaXn+oIBAUZLY
MD5:	E548F9B9A2F4E2EA9BA5639DDB3DA20F
SHA1:	D448761FFD86E14FA7CA72770669DEF99E8D8663
SHA-256:	F1B90D3C35E75A46173481A5B5FA0D26DA3EAA5CBE071747F76D90AAFA5251CC
SHA-512:	E2F2E56D658037F53F2D6FBCD8224078CB5A540C2638561FA784AD5319F0E285F54A46BAAB3F4E7CE024B24F8A0F5B041D381F20E421876A02E58A553E86E475
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E.B.+.B.+.B.+... .C.+...%.Q.+. .8.A.+.B.*...+...!...+.../.C.+.RichB.+.........PE..L....S...........!................zD..............................................................................PM.......H..(....................................................................................................................text...ry.......................... ..`.rdata..L...........................@..@.data....%...P.......P..............@....reloc........... ...`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-D98D1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4651
Entropy (8bit):	5.022475642992595
Encrypted:	false
SSDEEP:	96:FQ83b8E3UmD8uDPg7z/5SBSBtj1yuRpF1W6zTHjxz7Aqsw75eKEWLiZbQG0P7fyy:SHigJ5B7bVUM
MD5:	6E1A12162D3DCD8EFEC133130C2FD17D
SHA1:	B505860F73EDE2DE6279009E5998635FFD493454
SHA-256:	284949660F9CACB29B2D76B4B2FE96318A70B41850ED2A3B884C136472408DD0
SHA-512:	20457B7ABD8A504A859C09E5A40000BE19CB49D9774ADF02C56616CBD96BB11415030EC5CB6E3561B5C19D5E27E2C4D1242587073E90F760F3D98955ED37CBCB
Malicious:	false
Reputation:	unknown
Preview:	<FormatType>.. <displaycategory id="1001" title="iPad 3,4,Air" type="1" icon="Iconipad4" EncParamInfoID="10001001" />.. <displaycategory id="1002" title="iPad 1,2" type="1" icon="Iconipad1" EncParamInfoID="10002001" />.. <displaycategory id="1003" title="iPad mini" type="1" icon="Iconipadmini" EncParamInfoID="10003001" />.. <displaycategory id="1004" title="iPhone7(P)" type="1" icon="IconiPhone7p" EncParamInfoID="10004001" />.. <displaycategory id="1005" title="iPhone6s(P),6" type="1" icon="IconiPhone6s" EncParamInfoID="10005001" />.. <displaycategory id="1006" title="iPhone 5s,5c,5" type="1" icon="IconiPhone5" EncParamInfoID="10006001" />.. <displaycategory id="1007" title="iPhone 4,4S" type="1" icon="IconiPhone4S" EncParamInfoID="10007001" />.. <displaycategory id="1008" title="iPhone 1-3GS" type="1" icon="IconiPhone" EncParamInfoID="10008001" />.. <displaycategory id="1009" title="iPod Touch" type="1" icon="IconiPodTouch5" EncParamInfoID="10009001" />.. <displaycategory id

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-E28Q8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1089024
Entropy (8bit):	6.444956936319174
Encrypted:	false
SSDEEP:	24576:+NY3WQ+cPKKFvUF/1hh4Y4WDBJe5xODJD:f3R+cPFlUF/174Y4WDbe5xODJD
MD5:	5A287275C61F3479AF8BEDE5BFA7B3A8
SHA1:	4BA7DDF1170AC4A0062E18FA9B30AE7BFDDCA6F8
SHA-256:	4BE58F512EE5C913350BB8D2103E81E6F6D82399224916F06F115C2906DA02AD
SHA-512:	A19AD1F999934DFBC82EEEB35F166A2F724AE3C655439F945451D810BE6933202A06C228595902B7D6139B213507CF000D8FFCDE1EB02A4BAA06AB289EE54BA1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T.b...b...b.._-,..b..../..b....9.}b...b...b....)..b....>..b....0..b....(..b...0...b....+..b..Rich.b..................PE..L......W...........!.....F...T.......I.......`............................................@......................... .......P...d....@.......................P...w..@b..................................@............`...............................text...{D.......F.................. ..`.rdata.......`.......J..............@..@.data....Q.......0..................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-GBHF6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	188928
Entropy (8bit):	5.408092359269396
Encrypted:	false
SSDEEP:	3072:rFIjBE43VkP3hsCYCIVeb4F9zrqNr+2d0mPAe6o43sa8SBvGVPx7FIHp:rFIVj3GP3hQdH/qD2y/SsS
MD5:	04CA484D8C7E663196AB83EF810C95E1
SHA1:	FCEA2AEDEA570FB16A814645D91987D8EE6911AA
SHA-256:	A3B0F42188777514D6DD3EC47EF1DE02A978765F24E4458123532B16765CF863
SHA-512:	B2C7317C5F12D68B5325836D48E3122D82370E8B8C079A329F9EE0BF83B69A28BF08B389DD07A513C4F821C5A17598124CB3C7FDE731B42FA780C6CA6AFEF4F1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.Z...........!..................... ........... .......................@...........@.................................h...S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H................................'...........................................0.w,a..Q....m...jp5.c.d.2......y.......+L...\|.~.-.....d.... .jHq...A..}......mQ.....V.l...kdz.b...e.O\...l.cc=....... n;^.iL.A`.rqg....<G..K....k......5l..B...@....l.2u\.E....Y=..0.&:..Q.Q...a....!#.V...........(..._....$....\|o/.LhX..a.=-f..A.v.q... .*....q......3....x4............j.-=m..ld..\c..Qkkbal..0e.N.b...l{.......W.....eP....\|......bI-...\|.eL..Xa.M.Q.:t....0..A..J..=

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-J909I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.424309444185535
Encrypted:	false
SSDEEP:	1536:RDZlBILcg+4i1JKw0uZU8hrLmKJVGoNJ+gAXCzGudAwKY6qCp8XbtLXKJSJeh8:RDZlaLu40JKw0uZUWyurTixqYJSJeh
MD5:	1B6F7752302A9C935FDF4AD8B05EEE42
SHA1:	6943D302D79BDCBF1C2ECCB8BD3A20626A083131
SHA-256:	384AEA68BDB1506BC02C74D4896DF9C5554002ED84429F4B078F7B8FB5CF75E0
SHA-512:	7E949ED62CE1E5BEAB6868B66CB326474355BB9E4D181844309DFC153ECBAC532C45D8E26656829B54BA8ECA76E82D7D52EB57F05CD5BE983750E2DD9F721EF8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................k......z......}......m............t......l......j......o....Rich...................PE..L...[..[...........!.....2.........."........P............................................@.............................P...<........................................Q.................................@............P...............................text....1.......2.................. ..`.rdata...T...P...V...6..............@..@.data...............................@....rsrc...............................@..@.reloc..^...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-JMUOS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	779264
Entropy (8bit):	5.71058373598344
Encrypted:	false
SSDEEP:	12288:HfA1S/ufXxLkW6ktCOK7yG3JNL0tXxDXO:HfduP9kr17HJNyX
MD5:	E6412D28466F5F41DC25E3C8985FDAAF
SHA1:	F012CBFBF0F60FFCC85CC27E960EC60B9CA83290
SHA-256:	C6F8BCBA87F718213FE463FC081F45636860593483839297514D8F6742F7CB7A
SHA-512:	4CF6D6479892C5A637F75DFAE57C782A76E738419A09596A3B2AE0C0EAE5FD5865645B7520C46C0F6258C7D06BD98B27246AF604B2D0F670FF1B98517D9A11E9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.Z...........!..................... ........... .......................@......T.....@.................................t...W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......<}..8~...................+.......................................B...B... ... ......B............B...B... ... ......B............B...B... ... ......B............B...B... ... ......B............B...B... ... ......B............B...B... ... ......B............B...B... ... ......B...............................B...........E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E`..E...E...E...E...E...E...E...E...E`..E`..E`..E`..E`..E`..E`..E`...............B..........

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-KL2RA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.160175641245332
Encrypted:	false
SSDEEP:	6:JiMV0mYyFR8aYseP/wWtgbY48Mx8apHtY48sFO:MMGo1YsejSb/rpt/G
MD5:	9D80BBCE0C9E0B8FC7AFC02573813389
SHA1:	00FD15B409B5475D2DAC4A4798EA0A66C72B35F9
SHA-256:	459C570B98A9858005AA6B98A4CE1900FAFB427465916DBDF392D7835BE9C73E
SHA-512:	82036EFF3E8A908C6D1BFF0475AADD062AD95D57162D5487C0C2D8A07E66CEE032CEEFDBC7BC3B8EC4E0D5C295C047CE6D6BAE630902822056A3D3B20687143D
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0"?>..<DSHOWDecodePre>...<FormatExt Ext=".WMV">....<EXCEPTION> .....<VIDEOCODEC>G2M;</VIDEOCODEC>....</EXCEPTION>...</FormatExt>...<FormatExt Ext=".WTV">...</FormatExt> ..</DSHOWDecodePre>

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-MRPUM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1193224
Entropy (8bit):	6.4180690298719245
Encrypted:	false
SSDEEP:	24576:C1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3Grvx9J8w:yQdhZgEN6GnJ0B
MD5:	6534DC07A839274161DB6F77BF18B631
SHA1:	D8BEF4E6FE81469C148EFECB6EFC3BE6FA1B174F
SHA-256:	B4BB1A45CFC27EE6B34A0A3EFDC2C9C9A6E774F8ED752272C992219021073679
SHA-512:	11419A4CD11EA661EDAB27AF3C982481CF1D06C7AF3621F1AA50F1E220C2CEBA98F88F59A46392BD816A584106C9789EB989BD2D3B79BD79BCD0C49DD200AD41
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S.....................2....................@..............................................@...............................7..................................................................................t................................text............................... ..`.itext.. ........................... ..`.data...80.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............R...................rdata...............R..............@..@.rsrc................T..............@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-NAN67.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6617
Entropy (8bit):	4.442808179295516
Encrypted:	false
SSDEEP:	192:C3f3b2gI0FT4fScXz6HhzRdxTTeRJOkjvLBnneseGiClCHJYOhIhrB5nT4MS6:OJ4HarHJeJ
MD5:	578B5516677A7E957EAD5C9A78A795FF
SHA1:	E6340AB25D4120D03A9434254821F6D8227C9F44
SHA-256:	83E7545549668145C0F5A8E439130735A3096F183DB98365A83BBAB2D1125812
SHA-512:	60673484DCFFA9275BD368B5961D0741018F4D649F14291BCE24D6F0BA11626180AAEB4D3A6C4747336E775475BC55D3CFEC1A4A8463BCA61DA64B0506E30B73
Malicious:	false
Reputation:	unknown
Preview:	message Datetime {.. optional uint32 time = 1;.. optional int32 zone = 2;..}....message Start_system {.. optional string pcsystem = 1;.. optional string pclanguage = 2;.. optional string pccountry = 3;.. optional string screenresolution = 4;.. optional string pcdpi = 5;.. optional string hasitunes = 6;.. optional string start_from = 7;.. optional string itunesversion = 8;..}....message Download_finished {.. optional string download_chooseformat = 1;.. optional string download_mode = 2;.. optional string download_sourcefrom = 3;.. optional int32 download_videoquality = 4;.. optional int32 download_musicquality = 5;.. optional string download_youtubeoneclickdownlaod = 6;.. optional string download_oneclickconvert = 7;.. optional string download_oneclickconvert_foramt = 8;.. optional string download_sourcebroswer = 9;.. optional string download_playlistcount = 10;.. optional string download_state = 11;.. optional string dow

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-NH10N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	136704
Entropy (8bit):	6.520098665229791
Encrypted:	false
SSDEEP:	3072:9XAkJxiu6rOD9KtVQWgyMDAg0FuFk+Qr:9wSxOO+V5PoAOs
MD5:	44716425D858F5D13C218A088C05FBAE
SHA1:	24C29F1B4855555B2D9F6B0406751290A39B618E
SHA-256:	B4F87FE154046A83C11BF44D740EC56B365628829892A05491450AD097D3236B
SHA-512:	5F64F6C3FFD49129BE5CD3BEEBF92E51700B95A255E167D846219E828DD69A3443A13895621C2774372E10FD9B9CD7AF11DA2F2A68407A0A301E428EAD970241
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............H..H..H...H..H...H..H...H..H...H..H..H..H...H..H...H..H...H..HRich..H................PE..L......[...........!.....T...................p............................................@.........................`...V............@.......................P.......q..................................@............p...............................text....S.......T.................. ..`.rdata...}...p...~...X..............@..@.data....E..........................@....rsrc........@......................@..@.reloc...&...P...(..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-Q6QUF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.435790700326355
Encrypted:	false
SSDEEP:	1536:D1mXeSmaxr2+m+/llW+R86PM7wxvsh6csX5Yn56x/EcvhCZ5EG+xPLPz:D1mgaxrjm3t6q8v0ghCTEG+xPLb
MD5:	FE1A434ABC02254927DC0F7F5810141D
SHA1:	569336BCB1A32562105E69FFC6614A2ABA3D2FA0
SHA-256:	DDE612A05CDD3B01077B38382986D4DD5CA629BE32DF607A6229743C2B548B5F
SHA-512:	AD69EE6CB590E673DED8E8EEB4E7293925D32D95731454217CF1186C9345507A7BF69F7024DBD64F3BA9DD916FEF676F3F059B9CC48FAD0B0197A0E41767C19E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+...J..J..J..2v..J...g..J..2g..J..2`..J..2p..J..J.J..2i..J..2q..J...w..J..2r..J.Rich.J.........PE..L......W...........!.....d...................................................p......1$....@.............................. ..h...d....0.......................@.........................................@............................................text...Tb.......d.................. ..`.rdata..yi.......j...h..............@..@.data...\|1..........................@....rsrc........0......................@..@.reloc...#...@...$..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-R16RT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	160972
Entropy (8bit):	5.121559708431894
Encrypted:	false
SSDEEP:	384:iUyEYi1WToM5iMmypyBMr5idt5MdsdrSv4D+nw02iA2fw2zf42utZ02D/S2IS299:h5ZFUFjj5
MD5:	D8BCD877F594B08C4AB996D624F63BB3
SHA1:	82BDEE11E3FAD9337E9B9A0DEC5B07A9028CF029
SHA-256:	3C71BC9879F49AB3DB3BB92CE3C1145A4E6D806CBF256776CF4333027B7D611C
SHA-512:	4C9D6DC6230855971787D3B026E2909CFEE1AF96A3EC565AFF2E4BE277F5004D8723543E6A80113571E544C90DCF3602C24CC695E77E6CE6EDB3E863A49FC5A6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>....<Product>.. <FormatInfo ID="100040" Skip="False" Icon="IconiPhone8" Categoryid="1" FourCC="IPAN" Format=".mp4">.. <Name>iPhone8(P,X)</Name>.. <Description>MP4 format for iPhone8, iPhone8 Plus, iPhone X</Description>.. <VideoEnc defVideoFourCC="IPAN" defResolution="19201080">.. <EncParam VideoFourCC="IPAN" Resolution="320240" defVideoBitrate="384 kbps" defFrameRate="30 fps">.. <VideoBitrate>256 kbps;384 kbps;512 kbps;768 kbps;900 kbps;1200 kbps;</VideoBitrate>.. <FrameRate>24 fps;30 fps</FrameRate>s.. </EncParam>.. <EncParam VideoFourCC="IPAN" Resolution="480320" defVideoBitrate="768 kbps" defFrameRate="30 fps">.. <VideoBitrate>384 kbps;512 kbps;768 kbps;900 kbps;1000 kbps;1200 kbps;1500 kbps;</VideoBitrate>.. <FrameRate>24 fps;30 fps</FrameRate>.. </EncParam>.. <EncParam VideoFourCC="IPAN" Resolution="640480" defVideoBitrate="900 kbps" defFrameRate="30 fps">.. <VideoBitra

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-RFB4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3669744
Entropy (8bit):	6.373097680958797
Encrypted:	false
SSDEEP:	24576:q3/HPWTu8r11WQlpElqOLXMJZ9RDOO4NvEdpVVS3KvbsY1BBQMF3X+9bjR:Y01JTYHWpVYKvbDrWMxX+9h
MD5:	549B0D73FA0B4BAECA0626153DB341F7
SHA1:	FBFA0E77B0448057A2EDA1DE1A9491B6B886D0AE
SHA-256:	6F96A90263695521E365DAD8FE1580F8E684A7C9D4DCFEC467E1E5B57CCA75D2
SHA-512:	431ACA3AB0E53B354076C6B6CCD1BE97862851F509A366A3F4AB4BC8D7CD0237E6FAAEF61D70245735A699ED54669759DCD4E7B319ECC507D5CA38D04228BD01
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-RFB4B.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......[......................).....l.............@...........................8.......8..........@...........................p..`>........'...........7..4...........................................................{..<............................text............................... ..`.itext..h........................... ..`.data....A.......B..................@....bss....LS...............................idata..`>...p...@..................@....tls....D................................rdata..............................@..@.reloc............... ..............@..B.rsrc.....'.......'.................@..@..............8.......7.............@..@................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-SRV69.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1492931
Entropy (8bit):	6.462107358021934
Encrypted:	false
SSDEEP:	24576:LwMAkAovRhn1S6eRgkwrt7q1OZuWJpQlrTwl:LF/Aa6Rgkwrtd0il
MD5:	98002162ED20CFDF9453B5E76E370E2A
SHA1:	EE626916FBB242DE452C52906EA233040299CD35
SHA-256:	66609F7D84D3371F465642CBD7E130A7E269DC25E7C71A113655527764DD30C6
SHA-512:	C8FD8DC7EA089C63948F8C7BDE972F6C471F4A82214531DF53920C3AE929D0E275191DB23AB228EC46C10101688F1833AD728AFEE40EF55ADAD5C51D8649DBD1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Y...........!...8..........................\|n.........................@......zH........ ..............................P...............................`...A...................................................................................text...d...........................`.P`.data...............................@.`..rdata..d...........................@.`@.rodata..*.......,..................@.`@.bss.... .............................`..edata..............................@.0@.idata.......P.......d..............@.0..reloc...A...`...B...n..............@.0B/4....................................@./19.....-.............................../35.....&.............................../47.....d.............................../61.....J.............................../73.....P.............................0./86.......... ........................../97.....h....0..........

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-T6Q6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	178243
Entropy (8bit):	4.910037384689572
Encrypted:	false
SSDEEP:	3072:A1jCZpcYItxU31ZIIGyn/fBw/q/SyTUUTVOb5qm7+4EreULahHLJaTbBKUiw7Jlu:A5CZpcYItxU31ZIIGyn/fBw/q/SyTUUE
MD5:	DFE8EA98E90785CBC84C89F486BE0456
SHA1:	6275375DCF402398FA23869C5A9EE81741140D4C
SHA-256:	8D9D0EBD77DE2A015C5E0C2530DD94A284A74EEB5C3CFD19CE7787387B4260AD
SHA-512:	2D230C3D3ADF15EB4E8DABB6F297148E012164348B633CA90FFC65431F585882FD65233153F76E2FB331B54C243C0CE295B7EE58DD8C08C6C19E14C52BEDC65B
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Wondershare_XML>.. <FILEDEMUXDLL>.. <AVDEC>.. <FDPAAC>.. <FORMATE_1>.. <EXTNAME CHAR="">.aac</EXTNAME>.. <PRIORITY INT="">15</PRIORITY>.. <DLLNAME CHAR="">fdpAAC.dll</DLLNAME>.. <FOURCC DWORD="">' CAA'</FOURCC>.. <DLLDESCRIBE CHAR="">AAC File</DLLDESCRIBE>.. </FORMATE_1>.. </FDPAAC>.. <FDPAC3>.. <FORMATE_1>.. <EXTNAME CHAR="">.ac3;</EXTNAME>.. <PRIORITY INT="">15</PRIORITY>.. <DLLNAME CHAR="">fdpAC3.dll</DLLNAME>.. <FOURCC DWORD="">' 3CA'</FOURCC>.. <DLLDESCRIBE CHAR="">AC3 File</DLLDESCRIBE>.. </FORMATE_1>.. </FDPAC3>.. <FDPAPE>.. <FORMATE_1>.. <EXTNAME CHAR="">.ape</EXTNAME>.. <PRIORITY INT="">15</PRIORITY>.. <DLLNAME CHAR="">fdpAPE.dll</DLLNAME>.. <FOURCC DWORD="">' EPA'</FOURCC>.. <DLLDESCRIBE CHAR="">APE File</DLLDESCRIBE>.. </FORMATE_

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-UTV22.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1872384
Entropy (8bit):	5.430226004217751
Encrypted:	false
SSDEEP:	24576:iw2pXGmfWF+YnbQC2pS/qm/f6aDYp5WlpF+5:6pXGpQC2A/qp5p
MD5:	0BDEF150B51E8CDC6547D33E8EBE21F5
SHA1:	C4F2EDD3890AFBF35042BE34EB38EDE0ED2591BF
SHA-256:	1D84CC9A239B3CA8E0ADACC9251A55C03E86B0A712E70AB692C4D0B9C8293ABB
SHA-512:	EC052AF1C1F8EEE04C2DF1CB053C73AE12B9C151514FEDC6426C1C7E6B041176584D7735BCD4F407C0275C5DF7CD8C755664C5B524B99FF4025BC5652D8CDD24
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.Z...........!................>.... ........... ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......,>...X..........@.......` ........................................UU..UU..UU..UU......f.!62.`P.T,.h.....X...z:.....&....#u.v..Y.A.. .&E.pA0b..t....w..#.O9..>.......J.Fw..B.I.....{k....S.!......M.Q..[.0...........(......0...........%(.....}......}......}.....0...........{......0...........{......0...........{......0...........(......0..%.......(....,.+..(....~.... ....oH...(I.......0..#.......(....,..+..+.,.+....(.......(....F...........(....*....0..

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-VDP19.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	448
Entropy (8bit):	4.741299771854692
Encrypted:	false
SSDEEP:	12:7OKb1nvnKbBeKbxRGDKDKOKbkRlKYKb19N/KbiXZ1KOKbpf2gj+o9b:7OKZKVeKVwDKDKOKKKYKh//KWp1KOKRn
MD5:	AFB0CE56193185C7B1E8B78E49CAF358
SHA1:	4F3CD62A59C899C26ED41F00FD9FAD6DE250FF95
SHA-256:	80B7739AC0AE58877AE65662997821A60F0136D7A9B039966B9236A1616A00AD
SHA-512:	B5C98A62484ED379719CBDDABD78E335BE55D6F7736DD0A54CE1D34A3B1EF53AD04FFBBB03BDF0DFA10C55B7EE8750C48BA77304FFBCEF30C26C564DB8A8B66F
Malicious:	false
Reputation:	unknown
Preview:	.<profile>.. <category id="1" title="Apple" icon="MenuApple"/>.. <category id="2" title="Android" icon="MenuAndroid"/>.. <category id="4" title="Video" icon="MenuCommonVideo"/>.. <category id="5" title="Audio" icon="MenuCommonAudio"/>.. <category id="3" title="Apple Software" icon="MenuAppleSoftware"/>.. <category id="6" title="Web Video" icon="MenuWebVideo"/>.. <category id="7" title="Game Devices" icon="MenuGameDevices"/>..</profile>

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-VO72Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	146432
Entropy (8bit):	6.437770652078323
Encrypted:	false
SSDEEP:	3072:sUHDph6wqJ6KzIuuoRCmCi5yyfxEUCeV05XaO9VKDzqk8jiw+wGr:sU4J9ombfxEURV8VxiuG
MD5:	1CB8B7968209C79451B6C66127267C99
SHA1:	D625283D991D4380E7EB6B638268228564F9161B
SHA-256:	1499CDBD4230EAA79FC771A8FC34AB6352C711706549799CE6CE80EF39BE4BD1
SHA-512:	39A20800E3AB8CC5258A4BB7583F240A77645C7399114A35721CA5F9FBD6653FC26137438EF4A72BF01DB34D467FFBE070FAD82F2328F9D7D49C0D2D8AD19DFE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........^q..^q..^q...>_._q..W.\.Iq..W.M.uq..W.J.(q..W.Z.Iq..^q...q..W.C.Qq..W.[._q..W.X._q..Rich^q..........PE..L......[...........!.....~..........M.....................................................@.............................V............p..........................H.......................................@...............L............................text....}.......~.................. ..`.rdata...q.......r..................@..@.data....W..........................@....rsrc........p......................@..@.reloc...-..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\is-VPARC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	193776
Entropy (8bit):	6.763656771383948
Encrypted:	false
SSDEEP:	3072:W/IWFsvdzzPARtTALlwejovffj4xj6Nkqmq3HbcO36w/lvGTBfeT+OiseV0zM0D:i8GtRejifj46Nmq3HbcOzlvGTBO3emlD
MD5:	153C6AFF1A3841CEBB112C27D2C7DE66
SHA1:	8ED00F86D0AF897DD85A7FB54DB768A065EB9017
SHA-256:	7CBC0994FD2980BF3A1D83FB54FF758BEB8F421DB8BB62CE6EE5C408798748DD
SHA-512:	B9ED432C62BC9B04B730E78CA653FFC57E3D5AB01DC51FEB6524D3651AEFE9ED4D97A50323257EB1A9E2DAAC7F21888C1DB1DB930E4BD7988CD044FFA618A34D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.._.a._.a._.a..Y..W.a.Vn..n.a.Vn..G.a.Vn....a.Vn..X.a._.`.*.a.Vn..E.a.Vn..^.a.Vn..^.a.Vn..^.a.Rich_.a.........PE..L......M...........!.................)....... ............................................@....................................P........................4...........".................................@............ ...............................text............................... ..`.rdata...~... ......................@..@.data...............................@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	InnoSetup Log Wondershare Free YouTube Downloader, version 0x418, 422426 bytes, 965543\37\user\376, C:\Program Files (x86)\Wondershare\Free Yo
Category:	dropped
Size (bytes):	422426
Entropy (8bit):	3.7032739013956752
Encrypted:	false
SSDEEP:	1536:PhXNKWBOpDE7Lt6kjbLe7KTz0IXjrqWXJHG/BA9uIL56V9Nu+za0cXtDjP773X/+:pX85Pqp6VVX
MD5:	A17AE88731044972C2BC79A902A3A4F9
SHA1:	E407ECC1D94AE64073A1FBF0EC1852DA372931E3
SHA-256:	8999726FBB75D5719D71ED19F51CB24E2181319974CF0E8DA947F83F085F0ED0
SHA-512:	E6856986842ED2A0235374BF9EDB954A3F88C4932E89B24797E6E62D7AF860D4BC2BDD75E25B25D4425A1130C1A16C31227B7BB46C04AA5FF8C2E0EE763ADAAC
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Free YouTube Downloader.........................................................................................................Wondershare Free YouTube Downloader.................................................................................................)....r..%..................................................................................................................g.........................9.6.5.5.4.3......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.o.n.d.e.r.s.h.a.r.e.\.F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r..................4.... ...........4..IFPS....?...............................................................................................................................................................BOOLEAN..............TEXECWAIT.........TWIZARDPAGE....TWIZARDPAGE.........TCHECKBOX....TCHECKBOX.........TNEWSTATICTEXT....TNEWSTATICTEXT...................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1193224
Entropy (8bit):	6.4180690298719245
Encrypted:	false
SSDEEP:	24576:C1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3Grvx9J8w:yQdhZgEN6GnJ0B
MD5:	6534DC07A839274161DB6F77BF18B631
SHA1:	D8BEF4E6FE81469C148EFECB6EFC3BE6FA1B174F
SHA-256:	B4BB1A45CFC27EE6B34A0A3EFDC2C9C9A6E774F8ED752272C992219021073679
SHA-512:	11419A4CD11EA661EDAB27AF3C982481CF1D06C7AF3621F1AA50F1E220C2CEBA98F88F59A46392BD816A584106C9789EB989BD2D3B79BD79BCD0C49DD200AD41
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S.....................2....................@..............................................@...............................7..................................................................................t................................text............................... ..`.itext.. ........................... ..`.data...80.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............R...................rdata...............R..............@..@.rsrc................T..............@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\unins000.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	InnoSetup messages, version 5.5.3, 221 messages (UTF-16), &About Setup...
Category:	dropped
Size (bytes):	22705
Entropy (8bit):	3.2703725065879072
Encrypted:	false
SSDEEP:	192:QR1EjXgkg3Sqf8sfr69FT0AKanzLYfMa1GzvL7Vzo+oc51USQDztXfbKJUfvo:QR1Elvqf9r6fKVfMVRo+t1USQDztP3o
MD5:	BC64B8EB7B87880AE5410D025B4B3378
SHA1:	117DDEB175EEC74889F6ADD10D556968420B3931
SHA-256:	738E8D752723D436F141B1CB491362DC5E2FB354894E3C3EEFA275D4A86071DC
SHA-512:	9D819CA081091D528DDF645303B28B322C6FFF6DBCA04FDC098D53CAE5D610E00E043FC1C0C1E4ECA1ED3B5E837E61775A06CD182F9BD79BCBDFAA206661919B
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Messages (5.5.3) (u).....................................dX.........I&.A.b.o.u.t. .S.e.t.u.p.........%.1. .v.e.r.s.i.o.n. .%.2.....%.3.........%.1. .h.o.m.e. .p.a.g.e.:.....%.4.....A.b.o.u.t. .S.e.t.u.p...Y.o.u. .m.u.s.t. .b.e. .l.o.g.g.e.d. .i.n. .a.s. .a.n. .a.d.m.i.n.i.s.t.r.a.t.o.r. .w.h.e.n. .i.n.s.t.a.l.l.i.n.g. .t.h.i.s. .p.r.o.g.r.a.m.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s... .A.f.

C:\Program Files (x86)\Wondershare\Free YouTube Downloader\usExp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1089024
Entropy (8bit):	6.444956936319174
Encrypted:	false
SSDEEP:	24576:+NY3WQ+cPKKFvUF/1hh4Y4WDBJe5xODJD:f3R+cPFlUF/174Y4WDbe5xODJD
MD5:	5A287275C61F3479AF8BEDE5BFA7B3A8
SHA1:	4BA7DDF1170AC4A0062E18FA9B30AE7BFDDCA6F8
SHA-256:	4BE58F512EE5C913350BB8D2103E81E6F6D82399224916F06F115C2906DA02AD
SHA-512:	A19AD1F999934DFBC82EEEB35F166A2F724AE3C655439F945451D810BE6933202A06C228595902B7D6139B213507CF000D8FFCDE1EB02A4BAA06AB289EE54BA1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T.b...b...b.._-,..b..../..b....9.}b...b...b....)..b....>..b....0..b....(..b...0...b....+..b..Rich.b..................PE..L......W...........!.....F...T.......I.......`............................................@......................... .......P...d....@.......................P...w..@b..................................@............`...............................text...{D.......F.................. ..`.rdata.......`.......J..............@..@.data....Q.......0..................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare\Free YouTube Downloader\Wondershare Free YouTube Downloader.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 19:25:08 2024, mtime=Thu Apr 25 19:25:11 2024, atime=Wed Dec 18 09:25:16 2019, length=1366256, window=hide
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	4.5151607670837315
Encrypted:	false
SSDEEP:	48:8PdnkdOAn1Ri5cF7KfyKzd025n7d025nud025ceyF:8ftB58cey
MD5:	5B24ABDBBEBF904A4C49602E5910F29F
SHA1:	47DBA71F07320982A8A85C7E01C30162B3B8116B
SHA-256:	C56C5FFD1144A8E09B88576A437F9C5CF1905C869C427987192611863F4B6FE1
SHA-512:	E13CB4366AD232105270977CC44BC8F34814F90219C3885B6BC3999D18AAD285359F03AB4C77C6CA6FC1EA0F67741A3D017764F662C96DE38CA495BCC0470223
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....&.N.......N.....p.................................P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V.......+.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....`.1......X....WONDER~1..H......X...X......=.......................+.W.o.n.d.e.r.s.h.a.r.e.....x.1......X&...FREEYO~1..`......X...X&.....J.....................$r..F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.......2......O(S .FREEYO~1.EXE..d......X%..X%......L........................F.r.e.e.Y.o.u.T.u.b.e.D.o.w.n.l.o.a.d.e.r...e.x.e.......................-............................C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe..T.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.o.n.d.e.r.s.h.a.r.e.\.F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.\.F.r.e.e.Y.o.u.T.u.b.e.D.o.w.n.l.o.a.d.e.r...e.x.e.f.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.

C:\ProgramData\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	1632
Entropy (8bit):	3.6498612004882998
Encrypted:	false
SSDEEP:	48:rsK4Z0eOBIZCNW5AJ5jDXALdno7VUI6IHd0R5V5:rsK4Zw+YsAXDd0fj
MD5:	B4AB2DF31F0072FA9AFEFFD2413321A4
SHA1:	E6D4E7DF581ECE818D2DBF5BA7EAAEE7EAAE83FC
SHA-256:	E8E97544F372E4AB041BBB57E908A244CB686AB109270DC28E0D02AF0ADBD7E8
SHA-512:	6290B739F70FB440E471AD690F35754F86BF9CCEE2C1814891598EE7D5079E5E57D70D9C5CDED8BB1896DFE75E33E395C7304F2F854F9FFC99EF5614D3B597D3
Malicious:	false
Reputation:	unknown
Preview:	..[.S.y.s.t.e.m.].....P.r.o.d.u.c.t.I.d.=.3.8.4.....D.e.f.a.u.l.t.L.a.n.g.u.a.g.e.=.E.N.G.....U.p.d.a.t.e.P.a.c.k.a.g.e.U.R.L.=.h.t.t.p.:././.r.e.s.o.u.r.c.e...w.o.n.d.e.r.s.h.a.r.e...c.o.m./.0.0.2./.8.8.6./.F.r.e.e.Y.o.u.T.u.b.e.D.o.w.n.l.o.a.d.e.r.T.r.a.n.s.f.e.r.P.r.o.c.e.s.s...e.x.e.....U.p.d.a.t.e.I.n.i.U.R.L.=.h.t.t.p.:././.r.e.s.o.u.r.c.e...w.o.n.d.e.r.s.h.a.r.e...c.o.m./.0.0.2./.8.8.6./.T.r.a.n.s.f.e.r.U.p.d.a.t.e...i.n.i.....A.l.l.I.n.s.t.a.l.l.F.i.n.i.s.h.e.d.=.1.....D.e.f.L.a.n.g.u.a.g.e.=.E.N.G.....D.e.f.I.n.s.t.a.l.l.L.a.n.g.=.E.N.G.....D.e.f.I.n.s.t.a.l.l.S.k.i.n.=.E.N.G.....I.n.s.t.a.l.l.P.r.o.d.u.c.t.I.D.=.3.8.4.....S.h.o.w.I.n.t.r.o.d.u.c.e.=.1.....D.e.f.S.k.i.n.=.E.N.G.....F.u.l.l.N.a.m.e.=.F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.....N.a.m.e.=.F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.....A.p.p.E.x.e.N.a.m.e.=.F.r.e.e.Y.o.u.T.u.b.e.D.o.w.n.l.o.a.d.e.r...e.x.e.....U.p.d.a.t.e.P.e.r.i.o.d.=.7.....P.r.o.d.u.c.t.U.p.d.a.t.e.V.e.r.s.i.o.n.=.7...4...7...3.....D.o.

C:\ProgramData\Wondershare\Free YouTube Downloader\LiveUpdate.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.304447552000666
Encrypted:	false
SSDEEP:	6:0BVyiIQLGVQWKo3Vf/r+ykiUyp/bNHMV60kn:liPGOWfCXiUypjFMM0k
MD5:	8268C0572EBE9DD1E47831611004E4BB
SHA1:	2CFF70E3948C51B13EE0F5D6DDC259B15CFCC04F
SHA-256:	59A0BAFBD28DA1C9A9F729D1460B7A20DE8D9E5B2626D72A5BD7D5839D544930
SHA-512:	35F8208B37DA353E264E1D9FC78D0BC17917E0750A9F1786AB41056790F69C7834BD186EEDECA63246735DC303274AF470D2C4996E8A987B800A03F795F6EFBC
Malicious:	false
Reputation:	unknown
Preview:	[System]..UpdateUrl=http://cbs.wondershare.com/go.php?m=upgrade_info&pid={0:s}&version={1:s}&email={2:s}..AppExeName=FreeYouTubeDownloader.exe..Email=..Version=5.0.0.0..UpdatePeriod=1..LastUpdateTime=2012-09-10 05:30:27..SkipCheck=false..

C:\ProgramData\Wondershare\Free YouTube Downloader\is-L99G6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	238
Entropy (8bit):	5.304447552000666
Encrypted:	false
SSDEEP:	6:0BVyiIQLGVQWKo3Vf/r+ykiUyp/bNHMV60kn:liPGOWfCXiUypjFMM0k
MD5:	8268C0572EBE9DD1E47831611004E4BB
SHA1:	2CFF70E3948C51B13EE0F5D6DDC259B15CFCC04F
SHA-256:	59A0BAFBD28DA1C9A9F729D1460B7A20DE8D9E5B2626D72A5BD7D5839D544930
SHA-512:	35F8208B37DA353E264E1D9FC78D0BC17917E0750A9F1786AB41056790F69C7834BD186EEDECA63246735DC303274AF470D2C4996E8A987B800A03F795F6EFBC
Malicious:	false
Reputation:	unknown
Preview:	[System]..UpdateUrl=http://cbs.wondershare.com/go.php?m=upgrade_info&pid={0:s}&version={1:s}&email={2:s}..AppExeName=FreeYouTubeDownloader.exe..Email=..Version=5.0.0.0..UpdatePeriod=1..LastUpdateTime=2012-09-10 05:30:27..SkipCheck=false..

C:\ProgramData\Wondershare\Free YouTube Downloader\is-TREFO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	3.4789713879192425
Encrypted:	false
SSDEEP:	6:Q+slckRG4K1aplJ/lxelFElyduVN+IaR5UmxQK7h49:Q+sGks4K1ix4HEJaR5riK7s
MD5:	42C5F0D3DF172E1DA4017FB2EF4CC3C8
SHA1:	75A5E0BA8EBFF2C4E94AB9DB401ECFB8125ABF4E
SHA-256:	80DAE9B2D52001EAEF58884B8D12E6FC1272873E13C1309FEF9F089A9496D035
SHA-512:	0A98869FFE1B865A376420CF7833BBB9A3243972AAFFE1E05606ECE647DDFB818D2D9A8C6EFAACF5534591E4A3C805C781009C611F35C2F52FC969AF94B1D4B1
Malicious:	false
Reputation:	unknown
Preview:	..[.S.y.s.t.e.m.].....P.r.o.d.u.c.t.I.d.=.2.3.5.....D.e.f.a.u.l.t.L.a.n.g.u.a.g.e.=.E.N.G.........[.D.o.w.n.l.o.a.d.].........[.L.o.g.g.e.r.].....L.e.v.e.l.=.2.9.........[.W.o.r.k.i.n.g.D.i.r.e.c.t.o.r.y.].........[.U.p.d.a.t.e.].....A.u.t.o.C.h.e.c.k.=.T.r.u.e.........[.R.e.s.S.i.t.e.s.].....

C:\Users\Public\Desktop\Wondershare Free YouTube Downloader.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 19:25:08 2024, mtime=Thu Apr 25 19:25:08 2024, atime=Wed Dec 18 09:25:16 2019, length=1366256, window=hide
Category:	dropped
Size (bytes):	1576
Entropy (8bit):	4.527836028766374
Encrypted:	false
SSDEEP:	48:8JdnkdOAn1Ri5cF7KfyKzd025nXd025nud025ceyF:8dtBl8cey
MD5:	7B0C6F9E8C23DD43D724E93B6BDC6233
SHA1:	20F5CDBCCF61BB98D73E1FD4FBBB3EADC052DF0F
SHA-256:	9CB22DAAD247C680F1610640FD4D2371FFB025A65EF1B1DCF9CBEABB6F022D97
SHA-512:	F1151D47C8AD100DD9E0C305DE7EE64BCC76BD585A3B74CCDEE9CCD54CB1FE21EA9F293359E84F9FFA2C9F1BD84485F3F2A820D675EE2A6F9FD6AEE744C11D2F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....&.N...k..N.....p.................................P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V.......+.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....`.1......X....WONDER~1..H......X...X......=.......................+.W.o.n.d.e.r.s.h.a.r.e.....x.1......X&...FREEYO~1..`......X...X&.....J.....................$r..F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.......2......O(S .FREEYO~1.EXE..d......X%..X%......L........................F.r.e.e.Y.o.u.T.u.b.e.D.o.w.n.l.o.a.d.e.r...e.x.e.......................-............................C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe..T.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.o.n.d.e.r.s.h.a.r.e.\.F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.\.F.r.e.e.Y.o.u.T.u.b.e.D.o.w.n.l.o.a.d.e.r...e.x.e.Z.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.o.n.d.e.r.s.h.a.

C:\Users\Public\Documents\Wondershare\DownTask_384.xml

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	XML 1.0 document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	245
Entropy (8bit):	5.162336502233613
Encrypted:	false
SSDEEP:	6:TMVBd//3SM/AXF9jt5LTEWXGlwgBbhBbyZ1vhZ/0KKdu:TMHdHiMIXLLybthtuoRdu
MD5:	59267490962FA2793D08BDDD61F1F587
SHA1:	F06FE544060A4A754D09D157F46BABF5A7427BB3
SHA-256:	1BE93275C0048E7F440E5E2861D8E7C58DAA2A3B91643B544D130E4942252CA6
SHA-512:	260A81B3F24D109B39A353343694FF51589C6A6617ADE6CBB3FEC324BB4EC2A61BF81ED37BBB9FE8AB8A5A97B1FA0B4FCB77CF309183211686A726533FE204AA
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<config status="3" JoinUserExperience="1">..<installpath>C:\Program Files (x86)\</installpath>..<task>..<complete>yes</complete>..<Installed>yes</Installed>..<ProductID>384</ProductID>..</task>..</config>..

C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15136
Entropy (8bit):	6.5035283351525734
Encrypted:	false
SSDEEP:	192:V1NyR5a1UwaYTnYe+PjPQu7RZgjl6rcOO5+vW5r9ZCspE+TMQrkxW:bNyra1UwaSnYPLQa6jaleMHW
MD5:	10A678F6B41D513E27FAC510F4368A32
SHA1:	3BEA1FEECA566FD9C6A01A4B54CCAC04A28BD082
SHA-256:	D96D6A2AB0E0A80E3D394B0015662EE1F2B9F0668BB13AE1AFF33576272BA807
SHA-512:	9042A1ACBDA888E927E39E2183B5001ED5EF22F9D0E618FE27CF2C4CC53FD79BFA352FBE2457B4D8524FFF532D227A9984D094D108D8075D74F191597B153321
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....v.P.............................-... ...@....@.. ..............................:.....@..................................-..W....@.................. #...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......L!...............................................................0..H.......(....(....(....(....(....(....(....(.........r...p.o....(....(.................,,......V....s....&rA..p(....Fs....&r...p(....Fs....&r...p(....Fs....&rG..p(....Fs....&r...p(....Fs....&r...p(....Fs....&re..p(.....r...p(......(......BSJB............v2.0.50727......l...@...#~..........#Strings....l.......#US.x.......#GUID...........#Blob...........G.........%3............................

C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe (copy)

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39787352
Entropy (8bit):	7.999727175455383
Encrypted:	true
SSDEEP:	786432:wmEfE/nHxO19iDLdK3IjHb9s88pnjqxngz96W0iNDdSSCuFi6kYPlsl:wtfW8wJK4Nsdn+Rgz96W0oDdSpigYPCl
MD5:	E1F9B186653025CDA1496212A7F57114
SHA1:	B7B387F53C7A179941280A721D8B11EC48DA2212
SHA-256:	CC079D507EF96CF7EA1B82205B74744A7B7848582BE8F5F0BE39029EE9A49C3E
SHA-512:	4A9103DA0F71FEDC726DA63AC4720C01ED7AD84FB83DE1574429167D229432697ED97E92BBF3618CFA32FAF95781458BCD9B8AD60F094EEB33DA6DDCDB7B6178
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S..................................... ....@..................................._..........@......................................X...........h.^..4....................................................................................].n....text...,........................... ..`.itext..D........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.....................................rdata..............................@..@.rsrc...X............ ..............@..@....................................@..@........................................................................................................................................

C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe.~P2S

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39787352
Entropy (8bit):	7.999727175455383
Encrypted:	true
SSDEEP:	786432:wmEfE/nHxO19iDLdK3IjHb9s88pnjqxngz96W0iNDdSSCuFi6kYPlsl:wtfW8wJK4Nsdn+Rgz96W0oDdSpigYPCl
MD5:	E1F9B186653025CDA1496212A7F57114
SHA1:	B7B387F53C7A179941280A721D8B11EC48DA2212
SHA-256:	CC079D507EF96CF7EA1B82205B74744A7B7848582BE8F5F0BE39029EE9A49C3E
SHA-512:	4A9103DA0F71FEDC726DA63AC4720C01ED7AD84FB83DE1574429167D229432697ED97E92BBF3618CFA32FAF95781458BCD9B8AD60F094EEB33DA6DDCDB7B6178
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S..................................... ....@..................................._..........@......................................X...........h.^..4....................................................................................].n....text...,........................... ..`.itext..D........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.....................................rdata..............................@..@.rsrc...X............ ..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	unknown
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.2361171502523645
Encrypted:	false
SSDEEP:	6:kKuY/lEN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:WY/lbkPlE99SNxAhUeVLVt
MD5:	42B1D9D4BAF1CAC0B496A106D837F029
SHA1:	68F29977CADA1EE1CAB70A31CDA3A7CA41859361
SHA-256:	4E5A82FAC312D7631BF18851C2327E34B6CAAC6B426C0513CBBFCADF24D5A09B
SHA-512:	92A7D8A6212FD75434C7481EC1F033CD7D1139FE7AB85A16AEB1B39FF334BD66C3106905B04A7566E6493FE4A735668F74A2166BB6DE918A1BC0551A74C3A2F1
Malicious:	false
Reputation:	unknown
Preview:	p...... ..........{N...(....................................................... ........M.........(.....wl....i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\NFWCHK.exe.log

Download File

Process:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1122
Entropy (8bit):	5.2849126453577275
Encrypted:	false
SSDEEP:	12:Q3LaJVV+06uytKr0zaj3Ui0tV3NON0NGOFia0kZs1B01ku9EZv4hk70hK9UYU7K4:MLUFytraOVo69zuRqKKPKovad4j
MD5:	D45FCD12C15FDE677453F6B8AB5AF463
SHA1:	F40BD19D49A6B46B19FC3BA26C60CDC29B0D1D9C
SHA-256:	804DAEFBC9A0C7A4E85DD5ED67955AECAF60D7A380EB02B62B8047A860B0E9D2
SHA-512:	94A5FB8EF171269A6E54D1C69AF52494BBB1B3428CAFE4C97E9F87C9A8EC8D07447FF5E2D4990298D4A31CCFD5D500E71A537FB748E38AB7CD0D9CA1EE4CB7A9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System\60bcd4094a2a6aa9ef85662f2bad1392\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data\73f96f8da5c1a1efcb8da556fcac8364\System.Data.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml\51eba73acef6415c0bc79a3a79838d51\System.Xml.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Transactions\59088b9870333921d7eaed9805bb5e59\System.Transactions.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Management\a5d6bb3c8e79ee7cb09af4e3de1f319d\System.Management.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing\4bbfa2b2d090d47bd2f1e96192ff5526\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\cb818943a42d691b19f93868cb8bd2f5\System.Windows.Forms.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\1b7e179ed0a73b93974e32cc02d2b317\System.Con

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CreateLib.exe.log

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PluginInstaller.exe.log

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.36509199858051
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2ql2ABgTv:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAv
MD5:	3C63E66D9AEEF8DBC085D1459854EE3E
SHA1:	770A084649B3A7D9CB0CF1A5B922FE2AC9D59122
SHA-256:	06DF1E84C6419E6B0752C1CFD1B9D51A5D3EC1BC44513B5C1EB7400FA18760C4
SHA-512:	8626E48E0854AC46C4024F00A6FF170EFE896C06D2E37022FE6F757FBD933EEE00E97D977F5B13CA5A41822651E32469B152778B04296657E0B4F19DEF18F103
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fit-style1.0.1[1].css

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	ASCII text, with very long lines (356), with no line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.777343980436387
Encrypted:	false
SSDEEP:	6:UnKqHna4PkcmcSsKPs9sSsG1csotsNcSstsE4vsltgd1Vc6OjVLy:2XHa4PkcsAZ1cIQsE4vO+Vc6OVy
MD5:	1ECF70DEFA6864C395BA45F197EE4649
SHA1:	FF47F4E78288B6AB0957F741FD29B904F73B20B0
SHA-256:	2FBB241554FF696FC44487AD8D878F92A002DC5438A679A0CD6982C161A4BDE7
SHA-512:	646840AE5443A7E4F1F4C2BF46FE088B3AD2CFDAE990F8452F57F4E71FB0CA6D8193017CC46FA0A26371DE5498D99A510A5961407A915CD414F642F2FC65AEC0
Malicious:	false
Reputation:	unknown
Preview:	html,body,div,img{border:0px;margin:0px;padding:0px}html{width:650px;height:315px;overflow:hidden}.container{position:absolute;width:650px;height:315px;padding:0px;left:0px;top:opx;overflow:hidden}.fitsize{width:650px;height:315px;border:0px;padding:0px;cursor:hand;cursor:pointer}.nohand{cursor:default}.orbit-bullets,.slider-nav{height:0px;dislplay:none}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\01[1].png

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	PNG image data, 650 x 315, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	32132
Entropy (8bit):	7.975684855942307
Encrypted:	false
SSDEEP:	768:m+CK4F+PLZyY6QNNop/KZN/fXN9A+B2KvfVVnOjv9s:VCKm+TZHLrop/4/fd+KHw+
MD5:	405009D9FABB41E784C1CBE528223C19
SHA1:	80B62B6460024B790867134E44A22A8AC594DAC5
SHA-256:	F19B51976FAAC3A46A293E83C8786514B83038B7F5ADDF269CFB81A605DA5A38
SHA-512:	5C4004565C78A348A33DFAD6A7466C63C00F34502991112AF7E5203CC4820D9D92C61763E2BBF03C045CA76FB1FBEBC355DBA7CCF62E7DCADE37C7BFEF093CCE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......;......h7.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:94d3bc15-ff4d-4edb-a9af-34f73b6d08dd" xmpMM:DocumentID="xmp.did:ACFB68ACF25E11E4B120D4F417EBC833" xmpMM:InstanceID="xmp.iid:ACFB68ABF25E11E4B120D4F417EBC833" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fe9df901-2192-4282-bb64-218d2d783b17" stRef:documentID="adobe:docid:photoshop:abf45f86-3a73-1178-93eb-cd8d047bb07c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......y.IDATx..}..%E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\02[1].png

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	PNG image data, 650 x 315, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	110176
Entropy (8bit):	7.995151704847901
Encrypted:	true
SSDEEP:	1536:mk6SkSL2euAPQfC9WQZAEiWS0xjKVlkFDgiblNgLgZXVlnXCS0Geg/a:CS1SqK54Agr5Xbog9Vln/0T
MD5:	F521DB8C0CE46E6E0C9725F89DDB588B
SHA1:	106EFED6050B3E4BD17636D3D5E53EA717AE32E3
SHA-256:	F6A02916280BF2436AD59966FAB58BC9A449351AD9B9990437DE8F04B43E8ACC
SHA-512:	341239B0C5A86E582DAA0A6614AB01A5156CA26674896970EA4E7B4A96C9D0F9BDA686B1D57EAD14ABA1E86FBCA170F2983EFBF5E870FBAF5C707D3F88994F80
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......;......h7.....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:94d3bc15-ff4d-4edb-a9af-34f73b6d08dd" xmpMM:DocumentID="xmp.did:A27A2E9CF25E11E4B120D4F417EBC833" xmpMM:InstanceID="xmp.iid:A27A2E9BF25E11E4B120D4F417EBC833" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fe9df901-2192-4282-bb64-218d2d783b17" stRef:documentID="adobe:docid:photoshop:abf45f86-3a73-1178-93eb-cd8d047bb07c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Xw.&...pIDATx....dW

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ytd384[1].htm

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.367962092355542
Encrypted:	false
SSDEEP:	24:hziIXsSt5XD1KXCoGsZBuNVMhZkNVI5UNBgeUmrBE0xKAMozFbXU1HAJxhXJHAak:8Lsmz5mVrBTxlMopbXjX96Itg3fiRk
MD5:	C3E8EE7606490F410A5669DDFA56703C
SHA1:	E73135858F0348433CA77FBAE098EE9EBF49B404
SHA-256:	942788CCC84EBC12D7AF89C82B32C5D38DF6031EC3790D4CA7C7DE608C4ED216
SHA-512:	8303B3991F57883574BB753156D2BF19827914A0E35FA66B94256F8826CEEBADF12D6E3D2B28BDDD53E0FB91107F433372C72A002D6D2D4D38FE9A9856FF0F98
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>...<head>....<meta charset="utf-8" />....<meta http-equiv="Content-Type" content="text/html; charset=utf8">......<meta http-equiv="pragma" content="no-cache">....<meta http-equiv="Cache-Control" content="no-cache, must-revalidate">....<meta http-equiv="expires" content="Thu Jan 27 2015 09:00:00 GMT+0800">.. ....<title>Ads</title>.... Attach our CSS -->... .<link rel="stylesheet" href="style/orbit-1.3.0.css">....<link rel="stylesheet" href="style/fit-style1.0.1.css">....<script type="text/javascript" src="style/jquery-1.4.4.min.js"></script>....<script type="text/javascript" src="style/jquery.orbit.min.js"></script>... [if IE]>.. <style type="text/css">.. .timer { display: none !important; }.. div.caption { background:transparent; filter:progid:DXImageTransform.Microsoft.gradient(startColorstr=#99000000,endColorstr=#99000000);zoom: 1; }.. </style>..<![endif]-->..<script type="text/javascript">...var urls = ['','',''];...jQuery

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\orbit-1.3.0[1].css

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	ASCII text, with very long lines (2022)
Category:	dropped
Size (bytes):	2387
Entropy (8bit):	5.0259114655968
Encrypted:	false
SSDEEP:	48:ZEIl+y3tkkCVZPRAUVL9qAgE7PWcIZUkgcU:mIl+y3mkCHRhl9q34PWcIZVU
MD5:	AD34AF4F9E2EDBC582E160B9436D5F7A
SHA1:	C67F11F41872AD88C3B821198620DD2425DB5E14
SHA-256:	EBEE997B48F765401646FB81E552854D49ADB484FA65D3B26CFABA5B1F00F171
SHA-512:	82482267646CBDC9C8F376F58A5D90AE149BBB3388730E2199295A5C620024E06A8AF18BF09DDDE2755F4DED52F3CF4B12D69613F6180A7480C87657E02DD2B3
Malicious:	false
Reputation:	unknown
Preview:	div.orbit-wrapper{width:1px;height:1px;position:relative}div.orbit{width:1px;height:1px;position:relative;overflow:hidden}div.orbit img{position:absolute;top:0;left:0;display:none}div.orbit a img{border:none}.orbit div{position:absolute;top:0;left:0;width:100%;height:100%}div.timer{width:40px;height:40px;overflow:hidden;position:absolute;top:10px;right:10px;opacity:.6;cursor:pointer;z-index:1001}span.rotator{display:block;width:40px;height:40px;position:absolute;top:0;left:-20px;z-index:3}span.mask{display:block;width:20px;height:40px;position:absolute;top:0;right:0;z-index:2;overflow:hidden}span.rotator.move{left:0}span.mask.move{width:40px;left:0}span.pause{display:block;width:40px;height:40px;position:absolute;top:0;left:0;z-index:4;opacity:0}div.timer:hover span.pause,span.pause.active{opacity:1}.orbit-caption{display:none}.orbit-wrapper .orbit-caption{background:#000;background:rgba(0,0,0,.6);z-index:1000;color:#fff;padding:7px 10px;font-size:13px;position:absolute;right:0;bottom:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\jquery-1.4.4.min[1].js

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	ASCII text, with very long lines (18999)
Category:	dropped
Size (bytes):	78085
Entropy (8bit):	5.371705153533769
Encrypted:	false
SSDEEP:	1536:UqfSu6aXlmaGWfiI7eldq3JqfugN3b9TV67+xjZopCrFSnPj7wrQBxA4m97:UvFKlVeO3IhFSnwrMxA4m97
MD5:	3A7AC86D2B0DC289466CF3E04033E0FA
SHA1:	3BC394782D1C64418EAD3EAC06C25A6261DF335C
SHA-256:	9059865307145AC7B94FF58B35AB3CA5F216FBC8256C255BFE8F69A04409E01D
SHA-512:	9A7C4A96899E1A4326DA1382F30D1203039BEE7B5B5030070EEAD9959091264A01083E6A031A3E470B1305DCEF32A2FA2D24B708AAB1D908A9D6A6A57FE0C3A3
Malicious:	false
Reputation:	unknown
Preview:	(function(E,B){function ka(a,b,d){if(d===B&&a.nodeType===1){d=a.getAttribute("data-"+b);if(typeof d==="string"){try{d=d==="true"?true:d==="false"?false:d==="null"?null:!c.isNaN(d)?parseFloat(d):Ja.test(d)?c.parseJSON(d):d}catch(e){}c.data(a,b,d)}else d=B}return d}function U(){return false}function ca(){return true}function la(a,b,d){d[0].type=a;return c.event.handle.apply(b,d)}function Ka(a){var b,d,e,f,h,l,k,o,x,r,A,C=[];f=[];h=c.data(this,this.nodeType?"events":"__events__");if(typeof h==="function")h=h.events;if(!(a.liveFired===this\|\|!h\|\|!h.live\|\|a.button&&a.type==="click")){if(a.namespace)A=RegExp("(^\|\\.)"+a.namespace.split(".").join("\\.(?:.*\\.)?")+"(\\.\|$)");a.liveFired=this;var J=h.live.slice(0);for(k=0;k<J.length;k++){h=J[k];h.origType.replace(X,"")===a.type?f.push(h.selector):J.splice(k--,1)}f=c(a.target).closest(f,a.currentTarget);o=0;for(x=f.length;o<x;o++){r=f[o];for(k=0;k<J.length;k++){h=J[k];if(r.selector===h.selector&&(!A\|\|A.test(h.namespace))){l=r.elem;e=null;if(h.pre

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\jquery.orbit.min[1].js

Download File

Process:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
File Type:	ASCII text, with very long lines (9817), with no line terminators
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.024765555749765
Encrypted:	false
SSDEEP:	192:DoBXmdUgaPbCqbGpl1aKazCwbKwujCfQ86c5O5xn5MRS5Maq6mbCy93T:UB2CgaPjbW4CwbKTjCfQ8HaXMkMUij
MD5:	C2A92B3EA04E88A0936C263E3F52D05A
SHA1:	B2F9119D4BD7FA0B8FE0351B014DF73DB44BB158
SHA-256:	5436B5A5AD531179EBB1BD66519A50B8A2B02A8E1B06E8E5B8487A9FF9635BB6
SHA-512:	185B5BEB92F59CF55D3B51A961BC9473531F6898E9CAB19020529D4D4A000D6CEA412AE6B8832CDC405E4C7575512B6B8D2D9076E357DB4A814042C38E9E3C29
Malicious:	false
Reputation:	unknown
Preview:	(function(c){var g={defaults:{animation:"horizontal-push",animationSpeed:600,timer:!0,advanceSpeed:6E3,pauseOnHover:!1,startClockOnMouseOut:!1,startClockOnMouseOutAfter:1E3,directionalNav:!0,captions:!0,captionAnimation:"fade",captionAnimationSpeed:600,bullets:!1,bulletThumbs:!1,bulletThumbLocation:"",afterSlideChange:c.noop,centerBullets:!0},activeSlide:0,numberSlides:0,orbitWidth:null,orbitHeight:null,locked:null,timerRunning:null,degrees:0,wrapperHTML:'<div class="orbit-wrapper" />',timerHTML:'<div class="timer"><span class="mask"><span class="rotator"></span></span><span class="pause"></span></div>',captionHTML:'<div class="orbit-caption"></div>',directionalNavHTML:'<div class="slider-nav"><span class="right">Right</span><span class="left">Left</span></div>',bulletHTML:'<ul class="orbit-bullets"></ul>',init:function(a,b){var d,e=0,f=this;this.clickTimer=c.proxy(this.clickTimer,this);this.addBullet=c.proxy(this.addBullet,this);this.resetAndUnlock=c.proxy(this.resetAndUnlock,this);th

C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\KPByName.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	6.012459225737119
Encrypted:	false
SSDEEP:	768:lQ8ZQKneCKmzF5Ltgl6nPhbyDGnTEDtP6FPBvU+Kw:i6e+ln5Ossy0+Kw
MD5:	4EF13E267EBBF804DD4157B447AA7059
SHA1:	B9507C5B02BBAE456AE5DE7132EBAFD27206B944
SHA-256:	2476D897A6D20653578FCB98737C85CCD96A42E57F67843FFBC431C0D05909A7
SHA-512:	81DF3F309B6A734FAE2E824A4535D9A7251D94885593C7C37EE70853F7C721062023D0D22BA1C92845C6FD14356048478B83C132AA9CEC9360690A65B74BF360
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@..'...t...t...t..5t...tk..t...tk.3t...tk..t8..t..>t...t...tH..tk..t...tk.6t...tk.0t...tRich...t........PE..L...eq.R...........!.....P...8...............`............................................@.........................p........z..<...............................(...Pa...............................x..@............`..$............................text...4O.......P.................. ..`.rdata...!...`..."...T..............@..@.data................v..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\TempkillProcess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49664
Entropy (8bit):	6.0609486495517775
Encrypted:	false
SSDEEP:	768:b6p045/ija+1IhJVlwal5An6gfTDmyTX9i3UElSV2Zu+I3NKL4zG8x:b6G+J46gfeyw3rZzax
MD5:	2D8EF1F86C38696ABEF55D64942A2C4A
SHA1:	F6710BDDA76A1CDB2669F49796F6C3161A895973
SHA-256:	E6BE04C390CEE6B4955C8AF0C78221FDEA3907CA5D0FB5F4F256FE7B05E8A332
SHA-512:	F668C37D9F722CE8217B87FE6CF2183ECC16451A1402A9D8D143CEAC914E7B0056CF8D6ACA8F81889CB954C85F12AF304EFE6D5D9121D4287E47AEC2B6732DA7
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~...@......4.............@..........................@..........................................R............ ...............................................................................................................text....{.......\|.................. ..`.itext..L........................... ..`.data...............................@....bss....h2...............................idata..............................@....edata..R...........................@..@.reloc..............................@..B.rsrc........ ......................@..@.............@......................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\WSHelper.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Generic INItialization configuration [Settings]
Category:	dropped
Size (bytes):	4660
Entropy (8bit):	4.667892794410234
Encrypted:	false
SSDEEP:	96:Yo4Z1y2RyVn5T1SEp2QttpA7JbOSiP89N0nn7WnHUGXlUGG8jn+vX:YpyNbJTp3toVbJ9NMn7uHUGXlUGRL6X
MD5:	C3D37313BF465F6145BB6F9BD845622E
SHA1:	1A27DA4300E997E07DA73F2916483862F9FE1FA4
SHA-256:	1B74775C8D88A46C6F1727029A4ACBDA6DD9CD1BF5298A3746CE104E0DA8F8B6
SHA-512:	4E92EC23D618E8EF2559BE1C5D2CB243E2EB074AAD86FFB338E3584806953EFDD22856847A35BDFEE1AA77756DC2B34F526777BD6FEDAF5E4B982391D31AD2D6
Malicious:	false
Reputation:	unknown
Preview:	[Product]..ProductName=Custom Server Platform Compact..DefLanguage=ENU..[Settings]..IsOpenHelperTag=1..IsShowTipTag=1..ShowTipsTypeTag=0..IsOnDesktopTag=0..IsMinimizeTag=1..IsImproveTag=1..BeginShowTips=60..ShowTipSInterval=60..UpdateTipsFormServer=3600..HttpGetTimeOut=120....[Server]..PID=1025..HostAddress=114140585B111A4F0F5B431958400F571750144503525A095B07480143505304515A59484709454E4D02..InitDataPostURLTag=0C5C5D45460C075212465E04455D124A0A4D09581E4F4714461A551C5E4D4E195C4744550D440E024F1F491B5A174510405F40471F..InitDataErrorTag=Pages\error.html..TipsListURLTag=0F5F5E46450F045111455D07465E1149094E0A5B1D4C44174519561F5D4E4D1A5F4447560E470D014C1C4A1859144613440A59115C5D4F1C..UploadErrorURL=3D6D6C74773D366323776F35746C237B3B7C38692F7E7625772B642D6F7C7F286D7675643C753F337E2E782A6B26742174723B623E3C7F7720793F2B6D2C253A6D6B226B6A2E..UserDataURL=316160787B313A6F2F7B633978602F773770346523727A297B27682163707324617A79683079333F72227426672A782D787E376E3230737B2C7F33276120293661792E7C347433706

C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-0SU7O.tmp\is-BBN21.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
File Type:	Generic INItialization configuration [Settings]
Category:	dropped
Size (bytes):	4660
Entropy (8bit):	4.667892794410234
Encrypted:	false
SSDEEP:	96:Yo4Z1y2RyVn5T1SEp2QttpA7JbOSiP89N0nn7WnHUGXlUGG8jn+vX:YpyNbJTp3toVbJ9NMn7uHUGXlUGRL6X
MD5:	C3D37313BF465F6145BB6F9BD845622E
SHA1:	1A27DA4300E997E07DA73F2916483862F9FE1FA4
SHA-256:	1B74775C8D88A46C6F1727029A4ACBDA6DD9CD1BF5298A3746CE104E0DA8F8B6
SHA-512:	4E92EC23D618E8EF2559BE1C5D2CB243E2EB074AAD86FFB338E3584806953EFDD22856847A35BDFEE1AA77756DC2B34F526777BD6FEDAF5E4B982391D31AD2D6
Malicious:	false
Reputation:	unknown
Preview:	[Product]..ProductName=Custom Server Platform Compact..DefLanguage=ENU..[Settings]..IsOpenHelperTag=1..IsShowTipTag=1..ShowTipsTypeTag=0..IsOnDesktopTag=0..IsMinimizeTag=1..IsImproveTag=1..BeginShowTips=60..ShowTipSInterval=60..UpdateTipsFormServer=3600..HttpGetTimeOut=120....[Server]..PID=1025..HostAddress=114140585B111A4F0F5B431958400F571750144503525A095B07480143505304515A59484709454E4D02..InitDataPostURLTag=0C5C5D45460C075212465E04455D124A0A4D09581E4F4714461A551C5E4D4E195C4744550D440E024F1F491B5A174510405F40471F..InitDataErrorTag=Pages\error.html..TipsListURLTag=0F5F5E46450F045111455D07465E1149094E0A5B1D4C44174519561F5D4E4D1A5F4447560E470D014C1C4A1859144613440A59115C5D4F1C..UploadErrorURL=3D6D6C74773D366323776F35746C237B3B7C38692F7E7625772B642D6F7C7F286D7675643C753F337E2E782A6B26742174723B623E3C7F7720793F2B6D2C253A6D6B226B6A2E..UserDataURL=316160787B313A6F2F7B633978602F773770346523727A297B27682163707324617A79683079333F72227426672A782D787E376E3230737B2C7F33276120293661792E7C347433706

C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

Download File

Process:	C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1193224
Entropy (8bit):	6.4180690298719245
Encrypted:	false
SSDEEP:	24576:C1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3Grvx9J8w:yQdhZgEN6GnJ0B
MD5:	6534DC07A839274161DB6F77BF18B631
SHA1:	D8BEF4E6FE81469C148EFECB6EFC3BE6FA1B174F
SHA-256:	B4BB1A45CFC27EE6B34A0A3EFDC2C9C9A6E774F8ED752272C992219021073679
SHA-512:	11419A4CD11EA661EDAB27AF3C982481CF1D06C7AF3621F1AA50F1E220C2CEBA98F88F59A46392BD816A584106C9789EB989BD2D3B79BD79BCD0C49DD200AD41
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......S.....................2....................@..............................................@...............................7..................................................................................t................................text............................... ..`.itext.. ........................... ..`.data...80.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............R...................rdata...............R..............@..@.rsrc................T..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-72P03.tmp\WSUtilities.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	186368
Entropy (8bit):	6.511101385669297
Encrypted:	false
SSDEEP:	3072:w1xNna70jpS3wOGvWhLdT24Nz0PPDKv6i2DZ6BTNbcGgehaupU:ibtS3PGvBqR2l6BTN9LBp
MD5:	DA154C59E1C0CBFD21F3658DB4EA4005
SHA1:	CF4D8F44A3ED1898C7635232C9FC77AF9421AAE4
SHA-256:	C04DBD5A3A64656CEA1410120C793922C469F5118F5FF8112D771FAAED628C3E
SHA-512:	D6099B632E2C64F0026FF823984F21A9290DDC228CCEA6E004D5274033D3423A4EC46DCD76B1DF90037971304E8B38B051AE79EE0B66D60CC0D2AE22D5A0B172
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............a..a..a.....a.....a.....:a...j.a..a.. a.....a.....a..3..a.....a..Rich.a..........................PE..L....;.O...........!................@7.......@............................... .......w....@.....................................................................x....................................o..@............@...............................text....-.......................... ..`.rdata...]...@...^...2..............@..@.data...(4..........................@....rsrc...............................@..@.reloc...+.......,..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-72P03.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.363359036723334
Encrypted:	false
SSDEEP:	48:SvrzfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2piSS4k+bkg6j0KHc:+fkcXegaJ/ZAYNzcld1xaX12pTSKvkc
MD5:	526426126AE5D326D0A24706C77D8C5C
SHA1:	68BAEC323767C122F74A269D3AA6D49EB26903DB
SHA-256:	B20A8D88C550981137ED831F2015F5F11517AEB649C29642D9D61DEA5EBC37D1
SHA-512:	A2D824FB08BF0B2B2CC0B5E4AF8B13D5BC752EA0D195C6D40FD72AEC05360A3569EADE1749BDAC81CFB075112D0D3CD030D40F629DAF7ABCC243F9D8DCA8BFBE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-72P03.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	712704
Entropy (8bit):	6.483750937337905
Encrypted:	false
SSDEEP:	12288:9QtLeYXPEv4arPEn37TzH7A6p3xxu9yz/eERMY1VLJrNufs9RZM2wHOQyD362kS0:+tCUA4arPEn37TzH7A6nw9yzeESUFgH/
MD5:	8AA8C628F7B7B7F3E96EFF00557BD0BF
SHA1:	9AF9CF61707CBBA7BF0D7CBED94E8DB91AFF8BD6
SHA-256:	14D4FA3EA6C3FBF6E9D284DE717E73A1EBB5E77F3D5C8C98808E40ADE359EA9D
SHA-512:	5E0A4765873684FCE159AF81310E37B6918C923CCEDE0C4DE0BD1E2E221425109131830CFF02E3F910F15B0401EE3B4AE68700B6D29A5E8466F6D4EE1DCD6EEB
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................b...........n............@..............................................@...............................%.......@..........................................................................................................CODE.....`.......b.................. ..`DATA.................f..............@...BSS..................x...................idata...%.......&...x..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc....@.......@..................@..P.....................j..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Wondershare\WSHelper\ProductUpdateList.xml

Download File

Process:	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.753774260662876
Encrypted:	false
SSDEEP:	3:JLWMNHU8LdgC/:JiMVBdf
MD5:	2DEB5F9C2FA516E56EC215E6B8D92F2F
SHA1:	3F1D9E067C40142AF94B0ED4452B46A4ACC582A9
SHA-256:	F8347DD75F39D80962199E43DD68CF662FCAED1008D61B3CCBFC472A1AF0845A
SHA-512:	D47F5BFB906F356197C345B9373BC5316C699DBD676F6480C2856C0BAAF5AFA8434A73A7490A47D998D37F1A07C5D200A5735E5C264791CC040AF4C5E31B64DA
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>

C:\Users\user\AppData\Local\Wondershare\WSHelper\TipsList.xml

Download File

Process:	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.753774260662876
Encrypted:	false
SSDEEP:	3:JLWMNHU8LdgC/:JiMVBdf
MD5:	2DEB5F9C2FA516E56EC215E6B8D92F2F
SHA1:	3F1D9E067C40142AF94B0ED4452B46A4ACC582A9
SHA-256:	F8347DD75F39D80962199E43DD68CF662FCAED1008D61B3CCBFC472A1AF0845A
SHA-512:	D47F5BFB906F356197C345B9373BC5316C699DBD676F6480C2856C0BAAF5AFA8434A73A7490A47D998D37F1A07C5D200A5735E5C264791CC040AF4C5E31B64DA
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Wondershare Free YouTube Downloader.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 19:25:08 2024, mtime=Thu Apr 25 19:25:11 2024, atime=Wed Dec 18 09:25:16 2019, length=1366256, window=hide
Category:	dropped
Size (bytes):	1596
Entropy (8bit):	4.514716548185824
Encrypted:	false
SSDEEP:	48:8UdnkdOAn1Ri5cF7KfyKld025n5Ld025nud025ceyF:8it35J8cey
MD5:	5A98628E4AFC90E7630E2B810DC47B16
SHA1:	73C869867B07B48BDCEC89E2024519003746D6C4
SHA-256:	B120163B45A54786C218D40ECF9B99375D5B9D88FF8E4F4F0B682E4553436E74
SHA-512:	E7D10D1A62ECC3829F584BA68117B8E5A5857ACDFDC7E9B1205CE9EBEA88B3BDD27909A8BF90C93E56AF82F529DCA4E7D78A47214FF9C09BF38A9E043FA4620B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....&.N...SR..N.....p.................................P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V.......+.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....`.1......X....WONDER~1..H......X...X......=.......................+.W.o.n.d.e.r.s.h.a.r.e.....x.1......X&...FREEYO~1..`......X...X&.....J.....................$r..F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.......2......O(S .FREEYO~1.EXE..d......X%..X%......L........................F.r.e.e.Y.o.u.T.u.b.e.D.o.w.n.l.o.a.d.e.r...e.x.e.......................-............................C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe..R.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.W.o.n.d.e.r.s.h.a.r.e.\.F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.\.F.r.e.e. .Y.o.u.T.u.b.e. .D.o.w.n.l.o.a.d.e.r.f.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Free YouTube Downloader.library-ms (copy)

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (748), with CRLF line terminators
Category:	dropped
Size (bytes):	3718
Entropy (8bit):	5.2600954979699415
Encrypted:	false
SSDEEP:	48:c+9Dv2ERImIDyK6PUbb5mv2XpaLlCjru9HRWVhT+aCHKjCWVhT+E1KOYPQNpZEWa:X9DaLVTfcMj6RGhjCI1YQNpZEh
MD5:	B5D53141D996A25A07098504BC388FC9
SHA1:	D273BCE19DE6A954EFB62C7FEF617AD28E0B22D0
SHA-256:	369360224E2C139D7535E7715516DAD81614F0ACF03572AE8476236ABA650326
SHA-512:	EA43B03135FE3BD6F006260C4D4BEB6344157C89CF6AC45342184FB8209F36012E133272825F9096760D7847ACD0F69B582CF9AC4664395E669C109248491CCD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">.. <ownerSID>S-1-5-21-2246122658-3693405117-2476756634-1002</ownerSID>.. <version>9</version>.. <isLibraryPinned>true</isLibraryPinned>.. <iconReference>C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe,0</iconReference>.. <templateInfo>.. <folderType>{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}</folderType>.. </templateInfo>.. <propertyStore>.. <property name="HasModifiedLocations" type="boolean"><![CDATA[true </property>.. </propertyStore>.. <searchConnectorDescriptionList>.. <searchConnectorDescription>.. <isDefaultSaveLocation>true</isDefaultSaveLocation>.. <isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>.. <isSupported>true</isSupported>.. <simpleLocation>.. <url>C:\Free YouTube Downloader Downloaded</url>.. <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQDQAAAAApfbJrTX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Free YouTube Downloader.library-ms~RF6447ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (748), with CRLF line terminators
Category:	dropped
Size (bytes):	3718
Entropy (8bit):	5.2600954979699415
Encrypted:	false
SSDEEP:	48:c+9Dv2ERImIDyK6PUbb5mv2XpaLlCjru9HRWVhT+aCHKjCWVhT+E1KOYPQNpZEWa:X9DaLVTfcMj6RGhjCI1YQNpZEh
MD5:	B5D53141D996A25A07098504BC388FC9
SHA1:	D273BCE19DE6A954EFB62C7FEF617AD28E0B22D0
SHA-256:	369360224E2C139D7535E7715516DAD81614F0ACF03572AE8476236ABA650326
SHA-512:	EA43B03135FE3BD6F006260C4D4BEB6344157C89CF6AC45342184FB8209F36012E133272825F9096760D7847ACD0F69B582CF9AC4664395E669C109248491CCD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">.. <ownerSID>S-1-5-21-2246122658-3693405117-2476756634-1002</ownerSID>.. <version>9</version>.. <isLibraryPinned>true</isLibraryPinned>.. <iconReference>C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe,0</iconReference>.. <templateInfo>.. <folderType>{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}</folderType>.. </templateInfo>.. <propertyStore>.. <property name="HasModifiedLocations" type="boolean"><![CDATA[true </property>.. </propertyStore>.. <searchConnectorDescriptionList>.. <searchConnectorDescription>.. <isDefaultSaveLocation>true</isDefaultSaveLocation>.. <isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>.. <isSupported>true</isSupported>.. <simpleLocation>.. <url>C:\Free YouTube Downloader Downloaded</url>.. <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQDQAAAAApfbJrTX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Free YouTube Downloader.library-ms~RF644e0a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (748), with CRLF line terminators
Category:	dropped
Size (bytes):	3718
Entropy (8bit):	5.2600954979699415
Encrypted:	false
SSDEEP:	48:c+9Dv2ERImIDyK6PUbb5mv2XpaLlCjru9HRWVhT+aCHKjCWVhT+E1KOYPQNpZEWa:X9DaLVTfcMj6RGhjCI1YQNpZEh
MD5:	B5D53141D996A25A07098504BC388FC9
SHA1:	D273BCE19DE6A954EFB62C7FEF617AD28E0B22D0
SHA-256:	369360224E2C139D7535E7715516DAD81614F0ACF03572AE8476236ABA650326
SHA-512:	EA43B03135FE3BD6F006260C4D4BEB6344157C89CF6AC45342184FB8209F36012E133272825F9096760D7847ACD0F69B582CF9AC4664395E669C109248491CCD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">.. <ownerSID>S-1-5-21-2246122658-3693405117-2476756634-1002</ownerSID>.. <version>9</version>.. <isLibraryPinned>true</isLibraryPinned>.. <iconReference>C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe,0</iconReference>.. <templateInfo>.. <folderType>{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}</folderType>.. </templateInfo>.. <propertyStore>.. <property name="HasModifiedLocations" type="boolean"><![CDATA[true </property>.. </propertyStore>.. <searchConnectorDescriptionList>.. <searchConnectorDescription>.. <isDefaultSaveLocation>true</isDefaultSaveLocation>.. <isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>.. <isSupported>true</isSupported>.. <simpleLocation>.. <url>C:\Free YouTube Downloader Downloaded</url>.. <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQDQAAAAApfbJrTX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Free YouTube Downloader.library-ms~RF644e48.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (748), with CRLF line terminators
Category:	dropped
Size (bytes):	3718
Entropy (8bit):	5.2600954979699415
Encrypted:	false
SSDEEP:	48:c+9Dv2ERImIDyK6PUbb5mv2XpaLlCjru9HRWVhT+aCHKjCWVhT+E1KOYPQNpZEWa:X9DaLVTfcMj6RGhjCI1YQNpZEh
MD5:	B5D53141D996A25A07098504BC388FC9
SHA1:	D273BCE19DE6A954EFB62C7FEF617AD28E0B22D0
SHA-256:	369360224E2C139D7535E7715516DAD81614F0ACF03572AE8476236ABA650326
SHA-512:	EA43B03135FE3BD6F006260C4D4BEB6344157C89CF6AC45342184FB8209F36012E133272825F9096760D7847ACD0F69B582CF9AC4664395E669C109248491CCD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">.. <ownerSID>S-1-5-21-2246122658-3693405117-2476756634-1002</ownerSID>.. <version>9</version>.. <isLibraryPinned>true</isLibraryPinned>.. <iconReference>C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe,0</iconReference>.. <templateInfo>.. <folderType>{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}</folderType>.. </templateInfo>.. <propertyStore>.. <property name="HasModifiedLocations" type="boolean"><![CDATA[true </property>.. </propertyStore>.. <searchConnectorDescriptionList>.. <searchConnectorDescription>.. <isDefaultSaveLocation>true</isDefaultSaveLocation>.. <isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>.. <isSupported>true</isSupported>.. <simpleLocation>.. <url>C:\Free YouTube Downloader Downloaded</url>.. <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQDQAAAAApfbJrTX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Free YouTube Downloader.library-ms~RF644e67.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (748), with CRLF line terminators
Category:	dropped
Size (bytes):	3718
Entropy (8bit):	5.2600954979699415
Encrypted:	false
SSDEEP:	48:c+9Dv2ERImIDyK6PUbb5mv2XpaLlCjru9HRWVhT+aCHKjCWVhT+E1KOYPQNpZEWa:X9DaLVTfcMj6RGhjCI1YQNpZEh
MD5:	B5D53141D996A25A07098504BC388FC9
SHA1:	D273BCE19DE6A954EFB62C7FEF617AD28E0B22D0
SHA-256:	369360224E2C139D7535E7715516DAD81614F0ACF03572AE8476236ABA650326
SHA-512:	EA43B03135FE3BD6F006260C4D4BEB6344157C89CF6AC45342184FB8209F36012E133272825F9096760D7847ACD0F69B582CF9AC4664395E669C109248491CCD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">.. <ownerSID>S-1-5-21-2246122658-3693405117-2476756634-1002</ownerSID>.. <version>9</version>.. <isLibraryPinned>true</isLibraryPinned>.. <iconReference>C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe,0</iconReference>.. <templateInfo>.. <folderType>{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}</folderType>.. </templateInfo>.. <propertyStore>.. <property name="HasModifiedLocations" type="boolean"><![CDATA[true </property>.. </propertyStore>.. <searchConnectorDescriptionList>.. <searchConnectorDescription>.. <isDefaultSaveLocation>true</isDefaultSaveLocation>.. <isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>.. <isSupported>true</isSupported>.. <simpleLocation>.. <url>C:\Free YouTube Downloader Downloaded</url>.. <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQDQAAAAApfbJrTX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Free YouTube Downloader.library-ms~RF644e96.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (748), with CRLF line terminators
Category:	dropped
Size (bytes):	3718
Entropy (8bit):	5.2600954979699415
Encrypted:	false
SSDEEP:	48:c+9Dv2ERImIDyK6PUbb5mv2XpaLlCjru9HRWVhT+aCHKjCWVhT+E1KOYPQNpZEWa:X9DaLVTfcMj6RGhjCI1YQNpZEh
MD5:	B5D53141D996A25A07098504BC388FC9
SHA1:	D273BCE19DE6A954EFB62C7FEF617AD28E0B22D0
SHA-256:	369360224E2C139D7535E7715516DAD81614F0ACF03572AE8476236ABA650326
SHA-512:	EA43B03135FE3BD6F006260C4D4BEB6344157C89CF6AC45342184FB8209F36012E133272825F9096760D7847ACD0F69B582CF9AC4664395E669C109248491CCD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">.. <ownerSID>S-1-5-21-2246122658-3693405117-2476756634-1002</ownerSID>.. <version>9</version>.. <isLibraryPinned>true</isLibraryPinned>.. <iconReference>C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe,0</iconReference>.. <templateInfo>.. <folderType>{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}</folderType>.. </templateInfo>.. <propertyStore>.. <property name="HasModifiedLocations" type="boolean"><![CDATA[true </property>.. </propertyStore>.. <searchConnectorDescriptionList>.. <searchConnectorDescription>.. <isDefaultSaveLocation>true</isDefaultSaveLocation>.. <isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>.. <isSupported>true</isSupported>.. <simpleLocation>.. <url>C:\Free YouTube Downloader Downloaded</url>.. <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQDQAAAAApfbJrTX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\~ree YouTube Downloader.tmp

Download File

Process:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (748), with CRLF line terminators
Category:	dropped
Size (bytes):	3718
Entropy (8bit):	5.2600954979699415
Encrypted:	false
SSDEEP:	48:c+9Dv2ERImIDyK6PUbb5mv2XpaLlCjru9HRWVhT+aCHKjCWVhT+E1KOYPQNpZEWa:X9DaLVTfcMj6RGhjCI1YQNpZEh
MD5:	B5D53141D996A25A07098504BC388FC9
SHA1:	D273BCE19DE6A954EFB62C7FEF617AD28E0B22D0
SHA-256:	369360224E2C139D7535E7715516DAD81614F0ACF03572AE8476236ABA650326
SHA-512:	EA43B03135FE3BD6F006260C4D4BEB6344157C89CF6AC45342184FB8209F36012E133272825F9096760D7847ACD0F69B582CF9AC4664395E669C109248491CCD
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">.. <ownerSID>S-1-5-21-2246122658-3693405117-2476756634-1002</ownerSID>.. <version>9</version>.. <isLibraryPinned>true</isLibraryPinned>.. <iconReference>C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe,0</iconReference>.. <templateInfo>.. <folderType>{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}</folderType>.. </templateInfo>.. <propertyStore>.. <property name="HasModifiedLocations" type="boolean"><![CDATA[true </property>.. </propertyStore>.. <searchConnectorDescriptionList>.. <searchConnectorDescription>.. <isDefaultSaveLocation>true</isDefaultSaveLocation>.. <isDefaultNonOwnerSaveLocation>true</isDefaultNonOwnerSaveLocation>.. <isSupported>true</isSupported>.. <simpleLocation>.. <url>C:\Free YouTube Downloader Downloaded</url>.. <serialized>MBAAAEAFCAAAAAAAADAAAAAAAY0gAAQDQAAAAApfbJrTX

Chrome Cache Entry: 1754

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	429977
Entropy (8bit):	5.369295692313016
Encrypted:	false
SSDEEP:	6144:BSK9KwI51nTb7W9/juAwiiogfk8cJfzPdDpUyZ5uhmVB4sE7fJsGjL2Pb//iCB15:CMJfz1FBZ5uhmi7fJsGvCBge
MD5:	E826E2568F3153D2E146BF66286BD521
SHA1:	B47610E60026F3DB1E80BCF0026B53DBB089007B
SHA-256:	B601830D2F9A081099EA148ED53A859BF410CA3460F0029030FB663FEF728C99
SHA-512:	8F6F900CED068F3D3C8D8F390B0AE13A60C0171D64895F8068F412C056553C23E2BBA5A502BBBF10DFB444B2D186F53961B3C32FB429FCD5FE151986BB0AFEB3
Malicious:	false
Reputation:	unknown
URL:	https://cdn.consentmanager.net/delivery/js/cmp_final.min.js
Preview:	window.cmpccsversionbuild="2024-4-24.9.35";if(!("rpl" in String.prototype)){Object.defineProperty(String.prototype,"rpl",{value:function(a,b){var c=this;return c.split(a).join(b)},enumerable:false})}if(!("cmp_unq" in window)){window.cmp_unq=function(a){return a.filter(function(c,d,b){return b&&b.indexOf(c)===d})}}if(!("replaceAll" in String.prototype)){Object.defineProperty(String.prototype,"replaceAll",{value:function(a,b){var c=this;return c.split(a).join(b)},enumerable:false})}if(!("fnd" in Array.prototype)){Object.defineProperty(Array.prototype,"fnd",{value:function(b){var c=this;b=String(b);for(var a=0;a<c.length;a++){if(String(c[a])==b){return a}}return -1},enumerable:false})}window.cmp_fnd=function(a,c){var d=a;c=String(c);for(var b=0;b<d.length;b++){if(String(d[b])==c){return b}}return -1};window.cmpccsversion=20220717;(function(){var b="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",a=/^(?:[A-Za-z\d+\/]{4})*?(?:[A-Za-z\d+\/]{2}(?:==)?\|[A-Za-z\d+\/]{3}=?)?$/

Chrome Cache Entry: 1755

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	3.2001615812851174
Encrypted:	false
SSDEEP:	3:CUO/RD/0xlpfx/n:oDAn/n
MD5:	41C9BC7F3F78ED71115CC062C1C67B09
SHA1:	FF200D7EA28780D12BD6D9334178B930DBD5884B
SHA-256:	1CD58A827318C4A29B32A0DB15C8C39D5651B42D8CAD227519AD81BCE4ADB944
SHA-512:	280EA4383EE6B37051D91C5AF30A5CE72AA4439340FC6D31A4FBE7BA8A8156EB7893891D5B2371B9FC4934A78F08DE3D57E5B63FA9D279A317DCBEFB8A07A6B0
Malicious:	false
Reputation:	unknown
URL:	https://www.linkconnector.com/tu.php?pid=48130&nv=_gcl_au%3D1.1.1367721842.1714076765%2C%20srcSite%3Dwww.wondershare.com%2C%20referrer%3D%2C%20_uetsid%3D0b3e81f0034211ef80523331be39900f%2C%20_uetvid%3D0b3ea370034211ef8f1ecfac22ceebac%2C%20gdprAgree-eu%3Dno%2C%20_ce.irv%3Dnew%2C%20cebs%3D1%2C%20_ce.s%3Dv~58b776d3de2428599fd11c3427deaccfc480ab43~lcw~1714076769255~lva~1714076769255~vpv~0~lcw~1714076769256%2C%20IR_gbd%3Dwondershare.com%2C%20IR_15586%3D1714076769684%257C0%257C1714076769684%257C%257C
Preview:	GIF89a...................!.......,...........T..;

Chrome Cache Entry: 1756

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 3840x5, components 3
Category:	dropped
Size (bytes):	712
Entropy (8bit):	4.674761335456292
Encrypted:	false
SSDEEP:	12:3XtuVt1xLbe545WuVt1xLbe545cWXtoCQpwaNqBtcdyG6Um34R8n:oVt1xLbegPVt1xLbegcWdhMwGMalnmi8
MD5:	99696EE625EDD61109F7B9307E813732
SHA1:	312F3854DB779F488594398C8BF4881D97E2570C
SHA-256:	02F4A44CBFD3DC713B9C8B00AECC7B25492454F69EA6EC687668C236B9601D63
SHA-512:	DDF8EFCCDB3F4A1454957858ECE9246A0C09EF7CB508A0BC4F671F6AA318F1A3E7AB0F3D97727F9DF1B95445CB1E52DF3A976040FD295153BA2E0168CEC4D931
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..........................................................)... ... ...).?.'...'.'...'.?.8.C.7.3.7.C.8.d.N.F.F.N.d.s.a.\.a.s...}.}.............5............................................)... ... ...).?.'...'.'...'.?.8.C.7.3.7.C.8.d.N.F.F.N.d.s.a.\.a.s...}.}.............5..........."..........,..........................................................0.@. ........P..P$................X.........T......@ .........((.......h..K`....(...-....................((*.`......((J.(Z......A....((J.....@.(.....@.A((-.............E....KD..J..(B..J......@(@-.........B.J.J.@Q.(.....@ J.K@..@J.J...J..D.....(.K..............................?.p......................p........?.p.....................p........?.p..

Chrome Cache Entry: 1757

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (31997)
Category:	downloaded
Size (bytes):	42339
Entropy (8bit):	5.287317773830268
Encrypted:	false
SSDEEP:	768:TI8UwRZMgl2gICeV4p0uyn+kjNeAB9Bcw2ThlHSo03+NQIr:Tb7TM9gILVE0uyn+6Neincw2Thly9SZr
MD5:	D937B5BBE099F447F0F429C6C8EA1A50
SHA1:	85CC7B334FF23F2407BB2F09D08D12CD31E3437A
SHA-256:	D9DEE4DC92392529BEBA6F2138DA5ED2B4FCE1C69CF623234FCFC117B12D6644
SHA-512:	F9FEAA33F4340FF1F3991A96B089FC91E5D852A10DD3EC2B44DF156E14F395B389739406261B725EEAC3F7753A3D5F2F49D9D41DB5578ED061703ECF1D9E0BE9
Malicious:	false
Reputation:	unknown
URL:	https://tag.rmp.rakuten.com/120272.ct.js
Preview:	!function(e){function t(r){if(n[r])return n[r].exports;var i=n[r]={exports:{},id:r,loaded:!1};return e[r].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}var n={};return t.m=e,t.c=n,t.p="",t(0)}([function(e,t,n){function r(){n(33),n(38).isTesting\|\|(n(37).main(),n(34).main(),n(39).main())}r()},function(e,t,n){var r=n(3),i=n(16),o=n(19);e.exports={observe:o.observe,domReady:i.domReady,addEventListener:i.addEventListener,on:i.addEventListener,wrap:r.wrap,never:r.never,isTrue:r.isTrue,empty:r.empty,and:r.and,fireAfter:r.fireAfter,fireEvery:r.fireEvery,identity:r.identity}},function(e,t,n){for(var r=n(3),i="DataLayer",o=i.split("."),a=window\|\|{},s=0;s<o.length;s++)"undefined"==typeof a[o[s]]&&(a[o[s]]={}),a=a[o[s]];var u=typeof a.loaded;switch(u){case"undefined":a.loaded=r.identity();break;case"boolean":var c=!a.loaded;a.loaded=r.identity(),c&&a.loaded();break;default:a.loaded=r.identity(),a.loaded()}a.loaded.triggers(function(){a.__meta&&console.log("Dl Loaded")}),e.exports=a},function

Chrome Cache Entry: 1758

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (307), with CRLF line terminators
Category:	downloaded
Size (bytes):	2022
Entropy (8bit):	5.41027909914633
Encrypted:	false
SSDEEP:	48:as95QqxmzI6Qk6NgpBk5SWlUpZnhpyQlKH2euECZzURwChF:ptmVQkppBk43pdhptlKWiv
MD5:	53239C64C279CDE4A4D9AC273E510644
SHA1:	B3A14E21F219DBC3A50163927039BFEE3125BA55
SHA-256:	9D4B176583032BAE375A1133FA1991F7BAD0DCA659C4E05DF4EDEB3CD2E0FDC7
SHA-512:	34623AAA4F2AE8424AE8F66AC99552CB2A41415DB17CA6733C5374EAD95FD9D4E8A0C8739B8B38C16C702154BD214E01B258A16EB7E7D02ED5172DCBFCC57E99
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/script/mobile-sendmail.js
Preview:	var images_host_path = 'https://images.wondershare.com/';....fBrowserRedirect();....function fBrowserRedirect() { ...var sUserAgent.= navigator.userAgent.toLowerCase();...var bIsIphoneOs = sUserAgent.match(/iphone os/i) == "iphone os"; ...var bIsAndroid.= sUserAgent.match(/android/i) == "android";...var bIsIpad..= sUserAgent.match(/ipad/i) == "ipad"; ...var bIsWin = sUserAgent.match(/windows phone/i) == "windows phone"; ......if(bIsIphoneOs \|\| bIsAndroid \|\| bIsIpad \|\| bIsWin) setMailBtn();..}....function sendMail( obj, download_url ){...var email = $(obj).parent('div').find('input[type="text"]').val();...if ( !isEmail(email) ){....alert('Invalid e-mail.')...._gaq.push(['_trackEvent', download_url + '\|Mobi', 'Failed Mail Invalid', document.location.pathname]);....$(obj).parent('div').find('input[type="text"]').focus();.... return false;...}.......$.get('/sendmail/?email='+encodeURI(email)+'&download_url='+encodeURI(download_url)+'&r='+Math.random(),function(data){....if(data==1){....

Chrome Cache Entry: 1759

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	1198
Entropy (8bit):	7.745798102496085
Encrypted:	false
SSDEEP:	24:cYXED/pies2A7N50Z5Q7RGPxKIHthDPIYBjmli1oykXwa4/59dm:JberE0ZyvuhLIYvlGr259dm
MD5:	2A0163CE0C36835DB81AD638E197F46A
SHA1:	CECD8C3FAC17B5D904B823CBA0A5CA38A08C586C
SHA-256:	88A0D5A631D42670CECEAE275B624A2AFFFCC488556D2B435C4B8174BE3CA5F5
SHA-512:	5C657A009E25DA3D490A0B0C6D35BF24516679834887D0E3FAFC7D4825D58E681FE4DC7B4212ED6F4E27CC33AFE8B80541FB9BDC48155D6D69BA465E9F5E6B18
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style/images/video-win.png
Preview:	RIFF....WEBPVP8X...........H..ALPHB....PR[[S.o.ER.............1.@M...I.%\.b.w.-.........L..N...p...='VP8 >..........I.>a(.E$"..,-D@....F\|..'....0?q..../...K..-..@.....9....x?......4.....C...;.Y.H.>.-.H.R.3Y...yh.{(..H.ll......?g..@a...]/.Z..\|.x].....y....\|..%..w.W.%....$I........Fw.1.].F.uL....Y8..%.....M........~V..d.....@.l.1.F.$.h.9\|.m$b.+..4u..K....!..S[.R.........l..?sX+..B~q...2U...(.<%.\|...PIdu.\X.Y..J...+...g.....p..U...%b....=..2.Z_r.Qa..d.L5....jv..]j...lh..Dx..Y5z....bw.a..'.p7$.z.P.-$H......k.\...'V...$..'..]W.YL.e..Cx).&zow....k...B..#..C..V.......?...F...U....s.x.M...C........#.uJ......a.....Oy..t...&)..X2...aD2.....3.-R.u.....Ik[,~.W.i..8/a..?(...<......%\.8.i...\|...H...<.c...g...5..Z,.0I....N..<x.\+..2Z3Q:.(....W..'.x.....uj..\|t.9...r.[..f.......P;TK..\..}..Q...]X<hS`o..a......V.h..5)..!K.$.F.1.y.......-..{.R...pV..D.....x...2...../.d.N.V...z....R......R...I....U..t..0%...k.S.92'mJ.i....h.l..O..7.2...C.9.0.W....P.t.P..$.?.{._..L[.~.[]U

Chrome Cache Entry: 1760

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (596), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	8550
Entropy (8bit):	5.327699943905294
Encrypted:	false
SSDEEP:	192:tJambumBd5MUjtAi49FxoV+NXXXs4pf6paA6Xu:7amqmBdOhO03s4pf6paBXu
MD5:	D291EEEBE095BA083C8BE2419EF557BB
SHA1:	17F7CBF896DF0E953AEA34D7F6CB26207A2AE23F
SHA-256:	1E7F43F044EBDB56D1816C69166566E48A44E1F2542C4C22D447AD486B5A5760
SHA-512:	8EB4EFBEEC935FBAEDEC13F482A0269997B8875C1ED9AC48108ABB5C1B58006987EA27FE63C94E31D9D3EC429CBB60FD715FA023CD978944249F2EADEDBAF894
Malicious:	false
Reputation:	unknown
URL:	https://www.linkconnector.com/uts_lp.php?cgid=900133
Preview:	var uts_ip = '185.152.66.230';..var uts_refr = 'https://www.wondershare.com/guide/free-youtube-downloader.html?act=install';..var uts_protocol = '';..var uts_now = '2024-04-25 13:26:09';..var uts_dnt = '0';.var uts_lc_cookievalue = '';.var uts_lc_uts_id = '';.var uts_lcid = '';.var uts_calling_domain = 'www.linkconnector.com';.var lc_mref = 'https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall';.var lc_val = '';.var uoffset = -8;.// Dynamic end..function ScriptFunction(path){var x=document.createElement("SCRIPT");x.src=path;try{document.body.appendChild(x)}.catch(e){document.head.appendChild(x)}}.function ImgFunction(path){var x=document.createElement("IMG");x.setAttribute("src",path);x.setAttribute("alt","");x.setAttribute("height","1");x.setAttribute("width","1");try{document.body.appendChild(x)}.catch(e){document.head.appendChild(x)}}.function uts_readCookie(name){var nameEQ=name+"=";var ca=document.cookie.split(';');for(var i=0;i<ca.length;i++).{

Chrome Cache Entry: 1761

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	15742
Entropy (8bit):	7.979985548728032
Encrypted:	false
SSDEEP:	384:r+Bfb9CtfTxAgAcTL3vXTcFfdGkMYkMoveRIaOR:mf5+yyL3fTUzjovKILR
MD5:	767982EB4DE8E9E6776E0B289396CD24
SHA1:	79F98DECF37F7AEC7FF8D5BC214E1F42AAFB62FD
SHA-256:	EACB24D6407AC7813AB60F1197582CC3EB7D4E3B15C832F8432BF0D063D292AD
SHA-512:	4652C90A74949FC5B7FDEEB51639BA0B1C1E4C7506CA2B300FA102CB168FC84299A2679200991870B321FC8782C850F927C2D73204852DFE006343EA5DD9D695
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/guide/images/free-youtube-downloader/transfer-to-mobile.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................<p...#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......X...w....pixi............ipma.................<xmdat.....f%{......2.xLl..Y.-.h..tr..l...y.go^]...'z$~.o......C..G.sk..B..?...J.....py...p.ueh}....Ct..r.x...\.x.....~.%.'3........5.P1W.U......Y>xd./. t..}6...<....Gt.q....zQ......`....k.J...&1....,#.:.]@.4.e.....l..iA....}B.2F.m^.h.....8..^=.?.e........q.iM.cX.^s...[.A..,........}.o..W."M..u....._...[..3...V=.0.......&>..S.q....l..z..,...2...M...l.c.QF.w2...#...9....4$.M...5g.\|k.Z.z"K........#..!...lP...-.>.RZA.f....@Z..u.t....t+....Z+bi..hs.L....!...nW.....].SK.......o.<.K._k....+..C..\|.ul..o.....\|d.n.~.\O.;.... .-j..).+.]..cum] ~i........j0d..{.....S.......X.;..15W...-JU......ku2..9C...c7.Q^..Z..A....o>...V.."lI>...M..$....E.U..P.E.n.4RW..l.,~>O..u......x............"*Q........n....W

Chrome Cache Entry: 1762

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 11 tables, 1st "OS/2", 20 names, Macintosh
Category:	downloaded
Size (bytes):	8080
Entropy (8bit):	6.358820119000046
Encrypted:	false
SSDEEP:	192:J77RFgrrTGb+n95PXwPnZIT/XpfWLJ4cdru1wgp+4W2dJGxsh:RRW3yb+9hKnGxKgvWAGa
MD5:	9034DBC35BA0BE163E5882F4EAC6B7B6
SHA1:	2884F16144AA430C7BEAE0F2997BAE3633226DEB
SHA-256:	087EAEE0D269D7968D00F870AF99CC11F65A2EEFD08EC61AF6EE6BCF2E43967B
SHA-512:	81455A8D4E4F827F427208E71999B320B29F9015A5C436761D7043FC5086DDAA6FE393C44369F15764129636F4F332D1D7C0D12F53608FDC91D1C41A7A6F0B33
Malicious:	false
Reputation:	unknown
URL:	https://www.wondershare.com/style-fonts/fonts/global_iconfont.ttf?iv41ks
Preview:	...........0OS/2...R.......`cmap.V........Tgasp.......p....glyf..cg...x....head..........6hhea...z...D...$hmtx...Y...h....loca..\|N... ...^maxp.8......... name!Q..........post.......p... ...........................3...................................@...).....@...@............... .................................8............. .)......... ................................................79..................79..................79...........................!.......T..S.A...6T..T.@....S..T.=.CS..T.=.C.......4.......'..7...4b....`.t....s.8.Ht.G.R..........7............'....Y.5.?X......I...uK........7...........7.....Y..X......J....K.u........4...............b...t`......s....t..........%.F...:.......(....!5#.3.!5!'!.!.!...#"&54632....#"&54632..I....v{...A.......W...'..''..'.3'..''..'.{..:B..CD.C.....''..''..''..''......].B...>...,..%'>.54..#"......3267..4>.32......#"..5.... 9b.KJ.a99a.JI.1..>-Lg::gL,,Lg::gL-..d8J.a99a.JK.b96/...:gL--Lg::gL,,Lg:......@...@.....'........7....L....M....L.6.1

Chrome Cache Entry: 1763

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Reputation:	unknown
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 1764

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	37
Entropy (8bit):	3.040403544317301
Encrypted:	false
SSDEEP:	3:CUXEcyv+L1pse:J/se
MD5:	3EACD0132310EA44CAD756B378A3BC07
SHA1:	E2216A7E9B73F5CB0279351C78CE61C33475CEA7
SHA-256:	BB229A48BEE31F5D54CA12DC9BD960C63A671F0D4BE86A054C1D324A44499D96
SHA-512:	BD9AB35DDE3A5242B04C159187732E13B0A6DA50DDCFF7015DFB78CDD68743E191EAF5CDDEDD49BEF7D2D5A642C217272A40E5BA603FE24CA676A53F8C417C5D
Malicious:	false
Reputation:	unknown
URL:	https://tags.rd.linksynergy.com/cs?ns=lr&uid3=3655b587ed44784ee9d0d5fb3f19f505e7d1a5e63b8fe901319014e3fd24a8086ac34734d8e453ee
Preview:	GIF89a.......!.......,...........L..;

Chrome Cache Entry: 1765

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
URL:	https://z.asbmit.com/tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=z.asbmit.com
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1766

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (368), with CRLF line terminators
Category:	downloaded
Size (bytes):	152576
Entropy (8bit):	5.233548463020601
Encrypted:	false
SSDEEP:	1536:wTVL1G7WPFZeU+4B4KBE/SE+WgvId4OuEU1EvCKw7GSTM7:qD4HZkCi7ZI
MD5:	BDDFA359F383A9EEBCE6E68C1BC3EEBF
SHA1:	8B3F898F407F3CBA8D88C4DE10B4ED2E4CED662C
SHA-256:	572C1DD2C149E10F62F3010B501FA54233B24C000FA2982147C317943F542FF7
SHA-512:	C9F76F844D498DB07EB6105C84D78A85390694AE8086A6FEA7795276BDDBE61BDFF5D4564104F92671FCEC8F150D2270667C88C89C58C85F9FD5BC2E32565592
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style/products.css
Preview:	@charset "utf-8";../* CSS Document /../btn/...btn-org{display:inline-block; background:#f26559;font-size:14px;height:40px; padding:2px 25px;line-height:42px;text-decoration:none !important;-webkit-transition: all 0.3s;-moz-transition: all 0.3s;transition: all 0.3s;color:#fff !important; border-radius:5px; font-weight:bold;}...btn-org:hover{background-color:#ee3f31;text-decoration:none;}.....rel_pro_btn{ border:1px solid #f75a50; border-radius:8px;-webkit-border-radius: 8px;-moz-border-radius: 8px; display:inline-block; padding:5px 15px; color:#f75a50; background:none;}...pop_closeBtn{display:block;cursor:pointer;background:url(images/close-btn-pop.png) no-repeat; width:22px; height:20px; float:right; margin:15px 15px 5px 0;}...tc_bg,.tc_bg iframe {position:fixed; top:0; left:0; width:100%; height:100%; background:url(images/back-bg-pop.png) repeat 0 0;z-index:250;}...tc_bg iframe {-ms-filter:"progid:DXImageTransform.Microsoft.Alpha(Opacity=0)"; / ie8 /filter:alpha(opacity=0);/ i

Chrome Cache Entry: 1767

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 133 x 73, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11354
Entropy (8bit):	7.960922009889354
Encrypted:	false
SSDEEP:	192:fDv7rO74l65Z1mToCz+jjzqeT18NG2BveBuie8ax7TKwdAVttj3G9HyIs0Ud9Xtb:rvXO7/1E+XzHuZMUv8B5VttjW9Hy1t3r
MD5:	C7C6B1503A51408281A548A7A66BC2FC
SHA1:	5D0D18B0EC139D0AE1FDA393145C5D51C2B0CFFE
SHA-256:	F9E7780FB0372505FB326BA0B1F5B02A2D5F379C139CCC98579E6CA1B364A82A
SHA-512:	1AFF6D37E4C5925D4976B1C1578B1D14B79CE37D65E8E1E6485DC55DA883FF443A36618AA04CEC7A2A9EA88243CBAE46995F145EAAD88B490563DEE96F5637A2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......I.............orNT..w...,.IDATx.}[.e.u.s.s..]...n...w.hc..8 .d...........R.........!$...D...@ ..GH$....`...mw.m....nU.{.9{M>.s.s..H..}.Y...Xc.9.....+../.......?.n... ......G[... L..H..m.{n2.%kOC{o#.y...m'..%...'...E.@Drg._...@...[/..>.w.mK.F].!b.K.M{...mH...ot.......A.."..C@........V.....d....o......w.>..~...._..G.Zn0..`..$....@@.ua5..q.....#.$p.-I.....p.L#.do.:.! .2.....Hl.x. I.....jh.F....).Q`.8....k.....@$`&..8L'.v.}.......'Z....A(.!..... ..h`.J..!.f.~..;.3...pI..C..wYlTQ=..4.1..'..%Gl.@.I..}....c....A...w.G[A.K....XG `....$.3..I....-..%....&..?..0H....i.).@....T........pu...{X..@b..~et ..sLr..-\|w..8.d......iL..h...........J..L!.....#..mT...D$.!....n...1..}.+.u...C.h....MW..b...\|].0?....dx.Q..\.).%FvB.._p1;I.._..[.a..e.$)@.AN.pr.!g....C......4.3.(.Bt.H....Z.x$.].1...X.Y....9.z....W.a.2..].(....*.p....:b.....T~'Z...0C..z.t..(1@p.ZG\.........u1x.../....A......H.D......$...".8s..?.O.....A"...zvwzb;.C.G3.4-.W.7P&.G$..2.N...J

Chrome Cache Entry: 1768

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	170
Entropy (8bit):	5.973866818388822
Encrypted:	false
SSDEEP:	3:0Z/F1/JllebM/k9E5hh5GRdaaqOljx7R724px2GvwQl5APSl8lYJV3Nd5utWn:0ZQok9E5hSyOljz72kx2rw5APSSYJV3b
MD5:	CA8F2C660FC94845C44AB4ED87327537
SHA1:	43E0E9E27DACE24FC534953BF183E25635867452
SHA-256:	FBE1C6B8CA663DBCEE56430AF23DBC4CA610172790DD521439254900FA8B7658
SHA-512:	57CFBCE0B209D416141FADD6AEDFB62D282EDE04F3984FA03AB951EAE7B8A5D588B30A20E18513D773E7B662C3C6C205E145C0E8E12084930E713E598D1E7EBA
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style/images/step-bg.png
Preview:	RIFF....WEBPVP8X........6.....ALPHS....g..m.8[)....0vDD......m+.c.... r......B...O.....4.'_P.M.....1...ft..UBS.P...5..VP8 (........*7...>.l.R.&$.......i...`<.`...g...

Chrome Cache Entry: 1769

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1770

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	13292
Entropy (8bit):	7.974824142212565
Encrypted:	false
SSDEEP:	384:rmMPUmKcbXfsl7ZznKwD671CjPJIM1z/PacJBi:6MHhXcZ7KwO74jB31z/Pbi
MD5:	5979BCD3D3E67A50FAD0A9C93EDD9562
SHA1:	2B3CDF166F269A1070EF7FE65C0680847F6564CE
SHA-256:	F5FD21902A9F78AB67B33809CD88AAC1FCC76C38B29B1BBB07096AE6A8A0F462
SHA-512:	411B891E346F9EF2E55BEC2FE5416CF0F7685AD5FB008F11D66776D1038D7AEA8ACF0E399F14A9EC7BEEBFD4193D2032FBC34C132389C4E1027FA0F3713ACB87
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/guide/images/free-youtube-downloader/install-player.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................2....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......X...w....pixi............ipma.................2.mdat.....f%{...4..2.e.... .@.+..+....j...OM?.&..\|...f:;.....Z..e.U.....faxp...R2...9fK......bu.HH.<H.P...X.'..fv.........]. ....?W-v.taJz..dK...:..qN.k...?W,.M........E..?.>.%h...gC..1.i9......a.....}...WI...l.d..d.Il\%..7.&...R.n.x9KD.i}r...lKK.j.....h5Z..}.....Qz..f..._A.......h]3..%<.B..EY..n@...c.%6...e.......i.P.....H.z..7.+'W$>./.nA.L..}.q..y...E....:......4..9j./{.J.V.=...s).u...a....;..4.Po...S..z.S..p.........].. S...Fqy.b/....%.qR....;.z.Z...E.0............0../.....V..&.....w...\|,,..hZ..U.>....=...X].X....g...7}...oi....N+.~.@...#..~......V...e...+71I..,,...%.._G.B.6.R....>.7.W...r..?..d.Y.X.{....U}.[..d8...:@....P<...).H...(.T.....<~n..._AL.$B_,.`X.Q]K...z@..5I..L.C1~j{yv.

Chrome Cache Entry: 1771

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (928)
Category:	downloaded
Size (bytes):	16975
Entropy (8bit):	5.331634593480078
Encrypted:	false
SSDEEP:	192:s84y3Bd1d3Q8IYConZbtlXjumsLgAei+RHtg36U/u/RT6TDJJ1Nf3v:h4qd1F3ttucrR/Cu/N0DJJ1F3v
MD5:	7A50DBCFC793E43AE7E24F0F0372227B
SHA1:	4DD4E5395621614AF174B4739922BE4F82469A7D
SHA-256:	087DA35963644566B8C5D54248090D6CE1F6F78101FDC0EA6ADAB27BC7A65E70
SHA-512:	90417390103BE23B897992AD7E078FC3E4B61B9D6FAE767DF280CBF34013125AB29B6CC6D4929F24B0A0C882E705EAD9C93F1A345F07F1E4C8E46E05ABAC157B
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/script/fancybox-2.0.1.js
Preview:	/! fancyBox v2.0.5 fancyapps.com \| fancyapps.com/fancybox/#license /.(function(t,m,e){var l=e(t),q=e(m),a=e.fancybox=function(){a.open.apply(this,arguments)},r=!1,s="undefined"!==typeof m.createTouch;e.extend(a,{version:"2.0.5",defaults:{padding:15,margin:20,width:800,height:600,minWidth:100,minHeight:100,maxWidth:9999,maxHeight:9999,autoSize:!0,autoResize:!s,autoCenter:!s,fitToView:!0,aspectRatio:!1,topRatio:0.5,fixed:!(e.browser.msie&&6>=e.browser.version)&&!s,scrolling:"auto",wrapCSS:"fancybox-default",arrows:!0,closeBtn:!0,closeClick:!1,nextClick:!1,mouseWheel:!0,.autoPlay:!1,playSpeed:3E3,preload:3,modal:!1,loop:!0,ajax:{dataType:"html",headers:{"X-fancyBox":!0}},keys:{next:[13,32,34,39,40],prev:[8,33,37,38],close:[27]},tpl:{wrap:'<div class="fancybox-wrap"><div class="fancybox-outer"><div class="fancybox-inner"></div></div></div>',image:'<img class="fancybox-image" src="{href}" alt="" />',iframe:'<iframe class="fancybox-iframe" name="fancybox-frame{rnd}" frameborder="0" hspace=

Chrome Cache Entry: 1772

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:a2yb1tMn:aN1tM
MD5:	D06F04FCCF68D0B228A5923187CE1AFD
SHA1:	5DE9DF9FDD66A91EED06E31981553D4AB9CCF490
SHA-256:	830E67BDA2532CD5880EE86E3B33E69721082F8458BB0DF0CD4EDBB1577FD375
SHA-512:	9888104E0C9311D58B52A9B7030725C8BDFBE54F581246E4DDE0366F046671B3CE6838D09DDB4A384C6145248D4AB46D16BAE8E92F943488E2888982D6DB0D3A
Malicious:	false
Reputation:	unknown
URL:	https://assets-tracking.crazyegg.com/healthcheck
Preview:	{ "status": "ok" }.

Chrome Cache Entry: 1773

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	unknown
URL:	https://td.doubleclick.net/td/rul/578746000?random=1714076772866&cv=11&fst=1714076772866&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 1774

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x220, components 3
Category:	dropped
Size (bytes):	5581
Entropy (8bit):	7.8655533023783
Encrypted:	false
SSDEEP:	96:/qEmYXtsIXfhGe0ErDRJoJCRJFYF6H5EFXvQJn0MkQOZ1jZXIG2Sro:/bmctscZcEvR0uoF6HcIJnvkQW1jZXID
MD5:	F196D7593EA68BFF25959FCD042DE4AA
SHA1:	665BD1A92E1E3FB32A2CB4967FDBA78036B96FC4
SHA-256:	F62BA877BE0D32E1E2BE6DDD9B7822E8419AAA5ABB654DD2C10B5DDEC0C1CCD0
SHA-512:	240D9ECAF441CE3AB5E95D432D81B6EBDD019E67EC7C5469A9DB26AD7ABDB110C3E3B1FCFF7AA88140B7BA3867A99E04ED98A96AA040835977AE6D69074C9D3D
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T..........."..........7....................................................................Dv9j..J...+.....4........J...+....4...............................Z........Z........Z..............v......><\|..&.$j...APT..APT..A..APr.T..A.APT.....s.......c1..<.?.Yk...S.;^..\|...APr.T..A.APDiPT..APT..AP^..;[.....{......wG......c................ .......w..>[....oj..W...7...~g................................*........+......Lz...+}..g..8;-....z.\Y.%....1....r.XP.....S]O.f......o......9.Y_...PT..F..APg.B...O.:..:..7.M.....f1Vy...w.M.:..7...Wvu..'.^f.....Y...^...\|_..q.b...{..+..4.r..........V.kf.......;8.-.W<q..KPT.......A......<+..=..>.n..c.AI.v.A.....$...2^..........W..s.{....SE0.3..<"..\....lnb....;.....APB....APP.T....APP.T....APP.T..PT..G).APrq....A..r.T..'..APT..G).APrq..DF..DT..A

Chrome Cache Entry: 1775

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 400 x 220, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	7.773297124565366
Encrypted:	false
SSDEEP:	48:3gn10D0c4sbacr0mrqn+x/RGCn0eHi0Zmw+jmnw6W:3A10I71FXl2ViVunw6W
MD5:	DC38CB172C5076C9DFB0E20F22EDCD29
SHA1:	0F0A08BFC633E7E8C230E24BF5BDD0957FBDEBEE
SHA-256:	DE02C693678B85EA98026E6570DA411ADC4414724F4432186D4D4F55A459030B
SHA-512:	E86EDCE98140ECBFCBB3EA0320E6C2E28E83704B315D1F1E87775FF206970BD4A8AF438392FEA31692380FF9B6E3B1DF3F3A7AF41271B6ADBEA2AFC15C559E65
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............i..]...sPLTE.H...........J..L.V...Z.Ex....(b................6l.....[.....Q............g...N.%`.;p.<p..f.......Q..Bu.............k..u.....@s..U...........Iz.l.._...P.r...R.....M.!].4k.'a..W..M. \.0h.1i..........y..v.."^...............S..........t..)c........Gy....a...K......W....x...........Y.........5k........At..O.....T................&a............$_....W............R.q...J....`..Y.........m..2i.............\|..w.....{..U..=q....#^....\...\.d.............O.....}.....?s......Hz.,e.+d.i..s..7m..../g..........Y....^.......h.....[......V.......j.................N~........I....K\|.p..b..S..Z..L}.o.....~..........orNT..w.....IDATx....cMu...O.5..!.,[W..l.l.R..a.Eh.jf.....%.(R.KS......'u...9w.{.~r.m../.....9..../..;...................................O.....#.a.D....@.!.a.D....@.!.a.D....@.!.I....(7...$=..$T={..rk$..H..$}........../....D....@.!.a.D....@.!.a.D....@.!.a.D....@..?./#9......{......@.!.a.D....@.!.a.D....@.!.a.D.

Chrome Cache Entry: 1776

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10409
Entropy (8bit):	7.970401840052965
Encrypted:	false
SSDEEP:	192:pjLh1Pk4SMxUJuQN8NxEC1/Jz6LpMW32Bbs1zN4Ut801xn/KNyDc:hhO8xKuQNaEmJz6L2U2Bbs9NRn9Dc
MD5:	C8B065E1B1FC5A53EA2BAC89B3596A65
SHA1:	F7138A64AE387275A1870676854E85C3C7F44EE3
SHA-256:	C8CA294E224BB0F7F880E44C96D09F332484AC8676B5E4E3AF4CA6CCD7F714B5
SHA-512:	66E0D9176511DEF9953B2D680C0BC8B09137D832CB3CCBFA1300C4310E700833F25FC02DF34B0A5EC8257DE1A13F0478D465B9FC4B18AF587F4056617595455A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P..........(pIDATx..\|...W......?=I.i_,.daKB........2v.......L..R.....TA.Rc.0cf<..0.B.my.lc[.f.$k......\|..}.=..}. N.m.n..}....\|.......k9.-.C.}.....7.....g._.V.j.._,..TJ.R.j.&.ZM.....v....d...x.b9q....r."..../.L..9rT...K...;v......e..]299)...&9s..~.G<..}C.9![..k.....<.w\|.,\.p.n..\>..<....s..[....n.>......y....{.v.@.K..+...b...d2a...E..V......W`.tWW..q.z.....=..Igg.`.d.E.....?O.g.....+K....qb......A.......y.......N"..M.....D.t.<.......-..zv.H.....({8.45.t....t.M.......v.o'&&.@ut...N....1..........m..4Z...6..5..zdd.l6.8.8_.m).GGG.#....7.A.!97...ep}..WV..[#y.lV..d..R...>.[.TV5&.....`S=y.J..F{.....f..4........".....&.j`P.w[.%D.\.......V) ...... ."......pv0.xI..........;l...X.:....1..2wn.vnbbBU..S..q}~...ONN.1m...v...i...1.@&...b........]..Zz6..s.F...W_U.......\.~.=......a.<~..<.899......R.I.L .;....Z.....2::...U2N.<........\h#..?.6...:v......F...t.;Jq__.,X.@..z.;m/.u.l.H..{.=9p..\v.eM&...SPK.G.4...*.Q..50P.c.O

Chrome Cache Entry: 1777

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (41915), with no line terminators
Category:	downloaded
Size (bytes):	41915
Entropy (8bit):	5.711890455025583
Encrypted:	false
SSDEEP:	768:b9Qzmba6VYNd5b43sMpGS2Z+6ympOMqhIOE8EmTa+37PcN6OO5RKrb76Ac9+B:BQzm26VYqsmRmv
MD5:	6D79297E7A122241A02E7274F0FDB707
SHA1:	09656D52BD9A4D3615E046BCC1186A0713177E83
SHA-256:	47679B32AF4E5845F9231C8DCE5C94F8334D026A5511553AB8A1A9B954B3B970
SHA-512:	26C9C8E836E5D26183506FC8AE10EE94D3E069B32BEAE383B382106E037BC0866D2B24BB22E31BF83722EFAAB5303A41EF6F856DEE8AFAA528C60A2051378966
Malicious:	false
Reputation:	unknown
URL:	https://app.partnerboost.com/brand/track.2.0.min.js?bid=85021
Preview:	var PBT_0x26ec=['wpVyw4/DmsKnw48=','BcK+ckfCuyw=','MMOfFT5Z','csKsE8OHw6TDrcKFw7g/','wrMgccK/','w73ClQRieEYt','w4TDqcOXK8OJw4Iw','w4olbg==','w65zNMKyXiPDu2UDwo/DogfDnUzDp8KOwp/Ck2t+woHDjUtaw67CgMObw44Hw6jDvRE=','ccKlwqLDr8OP','wrEsFHrDocO6XMK2w6ZxGcKfMn3CrA==','wolfCsKD','w5E3ISHCjHBNOD/Crj8+wrtOFjk=','w7XCpVjCngLDqg==','Sy0WB8KWwqPCsMKrJQ==','BW9vHcO2wqx3aQ==','w506Iwg=','wr8YwoDCn8OKZ8K3wpo=','ThIVwrJsfAzCsw==','wpp4w43DkcK2w4Qrwr3DkRbDh1PCpsKS','w7vCnzFzeEoxw68=','SV/DomBQMW4=','OQU4IMOTPQ==','IhgV','wqFQwrk=','wqUvdsK/','woBOwpbDmsKaw58UQUvDtcOudQ==','FwjDlMKcBcK2woMqwoLCr8OWw6bDt8Kh','w6bClHLCtw==','a2BZaXQ=','R35VbHTDi8OZSQ==','w7d7w5Io','w5bDosOHB8Obw44zwrrCiw==','wr8kdMK+XyfDjjgYwonCt2LCiQzCuMKE','RcOeKAvCv8OfFxIvwo1HUsOBdA==','Wj/CgsKM','JRvDicKuD8KxwoUw','ZsO2w5fDu182wqfDow==','D3R5CsOrwo1y','E8K+wqJY','SloIHQ==','wrzCpWZmAg8zwr03','e2NfYXjDnA==','w4lSwr5Lw5pBwpbCrsK6O3jCp33DucO5w6k7VDvCucKmMcOPZWFOw647YMKYw7rCqnTCmsKzcQ/ColpvwqfDlsKPNHrDsw==','Y8K0w5pbw6nDow==','C8KqwqJY','w

Chrome Cache Entry: 1778

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	37
Entropy (8bit):	3.040403544317301
Encrypted:	false
SSDEEP:	3:CUXEcyv+L1pse:J/se
MD5:	3EACD0132310EA44CAD756B378A3BC07
SHA1:	E2216A7E9B73F5CB0279351C78CE61C33475CEA7
SHA-256:	BB229A48BEE31F5D54CA12DC9BD960C63A671F0D4BE86A054C1D324A44499D96
SHA-512:	BD9AB35DDE3A5242B04C159187732E13B0A6DA50DDCFF7015DFB78CDD68743E191EAF5CDDEDD49BEF7D2D5A642C217272A40E5BA603FE24CA676A53F8C417C5D
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.......!.......,...........L..;

Chrome Cache Entry: 1779

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.653178622293149
Encrypted:	false
SSDEEP:	3:YTyLSM9HJHWMRAMf88hjNJFA/dA7EEVrACq7A3BxKYM2ZD9DXgcVYY:YWLS+YQa4ZfAdAprACLxxDdbgc+Y
MD5:	015BF681509A6A2207672504CA4453FE
SHA1:	113E3DAF67580A7BEB950CF8D51DA1E6FB4EECC7
SHA-256:	DD21BFAAA3B2CF85FF85AF9F2580D329ECF4D98D05FA521359EAAD83AFB3E148
SHA-512:	9CD13B74A0DF56856884BABB30B541919966995E1B3700872225035D055DA9D38C682EF8E226612B4B91B4C0688BF1FF1991C59E851A879B66B70B59187E1AFD
Malicious:	false
Reputation:	unknown
Preview:	{"version":"11.5.202","sites_sampling":"%8&4!}%\|%]!}$<$4$8$;$9$6$6$,!}&%%?&$%^!}$<!}&0&&&%%]%^&&+%{%?&%^$.%[&&&$!}$,!}&%^%[&&&%]%\|&%%`%=&*%?&,%\|&&!}$<$3$6$;$6&6%;"}

Chrome Cache Entry: 1780

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1488
Entropy (8bit):	7.5117244553912155
Encrypted:	false
SSDEEP:	24:rGA0X/jcN91X6AL9Cw+lIQqz6WFtRI7iG8pDQg52gMYV/S/8jGi/89Ka1V1p29JA:rGAc/jYn6ABCIJ6WnKH8NrEgMQKw89Hn
MD5:	9BB1241FEB3D0C9BA298CDE314078777
SHA1:	850D4265FC36CB7B7BCF7DBB3DAF426CED542866
SHA-256:	78E8365887BF9BE357DE64DD9586827BDADC0E805F66A5018310B61C07A80C82
SHA-512:	1C95B2AE80F4081685CF1BB1FB1739AF62585B36F64730CDCF68DDE3B7F074BE430EF8239A5A99BF883E23F6E243EFCCE72AE696A1A37D18619B8BF63C88143C
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/vcu_logoImg.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@.......................#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma...................mdat.....!..l. h@2..D....<P...E)...2.{6../s..T.Z.J.......3..v.K<.8.5..7H.a.%b..`S.3..&&............+.....Ls..Q..q....Q.V........r.O{D....rNM...Q.n.6g......-...?j<PJ_R..S.?'.....=.h....Go./.m<C^....&......Y`@.6\|X%+J....%?R..........4...[t.hY3.D...y.]k<.1.].._q..9_.U.:...>...._.....\|.Z.L]....I..i..C... +...L..E..O.E.4.......K...s......Cu.y.Q..DV..['i...Z.c.Cc..&fj...q.b....}M..!......G.V...6..].#.^..be........!....:6..V...;.5..H......g....SP.&m.[qO6....D.....;.__\w..._.G./o.N...4.".+F...P[.YB;.Q..h.9.e.H.G..6........iyL.o.`.4.U:........X.<M\|)..(..Y&.IM.n.'...:.,.!I.#.:~.at.....w..t]..i......n!.fe>xl.."{8..;.W..%....... o." ,j..^........".......yJ..K&...qV...L;...y...2D.'3....s=D.~...

Chrome Cache Entry: 1781

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (63889)
Category:	downloaded
Size (bytes):	96677
Entropy (8bit):	5.475902250996523
Encrypted:	false
SSDEEP:	1536:FxveVv1uxGilDqVY/tKYS7EV0v8IBimxVoH01x3:F5eGlGytKY+UIBfVoO
MD5:	3C8DBFFDBFBECF988974BE0C29BF82FF
SHA1:	AFCA4D0E425FECB74BFC6BA8333AD31F4B72A8DF
SHA-256:	D69E3303757E223CC0FD92EC05E7F0EB6CA17C61C857CF273F19D181AD2AFD47
SHA-512:	C0D3964B679E25AC9F55978AF5CF5E8F2A488E07F9F0771CCAD9E7A26AB132981B62250C66E7036BE5B777709EDC8BF75FB71D59B5C30E91D5EA598AD465A8C5
Malicious:	false
Reputation:	unknown
URL:	https://script.crazyegg.com/pages/versioned/common-scripts/6735f9594d6bb8a4f1fe56c6b3e21cf5.js
Preview:	!function(){"use strict";var n,e={},r={};function t(n){var o=r[n];if(void 0!==o)return o.exports;var u=r[n]={exports:{}};return e[n].call(u.exports,u,u.exports,t),u.exports}t.m=e,n=[],t.O=function(e,r,o,u){if(!r){var i=1/0;for(a=0;a<n.length;a++){r=n[a][0],o=n[a][1],u=n[a][2];for(var f=!0,c=0;c<r.length;c++)(!1&u\|\|i>=u)&&Object.keys(t.O).every((function(n){return t.O[n](r[c])}))?r.splice(c--,1):(f=!1,u<i&&(i=u));if(f){n.splice(a--,1);var l=o();void 0!==l&&(e=l)}}return e}u=u\|\|0;for(var a=n.length;a>0&&n[a-1][2]>u;a--)n[a]=n[a-1];n[a]=[r,o,u]},t.n=function(n){var e=n&&n.__esModule?function(){return n.default}:function(){return n};return t.d(e,{a:e}),e},t.d=function(n,e){for(var r in e)t.o(e,r)&&!t.o(n,r)&&Object.defineProperty(n,r,{enumerable:!0,get:e[r]})},t.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(n){if("object"==typeof window)return window}}(),t.o=function(n,e){return Object.prototype.hasOwnProperty.call(n,e)},

Chrome Cache Entry: 1782

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	3.2001615812851174
Encrypted:	false
SSDEEP:	3:CUO/RD/0xlpfx/n:oDAn/n
MD5:	41C9BC7F3F78ED71115CC062C1C67B09
SHA1:	FF200D7EA28780D12BD6D9334178B930DBD5884B
SHA-256:	1CD58A827318C4A29B32A0DB15C8C39D5651B42D8CAD227519AD81BCE4ADB944
SHA-512:	280EA4383EE6B37051D91C5AF30A5CE72AA4439340FC6D31A4FBE7BA8A8156EB7893891D5B2371B9FC4934A78F08DE3D57E5B63FA9D279A317DCBEFB8A07A6B0
Malicious:	false
Reputation:	unknown
Preview:	GIF89a...................!.......,...........T..;

Chrome Cache Entry: 1783

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	3.2001615812851174
Encrypted:	false
SSDEEP:	3:CUO/RD/0xlpfx/n:oDAn/n
MD5:	41C9BC7F3F78ED71115CC062C1C67B09
SHA1:	FF200D7EA28780D12BD6D9334178B930DBD5884B
SHA-256:	1CD58A827318C4A29B32A0DB15C8C39D5651B42D8CAD227519AD81BCE4ADB944
SHA-512:	280EA4383EE6B37051D91C5AF30A5CE72AA4439340FC6D31A4FBE7BA8A8156EB7893891D5B2371B9FC4934A78F08DE3D57E5B63FA9D279A317DCBEFB8A07A6B0
Malicious:	false
Reputation:	unknown
URL:	https://www.linkconnector.com/js/uts_uid.php?cgid=900133&uts_protocol=
Preview:	GIF89a...................!.......,...........T..;

Chrome Cache Entry: 1784

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (44211), with no line terminators
Category:	downloaded
Size (bytes):	44211
Entropy (8bit):	5.515443189130591
Encrypted:	false
SSDEEP:	768:Epp9FNT2LFQg5Nna0a3akaFa3a8abeo08fhi1nO+EnrxawgSeoBg1Pvy0sHYfai2:Wp9FF2LFQg1ekfc1DEnrxawReAg1Pe4c
MD5:	43939098F65EA189A1F42A8B3D005118
SHA1:	3CE4B026AA7B76FF6E1C912A102F80BAF6ABA502
SHA-256:	9D15772F533007B1567408FDB39C18AB273DA42235E629ABA614A3707B4B8633
SHA-512:	695492A9381888F9BDBF070C8C255524A691F958BAD0B8CF900BF687875D311CCDFE00E1DADDEA41B332C2585D3999458A8C9E6F11012157893FF382112FF862
Malicious:	false
Reputation:	unknown
URL:	https://www.dwin1.com/20200.js
Preview:	var AWIN=AWIN\|\|{};AWIN.Tracking=AWIN.Tracking\|\|{},AWIN.sProtocol="https:"==location.protocol?"https://":"http://",AWIN.iScriptCount=0,AWIN.Tracking.device9Url="https://the.sciencebehindecommerce.com/d9core",AWIN.Tracking.flags={allowNewAWCCookie:!0,allowNewGCLIDCookie:!0},AWIN.Tracking.setFlag=function(e,n){AWIN.Tracking.flags[e]=n},AWIN.Tracking.getFlag=function(e){return AWIN.Tracking.flags[e]},AWIN.tldDomains=["com","org","edu","gov","uk","net","ca","de","jp","fr","au","us","ru","ch","it","nl","se","no","es","mil","gw","ax","wf","yt","sj","mobi","eh","mh","bv","ap","cat","kp","iq","um","arpa","pm","gb","cs","td","so","aero","biz","coop","info","jobs","museum","name","pro","travel","ac","ad","ae","af","ag","ai","al","am","an","ao","aq","ar","as","at","aw","az","ba","bb","bd","be","bf","bg","bh","bi","bj","bm","bn","bo","br","bs","bt","bw","by","bz","cc","cd","cf","cg","ci","ck","cl","cm","cn","co","cr","cu","cv","cx","cy","cz","dj","dk","dm","do","dz","ec","ee","eg","er","et","eu","f

Chrome Cache Entry: 1785

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2635), with no line terminators
Category:	downloaded
Size (bytes):	2635
Entropy (8bit):	5.84282025979193
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08FLaR0lwuGG9Q86:wsbSUtJfxrqLWWWdV6j1xLA0Y
MD5:	3D690DA69A3AE737A38AA31E0D090BEB
SHA1:	BCBA6BD707FD5FE4706CFB162A0DD326FB87F158
SHA-256:	FCC6C50C7CD5A7ACE9545BEE4FEEC460E2931C54137DF6B016E92150047944CF
SHA-512:	98832014EE474603C740C62CAEA4059F072A22F40944731E32074FBA68CA865D9B73BB4684FAC7CCA18FCA5D98FCB1AC57470FD6037EF325C1DE5398585CDD5B
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1004581587/?random=1714076772858&cv=11&fst=1714076772858&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 1786

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x220, components 3
Category:	dropped
Size (bytes):	4322
Entropy (8bit):	7.737748827660853
Encrypted:	false
SSDEEP:	96:ZvNfJJ6vLJWOtB4R53f+I02MWrAbTNp1Qho+VxyTaqi:ZvCtejWuwwooQO
MD5:	0CC4FF44913F34FC229CC6710AFDC7EF
SHA1:	20EADD71C596883A6F5FA6F05AC85F4ED0F2F14F
SHA-256:	35141FFF802FA5698414C1DE028229B7AB200DF43D1A3C3023AF4B086BD07A49
SHA-512:	F474DB5D8BFBE852AD2A0214A99F57DF4D463298AC6456C4E3789A81E49BDE20D32063BECB088B73C046FEC0743361A66BDE6F07D4D98F71A36BE8D706FAF50C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..........................................................+".."+2(2<66<LHLdd.............................................+".."+2(2<66<LHLdd............"..........6......................................................................^.............................................R.6.E1..5.Z..................R..SR\.....>...Y..................}.\|../.8.g.....=.o.W.W.\|+.v....b................z..7..%.:..{.E..1.d.NRO.9......;.\T...............S.9o...g.7...k.......Q................).`.....;y.I..........................o.&.f...Tm..............)I.?x.p......2v."D..J...;.z...T.qS.R\|....J..=......L.dn.}sX[.A...........V...oS[.}E...au...]...^..>..(.\|.m........:'.0...(S0....1.l....Qe\..........'H2.d._O>"K..-y.'A.....To.vg...............<@.37])[................................................I...........................!1."..2APqt..6QRUb.. 037@Daps...#%&'45BVr...........?....-..%......R.?!".B..\|..F..&.......q.......\|....4.n......./.i....?@..........G/.w.

Chrome Cache Entry: 1787

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
URL:	https://pafutos.com/tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=pafutos.com
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1788

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (40729)
Category:	downloaded
Size (bytes):	416793
Entropy (8bit):	5.551601855401309
Encrypted:	false
SSDEEP:	6144:X2KMysQXaN8sYLceF+jqTnXP9RIMHINOS:VsFSJ0wy
MD5:	6CEFB1E5D04A6FF7AE3F078858CD8DB3
SHA1:	018E427B64404E9DEB424F59F1EE890F298786F6
SHA-256:	AE82D5DBE19EF1FA28DC23AE12683B50679374EC7ECD3B0A2C1F47943BACE223
SHA-512:	2EBE877C95F0E96F7CF8F3AE44CC1934E5C2756281EC2585972BDD2ED3382D73EEF03CC226ED35613C9B58D41341D5057BF3A53AC016D0F346CE3C5C20A8D3A3
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-57FR6ZG
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"438",. . "macros":[{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"cmpRegulation"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"cmpConsentVendors"},{"function":"__jsm","vtp_javascript":["template","(function(){function l(c){if(c\u0026\u0026c.productNames instanceof Array){for(var f=[],d={},e=0;e\u003Cc.productNames.length;e++)c.productIds\u0026\u0026(d.id=c.productIds[e]\|\|null),c.productNames\u0026\u0026(d.name=c.productNames[e]\|\|null),c.productPrice\u0026\u0026(d.price=c.productPrice[e]\|\|null),c.proQuantity\u0026\u0026(d.quantity=c.proQuantity[e]\|\|null),c.productVariant\u0026\u0026(d.variant=c.productVariant[e]\|\|null),c.productCategory\u0026\u0026(d.category=c.productCategory[e]\|\|null)

Chrome Cache Entry: 1789

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5140)
Category:	downloaded
Size (bytes):	57526
Entropy (8bit):	5.325196955204365
Encrypted:	false
SSDEEP:	768:so/MPceY1M9WU9Yw5d1uYMxBMYUYNQj+DYfq5j1jYY8Z02LKVYKYLyYeIAcBYYci:RJeUwT7ltMHM9eEqJ1UTZ02LKVlEy2
MD5:	A649B6FC44301AC53EFEAFA228949DB2
SHA1:	59477821BA50EBCF8914F8F4F930A2CBB7D4FA61
SHA-256:	27AAC2303E644C5C3530328F2BDBAA2BF7358A0E730F10C6A5BAE09A3CC96EA7
SHA-512:	5460CD7A98F2A753D850A0B554617D19C17A6E6338C64861CD59FCFACC3A4C85790D091A5096235C4B7871A5C2989995AFB484D3F5AA0E39AED8F2D34CD5008E
Malicious:	false
Reputation:	unknown
URL:	https://connect.facebook.net/signals/config/475745997703022?v=2.9.154&r=stable&domain=www.wondershare.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 1790

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, progressive, precision 8, 400x220, components 3
Category:	dropped
Size (bytes):	4196
Entropy (8bit):	7.311217793872276
Encrypted:	false
SSDEEP:	96:hd8rrb7XzTSFnV3FaAm3/z7XqU3mzjWIRjiG2:78rrHPO9FaAmvSMmzjWcjiG2
MD5:	438B23E2F352B3893CCCFD7ED6DC567F
SHA1:	D83CE7DE8C4BB9E4A267BDB7D770A29E19C438B1
SHA-256:	681B43102136929E3E9F8341EA291B1F823C2465B2C0182087340E161DD04BE5
SHA-512:	B7AF98836269C1B8AAD0D792D1B89309DC794DC7BE6ACA3860BF024C26B009BD82D281F4027CFED361A8B041B60587EB1A15B416E82D352B6FF4948C33F37FB9
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....%.%......ICC_PROFILE.......lcms....mntrRGB XYZ .........).9acspAPPL...................................-lcms................................................desc.......^cprt...\....wtpt...h....bkpt...\|....rXYZ........gXYZ........bXYZ........rTRC.......@gTRC.......@bTRC.......@desc........c2..................................................................................text....FB..XYZ ...............-XYZ ...........3....XYZ ......o...8.....XYZ ......b.........XYZ ......$.........curv...............c...k...?.Q.4!.).2.;.F.Qw].kpz....\|.i.}...0..................................."......".$...$.6&&6>424>LDDL_Z_\|\|.............................."......".$...$.6&&6>424>LDDL_Z_\|\|............"..........5..................................................................8>..........................................................................:T....U.<\=..4$..............>.~..{V..].....c.^Y.J.................N6}&.Zo.....Z.a......................I.B.\|..iyj..x!G...............

Chrome Cache Entry: 1791

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (26258), with no line terminators
Category:	downloaded
Size (bytes):	26258
Entropy (8bit):	5.571429365980407
Encrypted:	false
SSDEEP:	768:JX23xUjK6z8M9uZHvIsJCCtB2vnDBX66JhJfHDEv+BdQ6Xh/lsRfIcTTT2056gR5:JX23xUjK6z8M9uZHvIsJCCtB2vnDBX6r
MD5:	7498A382C81E36508BC5DBEDEB33CAA4
SHA1:	91BCAF99B5B6E8F078728A60264D2DDB34CB2960
SHA-256:	101DEFEBF81AB1BB4B57902E47449F870A1F1C907760B84CB087927EEB2F4360
SHA-512:	7F9E3FD96853667E75F2C0DA5E65A68D17F00C20C6A45EE366903A276E262406F9F0431221F5FBCF8519AC93339802F2603D8CC5CEB01E131930B7CFF65EE004
Malicious:	false
Reputation:	unknown
URL:	https://td.doubleclick.net/td/rul/1004581587?random=1714076772858&cv=11&fst=1714076772858&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j88060693"}},{"action":0,"expirationTimeInSeconds":31104000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j2888893","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=1j2888893\u0026tag_eid=44806720","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1suPiIHA!2saAVYZQ!3sAAptDV7y21JL"],"userBiddingSignals":[["83210773","452819951","30002893","83210653","2496133","2497813","2498053","84559333","2497333","10538773","30002773","4

Chrome Cache Entry: 1792

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 55 x 25, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	173
Entropy (8bit):	6.279043094860781
Encrypted:	false
SSDEEP:	3:yionv//thPlimtJiPKdMlJ3BwpLHalJ5GWAf0NSnFaQ/lL/sIyJm7AsBq/1p:6v/lhPRgKdkVBwpW7zQ0+FZsIyJMAgKp
MD5:	3D025C7AA4A7D8474CE9BEDE7F3F7A58
SHA1:	FDBF685BCF71D71F118493E8E57D0904ABF71711
SHA-256:	49249F1E25E68750D83393E50CE2F5E1109DCFCFBE73B2388069EA45A12CA37C
SHA-512:	B5EC05D6B9ABE671A66700F497B18449F5CC47D4CA02E5245207821F76B34C442333189B5DB5A0EE55A1B9FBCF1EE65C72EAF8BFF2D3B1450F4D1ED47FB67F80
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...7.........?t~.....orNT..w....gIDATH.....0.CQ..p..Z. .U.n.i...........B...8.N. $D=..W.(,....c.....M.. .K...Kns.{.onn.s.......;...u.I.x.e....IEND.B`.

Chrome Cache Entry: 1793

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, progressive, precision 8, 606x379, components 3
Category:	dropped
Size (bytes):	41059
Entropy (8bit):	7.975219294325299
Encrypted:	false
SSDEEP:	768:fvxORtmL4cV3x0tFts160ahSfff7ffPNNNsNNzBFihcaVMv5eZema3i3UxTVcGq0:fvwRtmL4cxutFt07FNNNsNNGGaahu3UF
MD5:	2885AC4BA942003271D6841A58451AC0
SHA1:	D060463054F61C2470831A96CF7766EE67B6E2E4
SHA-256:	BCA53B004FFED5B6C9BDA7F3D515814654D77EBBF966AC9A78646DAC10E643EC
SHA-512:	08C2CEF61DB5FCE5D57CF3AA0C6656FBB58757474CD7219E90FA1DF1ED57F352D2EF6964682032396262D8A0B10B88DDDEFDCFE71ED90EE1125A05B82085BC26
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....%.%..................................................+".."+2(2<66<LHLdd.............................................+".."+2(2<66<LHLdd.......{.^.."..........6........................................................................).\|.7.a.&.....fvc.UX....T%-UBPT$.-....-:......\...V..7..Mdswd.YD.L.je..M5.....}..h...Z".. Z".. Z".. Z".. Z".. Z".. ....^.+2N...L.v...Y]...:."..>{........Q..J.@....[V[.9.n.JY\|yf...w..I...-.=W.jD'N..+......R.Wg.`..v..A^.+....\|.....j.....0.X'2.P..\|./.\!=_.p...Ap...Ap...Ap...Ap...Ap...Ap...Ap...AsW.N.}......Q..'.f>:x.<.i..&....O.c4.f.H....i2..iR..>....y.f]5.;l.sQ.M..k........=a.2.....k{.2.g.d..y9..O.j4.f.J.j4.f.J.j4.f.J.j4.f.J.j4.f.J.j4.f.J.j4.f.J.j4.f.J.j.......N..~..T..6J. ..vqb...x.W.].pW.}.F..f.1.s.l....p..n..D-......7. .8.p...7. .8.p...7. .8.p...7. .8.p...7. .8.p...7. .8.ugnTw..l..=:.s.-.Z........<....v...oh3.?.F..jW.l_..........#b$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$.l$y......._...

Chrome Cache Entry: 1794

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 600x376, components 3
Category:	dropped
Size (bytes):	28767
Entropy (8bit):	7.739132506852099
Encrypted:	false
SSDEEP:	768:4jH4rCqQQgQP9F8XxLQIeZ4OO8PMw0NLN9YjE:4krCBwCXW4OO8PMwWhz
MD5:	D283CB374F7A4CF12FCCE29F88892172
SHA1:	BA4D1854177DDBF75F4CE9A9F08BB4E09EB2123A
SHA-256:	BC3A1189DF87F82656255DD186BE738206A74E93D9488B137AE5F6E894BE5F08
SHA-512:	53C4EF43BE4AE6047CFA957C85AE86A4CFB76B81B6BB1554CB3DBC704A7367B8B3B1206F06E2284C9C1CA6DA8690AC9B2EF5982EE55044BEE28A26F5F684B46C
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......x.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.o......0.....,JY.h.G..t.S......._...Pi.^..T..4....(..l&..5:}..)...v!~b9...F....t.b*8.._c....._...M6.c.\m?....mjV.v..J...[...Z..xDr...H......@H>...SK.J..Qx.&#..y..f....i..~..(.=.........\..wL.[......eVe.q......y.V.p..,=......_..k..~..)~.g..>6...?.E..4)"K..+:..d(b{...JYt...yo.....QU..}O.K...5...k?.........f.....O...Z1irI<q......dVU`H..c..K...,{[qB.../.......

Chrome Cache Entry: 1795

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	downloaded
Size (bytes):	9662
Entropy (8bit):	1.976735566032478
Encrypted:	false
SSDEEP:	48:9wcjcDcTclc6p+cRchccodcIcMcwcStcOtcLsAE4whFvMndDIAs+Sm:9PgAQy6pNGhDNXzPZNg+Sm
MD5:	60206C00FDD79FFBE94CA2C8022912C5
SHA1:	D67E3F2CED6F4C2A798DBAE4429881A23719B5F9
SHA-256:	FFFB04270461D651B1C6C1C96EC81E6846B2516CA7BF7DA34D33825F107A734D
SHA-512:	C6C4956A898692F459A8DC8B3EF9F8CA249DA88DDBE737732B649F1AE26861CD06446A90841F068FC712CF36E7FB9A5B29E5A09FB802B68649CEB915EC935B95
Malicious:	false
Reputation:	unknown
URL:	https://www.wondershare.com/favicon.ico
Preview:	......00.... ..%......(...0...`..... ......$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 1796

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, progressive, precision 8, 600x540, components 3
Category:	dropped
Size (bytes):	20288
Entropy (8bit):	7.90418891165711
Encrypted:	false
SSDEEP:	384:987cKqosSW8uoL35vRFvf33UNBTOP44qK8T81EVJLyqvGzHAyd:98eauYNRFvf33UNB6AdT8uJLxGzgyd
MD5:	7C0178B4D82DDFA7B0DED2E5131F2FC4
SHA1:	42132EC5FC76F601081C8499E40D6F058CE7B51B
SHA-256:	52E512026D53BA9B97093E586987DE52ED9186C1D1FB3517C9CAB312A2E7E8B6
SHA-512:	4533175AF8F7FD6DECD58820AD12CF01F2FBC073426A71509D7D6052C2025560E4FEF26E1405B37CDB4E1A793ECA8A16ACB82FB34C9843228154D5E0F38743D0
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....%.%..................................."......".$...$.6&&6>424>LDDL_Z_\|\|.............................."......".$...$.6&&6>424>LDDL_Z_\|\|.........X.."..........5..................................................................e&7...L.B.....6.h..I...#.>`.l."u.}.R.`..>}....Y....c2._..=?..b.a.wq.]..h....{7]...E}..".m;N.....?...*.ts...E.TR..bD..........h>w.2.y>.;......}flySPn:.zXe......l.!...>..>._>.>..>\.\|......P.v..d......?.J.H.E.+.._...>.\|>...>...}.C..j..?)Hd.L...)..Nk..O.......i..Q5.......vuiu.W....t......d.<.25.W......\|...X>....P.6..e......9..WK`c........6=\|.w.f`V~H.......Fm............!...B....nx.O..Z...v<..\|...eT...\|._....R!..Vt{...W_.\<`...V.V.V.V.V.V.V.V.W..c.0........[..5D{f7..W..._...c.8.1.c.8.1.c.8.1.c.8.1.c.8.A.od.6.A.}.P.>....g...&..J._.\|;].:<...H.8./...N++........)....y..in..\.1.}..O.?Lw..:..^.M5..c."...q..^...3...4.[kjtKn.I.m...b..[..,.v..b[{O.'FW..9.w.<.<..<...3...4Q%. .......5Rb..?t.-.C+..?.4..6."m.-H..U...bb>...&.

Chrome Cache Entry: 1797

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4444), with no line terminators
Category:	downloaded
Size (bytes):	4444
Entropy (8bit):	4.967323705143905
Encrypted:	false
SSDEEP:	48:Tq6m6TJh4YMeCJBBZamrPlGdDbfGDiyDHBUXdnH+R7Ad6T2lg9o0s2Ulf/Lbvg:26m6We4Z82GX9e5e6yC9Zs2UNg
MD5:	B0568C126C5DC08228A6C581D87F7F34
SHA1:	424BDD96F103D01606CC0CD930A404BF23B398A3
SHA-256:	72D05DF00BC5A69E3F357180651A21D08FAED7EDC440F5B94D93F3C414806E64
SHA-512:	F2349ACF4ABCEF588AE28E9B7B4F655E476806403F18FC0BAB03609E563A68BE376874E82D79503A10DD7952E5B20AC6C6609CD9C0A693ED1B75375A2A9037A1
Malicious:	false
Reputation:	unknown
URL:	https://www.wondershare.com/style-fonts/global_fonts.css
Preview:	@charset "utf-8";@font-face{font-family:freigsanproLIG;src:url(fonts/freigsanproLIG/cf49aece-00f8-4267-b583-e78d38ee3322.eot?#iefix);src:url(fonts/freigsanproLIG/cf49aece-00f8-4267-b583-e78d38ee3322.eot?#iefix) format("eot"),url(fonts/freigsanproLIG/207add5d-09f8-4df9-a0aa-e5f02f8bcb52.woff2) format("woff2"),url(fonts/freigsanproLIG/57b64ccd-ce33-4c5a-b6ba-0fcf5232aec9.woff) format("woff"),url(fonts/freigsanproLIG/5cb16e82-1cd6-4d55-846c-b9daf11c7f90.ttf) format("truetype")}@font-face{font-family:freigsanproMED;src:url(fonts/freigsanproMED/0b5df096-1809-4ede-bcf6-dcf708de9efe.eot?#iefix);src:url(fonts/freigsanproMED/0b5df096-1809-4ede-bcf6-dcf708de9efe.eot?#iefix) format("eot"),url(fonts/freigsanproMED/8b338cb3-bb89-40d3-8c01-5580bceb3715.woff2) format("woff2"),url(fonts/freigsanproMED/4901a31a-f392-404a-a900-77532930640a.woff) format("woff"),url(fonts/freigsanproMED/4d13c8f1-526a-4c9a-ac70-6d7a855f4c4c.ttf) format("truetype")}@font-face{font-family:globalIconfont;src:url(fonts/global_

Chrome Cache Entry: 1798

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	808
Entropy (8bit):	7.650182953038441
Encrypted:	false
SSDEEP:	24:zSNfRLXLfGJCzrs+7NHQeNZjK5AdDcOH1/3WF+c6vf:uPNsINHQeNZjK5scO93wyvf
MD5:	6A72C2F36382A38C3DBB6DE90036193A
SHA1:	8039F3F58AD400A8DD6FDA04A071EB37AE5DC8A9
SHA-256:	8D85FAEDA30051D95D2BE0899AFF0D0826148CB29B8C631E04E4FCDEF3C514EA
SHA-512:	058B990C5A4319760C88A4C4C0CBCE823B2196F5902C492376DEE17EF463ED2224C34DE5708FE381AE3EEBD08A759773723B8CB36CE6C89CBD13B8BDCBD276FA
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images2016/icon_secure.png
Preview:	RIFF ...WEBPVP8X........1..1..ALPH......+.i[......cd#.m.m....m..^.q.9..Gn.H...{.G..DI...w..xsa..."..O=.C..~Yz...p...h^ .....Zx...p.G.J.7..C....I.{.....?..7.t%Lz....$x..M...p.+.Z..Z....ux.V.l.).R2.d..mZ....if...<y..I.`.....\|.,.!.?.J... .....1,.....O."../}E^.1.......x.....v..7.....k.@.J...x.J......+U.....V.3.O.=.L..t...R.t.W....{...D.....5...9d.........#S....Ia4{.7'..EO....".S.6p.......>,O..z....X.)..=............/.~ne....`.VP8 ^........2.2.>.d.P(%?........l...q....0....z..n.3.%...7......}...\..:.3..P.&.....q.p..............$?.@)%nt..V.Z...0t.......MbKs....=?...)%.....$.[.?.qe....c.-...0. ./_...d..be.....5.^....)S7.P~......6...a..Rz.K....[............A.db....-.L..<4.?..h....^..p...S.W..."k.V).\|.aXisd...y.J.BzeuF...1..,k.`.)L.w....o.......{*F.)...\.p.2.o........

Chrome Cache Entry: 1799

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	148
Entropy (8bit):	4.934234850599138
Encrypted:	false
SSDEEP:	3:2LGffVCbKSQXIQMzgxRSK8SQXIQM6FYY9MPSfDBSXIQM7jyAEvorAV3bMYYkNZgN:2LGXVoJQX+zgx5QX+uYW4X+7jyhL3o+e
MD5:	A16E91010FCEC7130A4768D14D5A55E6
SHA1:	E931EDA3A4E8DA9AF436C635E31351021DA01BDE
SHA-256:	EDE36E6487746175A33642512DDDFCA0503FFEAA6D044AB512BDDFC922F3F163
SHA-512:	A1E17C3E6157101E0E2355A6772AE62AE248931EA13FF732F1643ED8A093CA7B3201356BBF8B19D672BB072F705B8C4130C72A3337680E2181343F6D8A143AC5
Malicious:	false
Reputation:	unknown
URL:	https://ut.rd.linksynergy.com/jsp?cn=rmuid&ro=0&cb=___rmuid
Preview:	(function(){try{if(window.___rmuid && typeof(window.___rmuid) == "function"){window.___rmuid("3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f")}}catch(i){}}())

Chrome Cache Entry: 1800

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	13461
Entropy (8bit):	7.977895930915459
Encrypted:	false
SSDEEP:	384:raxhYpbZyAfVX3Y01k56qxgubI+OUdWIvkC+RXLcg2j:+rYpdpfNVsdzIfoEX4g6
MD5:	99A55FE000B3A092063669885E512CDB
SHA1:	177F7FF426D1153BAD478CC00E38A988D0E61DE4
SHA-256:	0B4951B868A0588EF4BBADD705E1924CCE0855CA894770D67E9D2B0C77C3FADE
SHA-512:	BA167AF11D2F4BFABF56558FD82A6508AF20EEF0E93FF0267A01C349BE7338F33922D7ED14A3C8E0921B78185459BEA823B1ACDBB0573AA3E4B6339CC8D6EA68
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/multimedia/video-converter-ultimate/record-2.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................3....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......X...l....pixi............ipma.................3.mdat.....f%{[.....2.f.@...A@.+.A]-T.......U...v.%...t(.g...f.T..p.Y.U.....EE6..c..#..M...m\......m@....O..p\|....J.EEo5..,.MM.E.MK@k.......k.XB8._.t..1\k...4....v.s.L..%.z.._.....:..............`Wv...q.....U..O..AZ..#...O....)...#=.m. ....:..X#..?..+8.].e.@..j..a....../.b.3E.>...F2.O.sl..?...-P.\|.s.w..).;w\|.Y...Utr..I.....bK4..M.g..........\|$....Ny...\.f.y.....Z....X.s...z..!.......R.ig2F.2.gu....$...(.w.2...U.._.\....5...2.&...\|....3..8.x..@wj.dHk..p....}a....p.-..^....wR 0.....).mf.p.(I...J...{2..60gn.$.T..5......?.D...Q.C...3.^.w..Y..,.Q.'..lm.(.L\|......w..t...?.TO..`K.#..T..so..,.?\|.lM=L......@.E....8(.F.Ke..9........ ..o....%.a....sV&.U._.\......3.Va.>K....~J4.gL....1...k..~z..H&n.

Chrome Cache Entry: 1801

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (358), with CRLF line terminators
Category:	downloaded
Size (bytes):	6917
Entropy (8bit):	5.450963612251361
Encrypted:	false
SSDEEP:	96:grrVzQ+eWkDn5z4F/8LYKQK6o+WiAuRBEcOk9NOrJTLW:gV8ln5z4ZoYvFondYBEi9uJTi
MD5:	E54616FEE851779ECEB95DD131D67041
SHA1:	8E830B09B6471E523F4CB381D55E68BE303A5750
SHA-256:	32A7F0EE997A0EA6D5315FE235E6CA9156CF8F1DE908D069B907F434C967D85A
SHA-512:	3F571B7A67A9F192390FA4B55F1035A18BC2C65EF1231FF09DB00AF0F14268E7CF187C4311E65FE73352C5ABFE93A0D673118C58D66934C49630ED5973E08EA8
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/script/mobile_download.js
Preview:	var images_host_path = 'https://images.wondershare.com/';....fBrowserRedirect();..function fBrowserRedirect() { ...var sUserAgent.= navigator.userAgent.toLowerCase();...var bIsIphoneOs = sUserAgent.match(/iphone os/i) == "iphone os"; ...var bIsAndroid.= sUserAgent.match(/android/i) == "android";...var bIsIpad..= sUserAgent.match(/ipad/i) == "ipad"; ...var bIsWin = sUserAgent.match(/windows phone/i) == "windows phone";......if(bIsIphoneOs \|\| bIsAndroid \|\| bIsIpad \|\| bIsWin){....$(document.body).append('<div id="popup_div" style="position:fixed;top:0;left:0; z-index:999"></div>');....setBuyBtn();....changeBtn();...}..}....function changeBtn(){...$('#article img,div.btn img,div.article_newCss img').each(function(){....var src = $(this).attr('src');........//..Dr.fone.....https://itunes.apple.com/us/app/data-rescue/id1030298807?ls=1&mt=8....var download_url = $(this).parent("a").attr("onclick");........if (download_url.indexOf("1283") !== -1 \|\| download_url.indexOf("1318"

Chrome Cache Entry: 1802

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	9429
Entropy (8bit):	4.4562886365322845
Encrypted:	false
SSDEEP:	192:1zlurGJF4UY7/XTOxJtdnjFw81SucG7yYSiKWXwUv:1z8Uddl1hcG6SB
MD5:	ED7F8256D329B0DF3B565B5BD04ABF87
SHA1:	4D855F9CEA346C782628FA11A979E4EFA1272090
SHA-256:	B4B1338DCD5D500F70397B7DFCF09F0EF3CB323EC80C92C5582672A4D8436CE4
SHA-512:	FC51DE02E0CEAACBBF5145AB1180BEC6191016513C82188D3609E0F90D0EBE7EA64E4A03B621ACFE7F0A3524C799668BD3E2F7554488C5D9F96E44B3A57B4895
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style2016/images/ws_logo.svg
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg width="219px" height="31px" viewBox="0 0 219 31" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: sketchtool 40.3 (33839) - http://www.bohemiancoding.com/sketch -->. <title>6FBF7252-F20C-4481-BA8E-02FFE3B4F95C</title>. <desc>Created with sketchtool.</desc>. <defs>. <polygon id="path-1" points="63.4275711 30.9752593 0 30.9752593 0 15.6229983 0 0.270737257 63.4275711 0.270737257 63.4275711 30.9752593"></polygon>. </defs>. <g id="Symbols" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="WSCOM/Navigation" transform="translate(-369.000000, -19.000000)">. <g id="20160909_Wondershare_logo_RGB_dark" transform="translate(368.836558, 19.000000)">. <g id="Group-5">. <mask id="mask-2" fill="white">. <use xlink:href="#path-1"></use>. </mask

Chrome Cache Entry: 1803

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, progressive, precision 8, 516x440, components 3
Category:	dropped
Size (bytes):	22485
Entropy (8bit):	7.927792669961273
Encrypted:	false
SSDEEP:	384:7KkNZKYIacSA+PPPPb4III5JC3IIIIHS7iul1Q2bXllZpNoyFVz74Re:7ncA4IIInC3IIIIKQExssWRe
MD5:	D83DB3C4D34ECC9754D23CF8484D544D
SHA1:	8949BD130072898FC4B69C14ADE6FCF617A0E106
SHA-256:	F7C575716C8D9EFD267ECB061A564BC634CF0C9EB94AD4D75059212BCD3E24C3
SHA-512:	87FD5E5CDDB6290F157F32C52DE16D4F11CA8CC5021E852A93B3537596AD2DE7BF06D113FAF9F2175E1F47B1F536EF173A86F45BE8EFEF2524FD9FBFFFC49334
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....%.%.............................................................&""&0-0>>T.......................................................&""&0-0>>T..........."..........6........................................................................l_........kF...7..^.l.X.}..\|...f....a....a....a....a....a....a....a....a....a....a....a....2b.=.L...-S.~.s.X..4_...xt..t.._].5.v.'.x} ..y.....lt...I.lt...I.lt...I.lt...I.lt...I.lt...I.lt...I.lt...I.lt...I.lt...I.lt...I.lt...I._.........`..\|.F......s.w ......>................??.....]sq..c.&...N2k..U.NU.%QBU....D.G.!.....o7..........".....= #..= #..= #..= #..= #..= #..= #..= 0.c....b...lU_........u._.p...r7..6..~..S.....Y.....!.....\|=r....O..\g.?=.........sE.P.-;P..E..Y7.mz..A'D.tA\|lu.Bc.V.f6........G.G.1..,U..........V..J..J..J.....bgFyQ.... ....Z5\|..8.v8....K.......m)uaJ]YR.QJ.].72.........#.#......\.\|.......;.R..V..i...u....3.#9.3...6>B>...................G.G.....Q.N%.b.-h.-b.....*.X.-b.c....c.!.= b= #..= #

Chrome Cache Entry: 1804

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, progressive, precision 8, 600x375, components 3
Category:	dropped
Size (bytes):	27587
Entropy (8bit):	7.94784893918994
Encrypted:	false
SSDEEP:	768:fv0V7zr1GdGNemIY6/cDMwYcw85kIlQcbDV1:fv+7zr1B4nYV9xl7DV1
MD5:	DC183DA94279D362515E0FEE402D09A8
SHA1:	173F4119C35D3FFDE6DF88C5D9F291A9AC004B34
SHA-256:	8E6E3ACDA2FA43835A1DF4536EC0BC64710D3A24807D0E0B90C149BBC3EF05DF
SHA-512:	AA2FDA886538C4169F0EA6367D20F1ECA702542A068268836CA5E263C7B0B232FE21A7982F03714BD4B7711670C76AAF1D70E150F73DFDCB83E9220A7DEDF098
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....%.%..................................................+".."+2(2<66<LHLdd.............................................+".."+2(2<66<LHLdd.......w.X.."..........6........................................................................)..@..[...\|.s.x/...a..p.W!.4.q!...x....Nz.].Nz..(y...g..~q..9.'.....S-+3.]q..$.D....A-.KD....A-.KD....A-.KD....A..0a`.3..M9sq.....(.P...y..E:............v.....O.Z..;._..X0...6d.^.e....*..zr.K.\|...G....m...#.Q.j:3.}o1Y....>}....JJ...}R1..%.eS.D..9.NA..D..9.NA..D..9.NA..D..9.NA..D...@y..;-..!^...a.[.uz5......h..s.....\|....0uz..[\|N...;i...w..T2..e..Qw.+....\|.=.7"..8M..r....R4e...s.oR.-.H<.. ....oR.-.H<.. ....oR.-.H<.. ....oR.-.H<.. ....oR.8=..V......N.ao.{9.2....6..N-...'....3..9..n.....9..n.....9..n.....9..n.....9..n.....9..n.....9..n.....9...i.d:a.$.X{....<.5.....Gb..\|&."%..b"X.."%..b"X.."%..b"X.."%..b"X.."%..b"X.."%..b"X.."%..b"X..0.k.q\|...T..K..s...g..9.].......\|..@.....................vo....s....K....}S'a...

Chrome Cache Entry: 1805

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 118x118, segment length 16, progressive, precision 8, 39x39, components 3
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	7.370493958104807
Encrypted:	false
SSDEEP:	24:dtFGstFylgalQ7tmDK8czOIAFjfhebETamkzDd+r4U2ZrdPBRbHlkf:dtBtQheED2w0bmszD8OtVSf
MD5:	3E693C345D88E6E52075FE098A70AE97
SHA1:	39586861EF884BFF814C0D4CC141EB8B3221DCA4
SHA-256:	1B5BED548A2C534046650F3C24B64EF524AF1A69C2B1607D0A9A8FDC66D702DF
SHA-512:	0BFCB356E9E22C8368DA68E24DDE1CA33AA59C63497DC27AF3C2519BD81C399C9A16A54E0FE31510A7EBFCFED55CA64836CCBDDDC4170F6640F8769420A39C31
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....v.v.................................................. .... %...%-))-969KKd............................................ .... %...%-))-969KKd......'.'.."..........2...............................................................N..D....m..Y.....H.j:..L%y..Fh.....>...........0...........................!1.A."ar2Qq..R.............?.....S=MK.E....}.G..^..7Gq@.4>..?....MU.wU...}[..r....mz....\>b?.q.*.p..i%I.$...e`r.:...Sv...#......I.M.H.b..@....K\|22..9.M.h.....%Pe@....9:.B.l..,.44R..U.....S ...<.u..7..D.(\/.8n.(.g....{n.g.$Ip~.N...F.Z."(+.......3..>?.....:.S..Ge..z...,\|.y...Vv...v..[\|.}.x..+.uh...qo..k..[9...U>>.(..Jm.iY.q..9.!...?...Q.,..$R..$....<.....L....r.W((h`if..$......(..Sm{.......^X.n.........>..S..pl=....V.p..:..I..{7..z........X..X.f.m.Li.6...9...#..f.H.......".........................!Q.q."#........?...P....lu.r}S>.......t@..:...........+..4G.'....t...<z..3K..c.P...VB.@......$....}.....$.........................1...!Qr.......

Chrome Cache Entry: 1806

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 50, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	533
Entropy (8bit):	6.770802771388853
Encrypted:	false
SSDEEP:	12:6v/7EZsT2V4il4R+55mnPE77g0RDkIBONLugU3N:u66/IzOPGgq7QvUd
MD5:	49D4635C86324CC91AE15192648DBDF4
SHA1:	5932C1B8B44AEF75918B3F75BA9AA47EFAD7DF16
SHA-256:	3801EC0C6264B67AB54567C6D347D40D52C45260D54C3FA858ED55BD5C53129D
SHA-512:	9FA2BE2FF3F8FF04A7C8CEE63D46FB29FBD5A72D3EAE64A77007B7968E63A5507E6160C9A0A68FB09E2EB531D7A86CE7127D0F424A14E44C78CEA9B856550498
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images2016/icon_money2.png
Preview:	.PNG........IHDR...2...2.....).x.....PLTE.......xa.u`.u`.v`.vd.u_.t`.t`.t_.{a.t_.t`.t`.v`.xi.t`.u`.t`..`.u`.t_.u_....xc.t_.u`....vb.u`.t`.u`.u`..m.v_.u`.xc.u`.u`.wb.u_..j.ua.t_.u_....t`.u_..f.t`.t`.x`.t_.......5tRNS..B.......u.p...=..1........C.$.x<...........@..S.....orNT..w.....IDATH.....0.E.......b....."...F.X.&..LI.P.#..Y....m\.=Q.7)LW.......d.`.R..R/V2....K.X..2.P......J%......\|S..)...Z....N;..4[.X..:6)....K.X...KK........3b).X....jMT6.R{l.....G......o.D~/..\..%....~.`.$..\|ya.IL...f..r..fU.........IEND.B`.

Chrome Cache Entry: 1807

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4179)
Category:	downloaded
Size (bytes):	226179
Entropy (8bit):	5.546039398975
Encrypted:	false
SSDEEP:	3072:x5Qaf5qZ3fhO+Agcq8rG1LceF2/ea8LR9Wk9As6UOQPGA2STnXDL9btIMP8PL:TQX5NAJYLceF+o9TnXP9RIMkz
MD5:	86783A2325432044253476C54AB024DF
SHA1:	793B9C24833A70E714DB194C306F2F082868CBAF
SHA-256:	69649DF77C6485EFE9E49AC07DF802B52F1DF5336A2782B1568C2CAA839D782F
SHA-512:	9418A0D81FFC0A77AA69345DF0AD3D4D4CE4FD503D6664B1CD8C5D2B54893C3CDAAB7F7F541437BA339E1102AC9F223E9460A4B0DB7FF947E31DBFC69164F11C
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/destination?id=AW-578746000&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_1p_data_v2","priority":3,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_autoEmailEnabled":true,"vtp_autoPhoneEnabled":false,"vtp_autoAddressEnabled":false,"vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":4},{"function":"__ccd_ads_first","priority":2,"vtp_instanceDestinationId":"AW-578746000","tag_id":8},{"function":"__ccd_pre_auto_pii","priority":1,"vtp_instanceDestinationId":"AW-578746000","tag_id":7},{"function":"__rep","vtp_containerId":"AW-578746000","vtp_remoteConfig":["map","enhanced_conversions",["map","ZhW_CMG86OABEJDt-5MC",["map","enhanced_conversions_mode","off","enhanced_conversions_automatic_settings",["map"]],"o7yhCKbPguEBEJDt-5MC",["map","enhanced_conversions_mode","off","enhanced_conversions_automatic_settings",["map"]

Chrome Cache Entry: 1808

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (41842), with no line terminators
Category:	downloaded
Size (bytes):	41842
Entropy (8bit):	5.498571517483536
Encrypted:	false
SSDEEP:	768:Epp9UNT2LFQg5Nna0a3akaFa3a8abeo08fh03O+EnrxawgSeoBg1PL4sHYf9ikjA:Wp9UF2LFQg1ekf6TEnrxawReAg1Pz4hA
MD5:	9575E6EEEF2B4A42E72A0401CBC03C24
SHA1:	EB05BDE95880F9C9448316CBDDFF59014A04ABAB
SHA-256:	B04D72546F3D807901AC18982112FCF6C50C115095F76755040CD6BE758599A7
SHA-512:	CC0AE33BC2E83334E58B0B4511F21BBCE442727C976867A4C2241424E05449953585456659C1F529597E3C28C7B2D48F10F9E0653CB9DC0863F0490FCF46FA50
Malicious:	false
Reputation:	unknown
URL:	https://www.dwin1.com/19038.js
Preview:	var AWIN=AWIN\|\|{};AWIN.Tracking=AWIN.Tracking\|\|{},AWIN.sProtocol="https:"==location.protocol?"https://":"http://",AWIN.iScriptCount=0,AWIN.Tracking.device9Url="https://the.sciencebehindecommerce.com/d9core",AWIN.Tracking.flags={allowNewAWCCookie:!0,allowNewGCLIDCookie:!0},AWIN.Tracking.setFlag=function(e,n){AWIN.Tracking.flags[e]=n},AWIN.Tracking.getFlag=function(e){return AWIN.Tracking.flags[e]},AWIN.tldDomains=["com","org","edu","gov","uk","net","ca","de","jp","fr","au","us","ru","ch","it","nl","se","no","es","mil","gw","ax","wf","yt","sj","mobi","eh","mh","bv","ap","cat","kp","iq","um","arpa","pm","gb","cs","td","so","aero","biz","coop","info","jobs","museum","name","pro","travel","ac","ad","ae","af","ag","ai","al","am","an","ao","aq","ar","as","at","aw","az","ba","bb","bd","be","bf","bg","bh","bi","bj","bm","bn","bo","br","bs","bt","bw","by","bz","cc","cd","cf","cg","ci","ck","cl","cm","cn","co","cr","cu","cv","cx","cy","cz","dj","dk","dm","do","dz","ec","ee","eg","er","et","eu","f

Chrome Cache Entry: 1809

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2652), with no line terminators
Category:	downloaded
Size (bytes):	2652
Entropy (8bit):	5.8561829047716465
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08fNLSw/R0lwuGG9QKk6:wsbSUtJfxrqLWWWdV6j1xLSw50/
MD5:	D83AFF99B6D9C92048473A57EC114BDE
SHA1:	8C40348B6FD73EDFF7CE68072A039632107CCC8E
SHA-256:	E22BD7045FAEEF81CE6C6C1E6E091D8EBEA632F70F54227171E92CE381C57A95
SHA-512:	C7A8868D3201C8BDD7292F578E6E0D5A7246BDE3A8B669B3EFC3E524ABE10DC5DA6ED9CB9DA4A98F86315C2541AA5F4598FFBA559C21870BC02EF1A8AF2A12E9
Malicious:	false
Reputation:	unknown
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/578746000/?random=1714076772866&cv=11&fst=1714076772866&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 1810

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], baseline, precision 8, 600x376, components 3
Category:	dropped
Size (bytes):	24847
Entropy (8bit):	7.772458666296573
Encrypted:	false
SSDEEP:	384:CXjp94rVVHe/CQQ7Qp9dfmS3+6AkTa58iSadnwrCrBqMeuUw4YwxNLN7gUs:KjH4rCqQQa9d+SAkTa5Z/ruVwwxNLN4
MD5:	A751A4259B70E27CAC58F26FA21A9DF1
SHA1:	5506FEBA6AE9CA100C3CE05C343AFD820FB2A03F
SHA-256:	1CC49136E7390C7BF9E49890BB4C080262698003F40A8103090B3EEE76E492D9
SHA-512:	9ED82A05914925AE97486DC5608DFAB3087769D1117AE4444FEAB5AE34F71576F248AE6FFCFF1982F98D510EDBCC99601FE76271C620AC0B17DD71B657BC1EC5
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....,.,......Exif..MM....................i.........&.............@...8....UNICODE..L.E.A.D. .T.e.c.h.n.o.l.o.g.i.e.s. .I.n.c... .V.1...0.1...C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......x.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.o......0.....,JY.h.G..t.S......._...Pi.^..T..4....(..l&..5:}..)...v!~b9...F....t.b8.._c....._...M6.c.\m?....mjV.v..J...[...Z..xDr...H......@H>...SK.J..Qx.&#..y..f....i..~..(.=.........\..wL.[......eVe.q......y.V.p..,=......_..k..~..)~.g

Chrome Cache Entry: 1811

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	49
Entropy (8bit):	3.2001615812851174
Encrypted:	false
SSDEEP:	3:CUO/RD/0xlpfx/n:oDAn/n
MD5:	41C9BC7F3F78ED71115CC062C1C67B09
SHA1:	FF200D7EA28780D12BD6D9334178B930DBD5884B
SHA-256:	1CD58A827318C4A29B32A0DB15C8C39D5651B42D8CAD227519AD81BCE4ADB944
SHA-512:	280EA4383EE6B37051D91C5AF30A5CE72AA4439340FC6D31A4FBE7BA8A8156EB7893891D5B2371B9FC4934A78F08DE3D57E5B63FA9D279A317DCBEFB8A07A6B0
Malicious:	false
Reputation:	unknown
Preview:	GIF89a...................!.......,...........T..;

Chrome Cache Entry: 1812

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	33
Entropy (8bit):	4.066677073707229
Encrypted:	false
SSDEEP:	3:YG6dd6aji:YG6dEaji
MD5:	AB029DA7039880B6ED50A5339B09CDBA
SHA1:	E80EDD378E63EE4ECC3774C9655311E3D1CCBAA1
SHA-256:	029F04C9B43406573342370C74F28FAC0F8F40FA457960AF3F09E52BAF3C30ED
SHA-512:	0D44C16BA6E01223FDB70406D8F8D1C8FBAA931E4430D360DEFF1C7C200B5B87C39722447A8EE4CF3241A204D9D7BD55BC0B381CB14C3A64B122E651523A2E8C
Malicious:	false
Reputation:	unknown
URL:	https://common-info.wondershare.com/api/v1/checkeu
Preview:	{"c_type":0,"country_code":"US"}.

Chrome Cache Entry: 1813

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1413
Entropy (8bit):	7.511798966097426
Encrypted:	false
SSDEEP:	24:rGA0X/jcWJX664q1Ya3DXsJ/EdJQKyiVX/qug1zWUf1LIDVhnobJRHX3T:rGAc/jt6tq1Ya30/2OKy2lglWUNLILCH
MD5:	A89A95567AF18C598E93456C5BC534E0
SHA1:	A83A5F482F40F65E040798331B381F00012EE54B
SHA-256:	25B85610254D669B58E181E3CA9AB0C31EB980554A8AEA56B4667EA241F397B1
SHA-512:	6A7AFD9DCA7E905563428542E61A9755412DD56275870339A548F0906F6610A8FAE0E622CE25556D435BC9A2345E89F6AD83287BE95D4298B8692626590A163E
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images2016/drfone_logoImg.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@...................w...#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma...................mdat.....!..l...h@2..D....,P...>I.8..U..V..m.}e....9.57.z...D.s[w.:...uNZ....8..x..I.7..YB.SQ_k../......zu...\.2.Oo.....kJ...e...........ym.D.C....\..r.......f..&...~.)....<....B..+..{FB..n..O....8%r.G>g..p..x..:Og}%W.....r#.N.}.]...]....Xj-.~...MP..3.ia.Kw.>.x}.AG.'......>).}....'.......<R?.!.8.<....g.ss...3.......?I.$h...5.pl..W..o.a.F......r.{..bj.5..T.4k..r.._.kDc.zL.R.L....)<\/(....vm.C1.uC~...C..N...`K.>..\|.2].W.@}..Z.n?H..8...M.J-..R.......l..@.1=...X.D.u>.y.]...z,C..+.!.&W.......m.v.kP.FKHc.2Do2...p._..;.......PY`x~....,..=........06.7saK.H.;..x.Hp.Ut.....X.;.Q2...`..:...p......4-.y...[..j.Y6e.$.....l.]..%.....t........3z.V..Td../..U..R.YH.7..$.H#...+b.3.r......0c_...bk...."N./.phHK.h

Chrome Cache Entry: 1814

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
URL:	https://lenkmio.com/tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=lenkmio.com
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1815

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	11495
Entropy (8bit):	7.966811491703495
Encrypted:	false
SSDEEP:	192:rGAAo2KmoVzpVkLCd4UjGcvslIWEertGnoHP1Gu4JwEVfxNlVFRtoWn238WGmuWu:rQRjoVzpmmd4UjGcvslIWEyGnZ5wEVfl
MD5:	E197A1313983B305ACC68C4CCC51A8AD
SHA1:	77A9A8F9792CE3E096F4A2024B2E68B672D87EF7
SHA-256:	7AF705E78B9515B3D9BB683CDCDD9295576CFF7D80BD934983EC5D65B2FA14ED
SHA-512:	BCBFF242DE55FE90EE5575EE833ED5562EBAFFAD2057260161335E80E3A1EF6DF08072D32FE60232C636DCDB4E86ACED640EE85161582588D8754F7FF5CD1469
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/guide/images/free-youtube-downloader/main-interface.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................+....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......X...x....pixi............ipma.................+.mdat.....f%{......2.W.....q@.,.S.R.XG.;.=8..9...&a..B&....E.&g?Be.,v....q.... V.....^./..F..+c.z....S..^.yvsK..0..R..z....G.zr.q.nw-...M.....].8y~.....".....b......#S.v.......Z....._..t...b..6^..9..\|..(.hP.^....Q....r1.}....t....R.O.P..<...~$)....&n....\|..!z....-.(L.(gM.h.,..../......t...-...B.(..............j..@..!........k8...W..d..x..'.u./{D.%.\|.....wI./..H0..K....}c..'.\|..GG1..X.....iX.S...S...Yk..F.\|... :.\"..i.......Z........>y!wQ..^,.W..D'Y.8....%.\c...n...&p....V[..!...g..ar........;..7H.zR^.Kw..t...#l/5..Z......\|.....L....zs.....[...x..Zy5Y.0.........~?.E.....~...3..O;.wOe..".:".t..}[..x.^=,.Ml........40.."....D....w.X._.^:.R.l(T.-:z..F...{gj....n.$a...........?....'..B).^.A

Chrome Cache Entry: 1816

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64347)
Category:	downloaded
Size (bytes):	223683
Entropy (8bit):	5.454805360153245
Encrypted:	false
SSDEEP:	3072:tt8WClBZIncVuP0bteuvQ+AMPpgArl0xYu5GKnPt:ttlWBZ7O0bvQQGArHu5GKn1
MD5:	85F41014BE15CC3E54A4123C00C5021E
SHA1:	1E5468F507A8B0216114A8D8F63309BE8CBCAB9F
SHA-256:	01E9582655224C83E6C075F44B7EECB135E108B6AD2150BF6F78A0A77C4AD5E0
SHA-512:	78F6D6CD922AA42FD340CF215D7D91DDFABEF5EC393DFA5EB578436B9B668F839747218A4DE980AEC2395194667B1E0215623EC902EAAF8CE592536172414FCD
Malicious:	false
Reputation:	unknown
URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 1817

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	2347
Entropy (8bit):	7.591688611538053
Encrypted:	false
SSDEEP:	48:rGo/jKI9VMnHCt1y1mPjG3vAZOcFYd0kyfv2PAHtr6vFy/VejMvhfeUCLQHuk:rGgKMqHadPjG3jcFYykyfv5Kw8Qv95Ci
MD5:	5CDD0152DDCA224B4E8273E9B7A00EE5
SHA1:	FF9EEAD0D5B5C19AA0926FDBCC721ECAC3AABB6B
SHA-256:	BDE241B21452AB1F6A74052B7254312472A7B1DC9194AEE2123CB0E514D3513D
SHA-512:	106A995E969B451AD22B20679DEBEAAF048F4BD0A68B61AD7599849E24A7065A054B8F95A15CBD3C6C939873B820B45824EA16817906EB57B9D8F4EAD6E93EC4
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style/images/iconImg2.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@...................C.................,...8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe....... ...X....pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe....... ...X....pixi............ipma..........................iref........auxl.........wmdat.......+..2.....x.....n......h.3.VaQa....[......h...".r8....R!.w..>..p..qJ..z.Q......?.[...].u...)-....2...W8....Z.YHE..N.E...b...sWm..#....PR.TT.0.v.N:.m....N..!.......x....1.5..,..".N....L....ys.........H.k...M...33.B.S.."6.ap......x.3...$.v...: nF..9...+\|.\.?ZXV..yX..'Z.....s.........[...}KG...;..id.o.4uT...0....pX...`...b.a...$P....5}......vzr....`~V..S;.....,...c..S.h....l]!:).z.._.^qR}.H....b.@.z-Eev..._..{.#.M....-4l..T<.h..3.x..`.'.r..#.o..!...R...@...&.?j....II..c...#....q.4...L...;=f...w..@.Z....M.....<*c,!q.

Chrome Cache Entry: 1818

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
URL:	https://tjzuh.com/tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=tjzuh.com
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1819

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	10702
Entropy (8bit):	7.966193317201297
Encrypted:	false
SSDEEP:	192:rGQJ3tNlg9+gVRBNEg6y5tePFIpa+JKuz2NYmlT63440:rV3+IgVN4oePMx+lT9
MD5:	CE91EC2426DF5EA4A308A0940A2DCA13
SHA1:	52AECEC2B0B9B67733F69A652AB9951646283F12
SHA-256:	0187F29D713F96CF72497C8FBB8049F66E03740432B9D9EB78D350ECFF434B64
SHA-512:	0B4A6BA1EA8543EA7B8026F8BC993900133CA21F5034094983EF3EC63EE733F369EBC5BA0BB41576B738D884AE1398D3D1093984DEB22F11819483BA8E951743
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/multimedia/free-youtube-downloader/main-interface-1.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................(....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......X...x....pixi............ipma.................(.mdat.....f%{......2.Q.....a@.,...]......(.&..2K2W...).";.@...c....I.4.w.b.........4=u6..g?+.I...z.s..K.V2F.......H.....=.db.s9.>.Y..}.m\|....\|...5.....gtDo;.5..... .....RK....j.....H=.Ju.h^g...Y....&....f.JU..6?Wc....?..@..W./E .Pd..lG...O..\.y.Xa0U.X..0..3..W.o1.,.'....W/.{..2G.m..g............l..~2P...3!.^..;.'.@d.H.Cx.l..Y. .....~.d.s.v.v..d+.sqx....M.?.....^El..)K..h..D#...cl[.ur......F.@..s..[...).z.....h...03......0S(-.]6.YM.{.......+;....R...q...W.7.>...omxp.v........F....R..~..z...rU.[.t+..&...V..HB....1nq.1"...../.L+0.m.`R".?Au.?`..1&..W.'.BYL<..R....!?....D.j)>..k...,.mj..x..8....}...TF$17..+.tv...'.]..A.X......5...#.. ........u.V..N....+.....$..........O.?_..t.b"E

Chrome Cache Entry: 1820

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2107
Entropy (8bit):	4.760123773997779
Encrypted:	false
SSDEEP:	48:tAlbOn6eJs8T/EJOQva/EJOUI1ChO8fUSpiQxC/:fHJnTzHz1j
MD5:	EEE14557500A05B37B8D7DB8CD45D918
SHA1:	1F04D2F32E153A8A3E18713155D55DB8BAFF06B7
SHA-256:	2B15114ADB679270E25E0D47CA2D8EE278701C0A23D815EBCBBD0A4630211873
SHA-512:	49BA6DFB6D71F7A2394C212591343BFBE11C43E97190825FEB108DA9D4DDBC8ACA70C99C012A486E4AAB7356836A02A9B0EB762921CE9979810ADB4985EA4BBD
Malicious:	false
Reputation:	unknown
URL:	https://cdn.consentmanager.net/delivery/crossdomain.html
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <title></title>.. <script>.. .. function handleMessage (event).. {.. try.. {.. if (localStorage).. {.. var msg = typeof event.data === 'string' ? event.data : '';.. if (msg.substring(0, 10) == 'cmpcd:req:').. {.. var key = msg.substring(10, 9999);.. var itm = localStorage.getItem(key);.. if (itm !== null && typeof (itm) === 'string').. {.. event.source.postMessage('cmpcd:resp:' + key + '=' + itm, '');.. }.. }.. else if (msg.substring(0, 10) == 'cmpcd:set:').. {.. var key = msg.substring(10, 9999);.. var p = key.indexOf('=');.. if (p > 0).. {.. var val = key.substring(p + 1, 99999);.. key = key.substring(0, p);.. localStorage.setItem(key, val);.. event.source.postMessage('cmpcd:resp:' + key + '=' + val, '');.. }.. else.. {.. event.source.postMessage('cmpcd:setno:' + key, '*');..

Chrome Cache Entry: 1821

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1905
Entropy (8bit):	7.656290772850683
Encrypted:	false
SSDEEP:	48:rGAc/jf6kFM3P0a3ovf7Rf57K/jcAf+J1FCG:rGPf62EoLBVeenFCG
MD5:	D80EE07F4B7EE4E2C276218AD58B67D9
SHA1:	C9F1D910CCDFACBED407C29844AA36F0FC63EF0F
SHA-256:	34EA5DD9D8A352F805827790D12F21CC4E3F1C6C9CA83DAE4E8F25BA83F713D2
SHA-512:	98EB113E2046C85E064FC17FFAB1408CBA53134A1C13005B6686776D5395AEF5C16BF91197FDD9E6FCADE193F2A191807D2EC30FA3CBCF269E97517B873DC8B2
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/pe_logoImg.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@...................c...#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma..................kmdat.....!..l...h@2.......a@.+sr.A....j.u.J~...>?....4#..Q..:M..9:m.%aYg...I#'I.....o.....)..4....t......t..=lF...?0.%...W........ .6?..SE....p@. K.>.../&w..K";.`Y.L..=.FhM../......j.."...g..h.....!.=~NQ...1'......d...v..R..M........]....(vI5{...9....f2.bE.D..z..K..u<.."....q.R...x1...T2E.MD..U;....1SF-q.r..l....Ne;......\.O<y..#Z..vMd..c.[.N2.~._.u.lS+..o.p..."#Zo!'9\.1..c.t.H...;.X.\|..g.....8. .Y.GT..CnU.p/dU.b{....L.t....L=Y.{...(i..........gp..f....Q.....{...&sV.@..l.&......Y.%.n........iX._.g.._.AN.4.e.....].[.......$$.k.;i.(.. ...g..Cz \..........1.EO_.d.RGf..l.#...\|..d.G9..X...o(.%..G+.......{.D/...,..WB..._....+...'+....7...!.".C.W..kK.IH.........f..'F.7..k.{d.7$./..^.T.Y.w5..

Chrome Cache Entry: 1822

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:a2yb1tMn:aN1tM
MD5:	D06F04FCCF68D0B228A5923187CE1AFD
SHA1:	5DE9DF9FDD66A91EED06E31981553D4AB9CCF490
SHA-256:	830E67BDA2532CD5880EE86E3B33E69721082F8458BB0DF0CD4EDBB1577FD375
SHA-512:	9888104E0C9311D58B52A9B7030725C8BDFBE54F581246E4DDE0366F046671B3CE6838D09DDB4A384C6145248D4AB46D16BAE8E92F943488E2888982D6DB0D3A
Malicious:	false
Reputation:	unknown
Preview:	{ "status": "ok" }.

Chrome Cache Entry: 1823

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4020
Entropy (8bit):	7.834787721847828
Encrypted:	false
SSDEEP:	48:W6whPdrWnG3OKAR82UgE8NxVvO4/22QqnBVAaUt3KPM5c8L/MeLXU6RU9rfBRBcQ:HqWnODAR8T3udQmVcxi4RUFBcUkK
MD5:	59971FD40F75795CB9EF9678D0C5DD98
SHA1:	1A9C8F41A0EA71FD9B13E703C33B325F342E0E4D
SHA-256:	AFD931A4397B8629A6396E2924935B9116BB3CE30784CAFEC90E266B78ECBDE1
SHA-512:	2B88033FCAEF4D1CCC5EAE37AF430576D0AFAABFFC9DC743CFDC85CD8830710CFDCD9AC3E4389C2BE9BD3685E8DC0FC9B65BD01A4D1E0B4CD650A90FC1E350AD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ...X........q....orNT..w....nIDATx..{.%U}.?gvv....u.eY...1..S>..5..Q.dS..c"...+..j.f..)p..X......f@I$.......(.7A.,..y...........9w.o......C.....v..O.>..{..\'...o.....Q.r.T.H`C<p..........?.^.2....V.0Q{).V.../.V........f)..8.x{N..E.....X.r..@...J.%..K.\|j...~.....,...r..^..B... .....'.O.X...j\|.....c.v.........+.,./l...?.\|...ND$_:...K....%,di%p..g..p..3..q....x.p...\.l\..B.%....M9IJ.>.l;F..s..ZS^i.p7..q\|=.j/.......E.BM....i..9.v.2....x.h.Y.........A.0...1..p........Wb..m...G..P..?....W..G..TG.I.y......O...?#.~.{..(d}.'a..`..`..`..`..Y.c.....$.T.r..-&T..0..J.*.W..%d..-...D..{...B...[......3.........`B...&T..<..-jQ.r..O.....+....>.....\| ...P.d&T.............@.`.....=.c.%.O.e.{...9.clZ....H...[ ......`.^.....@..7.8.\J.....]..s...xq......y+.m...}.._..};.+Yxq...'...K.Jl. p&.U.Xy4V.ksV.....gQ.d..dYv=~...m./\|..v+.N3..`.....hW....\|..[....^z.J`3^p.#.l........~..iW.....\6..........=..=.l........I.H.........\|.......v..x......a.....}\|S{?^#z....z.0

Chrome Cache Entry: 1824

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15219), with no line terminators
Category:	downloaded
Size (bytes):	15219
Entropy (8bit):	5.3750521418829
Encrypted:	false
SSDEEP:	384:njZvCfCUCAth1fYyV+Q0EwiKEElTCiCEsqfqrLa:nt2kujKEEJCssqfqXa
MD5:	7FD76C38EA2FF2B597A04569F2D3465B
SHA1:	616D6F4657787D813F490C84F8C37E366A029460
SHA-256:	3FC798C1D150E142A61E4E4CB9C5D31DB53C095E21F130662367207DD3F2AAFA
SHA-512:	F5F12770B58444A3A2F28F987FFBD6A79B3A03351A8F943243D2425B33F726CD479EE0A019AF318D81090E23811896B874053A8E7571F60C846BF75E214AABD4
Malicious:	false
Reputation:	unknown
URL:	https://cdn.consentmanager.net/delivery/customcmp/86321.js
Preview:	window.cmp_id = 86321;window.cmp_readParam=function(g,f){var b="data-cmp-"+g.split("_").join("-");var c=document.querySelector("[data-cmp-id]");if(c&&c.hasAttribute(b)){return c.getAttribute(b)}else{c=document.querySelector("[data-cmp-cdid]");if(c&&c.hasAttribute(b)){return c.getAttribute(b)}else{c=document.querySelector("[data-cmp-host]");if(c&&c.hasAttribute(b)){return c.getAttribute(b)}else{c=document.querySelector("[data-cmp-cdn]");if(c&&c.hasAttribute(b)){return c.getAttribute(b)}}}return f}};window.cmp_setParam=function(d){var b="cmp_"+d;if(!(b in window)){var c=window.cmp_readParam(d,false);if(c!==false){window[b]=c}}};if(!("gdprAppliesGlobally" in window)){window.gdprAppliesGlobally=true}window.cmp_setParam("proto");window.cmp_setParam("host");window.cmp_setParam("cdn");window.cmp_setParam("id");window.cmp_setParam("cdid");window.cmp_setParam("params");window.cmp_setParam("setlang");window.cmp_setParam("regulation");window.cmp_setParam("block_inline");window.cmp_setParam("block

Chrome Cache Entry: 1825

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46429), with no line terminators
Category:	downloaded
Size (bytes):	46430
Entropy (8bit):	5.303853365298302
Encrypted:	false
SSDEEP:	768:OaOFhhR5OIahpjfRys3LzQR04TYYyDMOWPKQ:OaOFnRqDRtzQ64IfWiQ
MD5:	72BCA04FD669EB89FC65D59052D0FC00
SHA1:	27E60AEF86F0CB1B2F6B6ED9DF9A4E3BA88EFD21
SHA-256:	823804A7807864B44093A3843788F4CD076E89CF4A6FDEB8D153AE5C2C2DF721
SHA-512:	56058E4C927563CA37DEC4979AF28A415EA3042A389C0BA22738C76D39131317A703A38A95EAB9D913F116F7C2D1DA62A0A87750F47DECA2DDB3447D64303B12
Malicious:	false
Reputation:	unknown
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

Chrome Cache Entry: 1826

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5337), with CRLF line terminators
Category:	downloaded
Size (bytes):	141242
Entropy (8bit):	5.249859320017703
Encrypted:	false
SSDEEP:	1536:77kuGwoyhMQxH0sfpk2+xJ1ZWrvLkV2TJF+AhxWxO6X1u8y/M7xyeeN911vsgFiu:nk0oy+E+xJ79MDEhx5NTbkfRpChYeo
MD5:	90B8183654778202C049A5DF42C54CED
SHA1:	0952E91EC46889532C211DA930D585E0CBFCB174
SHA-256:	99C0988445FDFA65AABEE5FE9E7D08E302E8F054DBAC3A7D0A4EB03B5317FE59
SHA-512:	529F9043FBE78441148D68564D0EDD93C77993BF46829C4BDFB05964D3EAED3A1C2B7B678FBE70C6A968A5A477E205266725E11B7F59DD18D6ADB0438B3E528E
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/script/jquery-1.7.2.js
Preview:	/!.. jQuery JavaScript Library v1.7.2.. * http://jquery.com/.. .. Copyright 2011, John Resig.. * Dual licensed under the MIT or GPL Version 2 licenses... * http://jquery.org/license.. .. Includes Sizzle.js.. * http://sizzlejs.com/.. * Copyright 2011, The Dojo Foundation.. * Released under the MIT, BSD, and GPL Licenses... .. Date: Wed Mar 21 12:46:34 2012 -0700.. /..(function(window,undefined){var document=window.document,navigator=window.navigator,location=window.location;var jQuery=(function(){var jQuery=function(selector,context){return new jQuery.fn.init(selector,context,rootjQuery)},_jQuery=window.jQuery,_$=window.$,rootjQuery,quickExpr=/^(?:[^#<](<[\w\W]+>)[^>]$\|#([\w\-])$)/,rnotwhite=/\S/,trimLeft=/^\s+/,trimRight=/\s+$/,rsingleTag=/^<(\w+)\s\/?>(?:<\/\1>)?$/,rvalidchars=/^[\],:{}\s]$/,rvalidescape=/\\(?:["\\\/bfnrt]\|u[0-9a-fA-F]{4})/g,rvalidtokens=/"[^"\\\n\r]"\|true\|false\|null\|-?\d+(?:\.\d)?(?:[eE][+\-]?\d+)?/g,rvalidbraces=/(?:^\|:\|,)(?:\s*\[)+/g,rwebkit=/(w

Chrome Cache Entry: 1827

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1828

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1829

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Category:	dropped
Size (bytes):	9662
Entropy (8bit):	1.976735566032478
Encrypted:	false
SSDEEP:	48:9wcjcDcTclc6p+cRchccodcIcMcwcStcOtcLsAE4whFvMndDIAs+Sm:9PgAQy6pNGhDNXzPZNg+Sm
MD5:	60206C00FDD79FFBE94CA2C8022912C5
SHA1:	D67E3F2CED6F4C2A798DBAE4429881A23719B5F9
SHA-256:	FFFB04270461D651B1C6C1C96EC81E6846B2516CA7BF7DA34D33825F107A734D
SHA-512:	C6C4956A898692F459A8DC8B3EF9F8CA249DA88DDBE737732B649F1AE26861CD06446A90841F068FC712CF36E7FB9A5B29E5A09FB802B68649CEB915EC935B95
Malicious:	false
Reputation:	unknown
Preview:	......00.... ..%......(...0...`..... ......$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 1830

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45202)
Category:	downloaded
Size (bytes):	363282
Entropy (8bit):	5.567411143950243
Encrypted:	false
SSDEEP:	3072:qILfYgQaf5qZ3fTO+cccl8xG1LceF2/ea8LR9Wk9As6nOQPGA2hTnXDL9btIMFVp:ZQX7Nc0YLceF+jqTnXP9RIMe9c
MD5:	81DB1C1CF8F222BB6BA5AE463837A972
SHA1:	A521A60B1C5DDF9E9781711AE585700C2854B06C
SHA-256:	AF426B2C2A9FF555DB6753C75A31763D4ECB6FF584366CA40FA26D02E9F20306
SHA-512:	374954046FC2F420E6262E0FA4BB29B90FCF14D8EA01F4E5C46B0CF740406570B2DCFC1A2B451F0FCBFAF1EFFC0DBA0B5C4BD2C5268EEDD90F9BCB386E2305C5
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-WRMX62N&l=dataLayer
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"605",. . "macros":[{"function":"__v","vtp_name":"gtm.elementUrl","vtp_dataLayerVersion":1},{"function":"__e"},{"function":"__v","vtp_name":"gtm.triggers","vtp_dataLayerVersion":2,"vtp_setDefaultValue":true,"vtp_defaultValue":""},{"function":"__u","vtp_stripWww":false,"vtp_component":"HOST","vtp_customUrlSource":["macro",0],"vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_defaultPages":["list"],"vtp_customUrlSource":["macro",0],"vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__c","vtp_value":"avangate.com,paypal.com,payproglobal.com,filmora.net,wondershare.net,wondershare.jp,wondershare.com,filmstocks.com,famisafe.com,wistia.com,wondershare.it,wondershare.br,wondershare

Chrome Cache Entry: 1831

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, progressive, precision 8, 750x80, components 3
Category:	dropped
Size (bytes):	12863
Entropy (8bit):	7.963634553563885
Encrypted:	false
SSDEEP:	384:fvkrZG9i/zKfez2Fr1g57v0seapN0RL3u:fv8c9i/2feGr1g5D05nu
MD5:	A8F65137093D3786113EB658D2958853
SHA1:	AC78EA9ED57057D0A1D5F4AA8BEB9BC595DE9092
SHA-256:	1EDCD3A35566BFB5E8A75375F19340973B2E7260DB27772558F521664A52DE26
SHA-512:	2D934F61F12E8EB055646359C037C8CBFCF9CB9C98E346EC9BA96D8889B08B45BCAE2D0638C2CB44978BAD376D8B6D1CFA4D1B960127B3273145C0BCB9C6BF95
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....%.%..................................................+".."+2(2<66<LHLdd.............................................+".."+2(2<66<LHLdd.......P...."..........6.......................................................................,....HY,w..;....TS3..9.$L{Xc..)..?..i\|S./z.M.#Q..77.y..Z'.;w.&9.6.o..@......p.-y...M........:.}..7..'...Nz...r.L.X.R.../..s.'.\.R{D.z...W...J.4o..O.k.w.z,.G ./\|..D.....X.S.E...=.e....>V...1.".M........5....hK0F.G......>T....l;.~^.../..5..5dH...1...#.R.M..u.....-....C%co.0.....m.7..a.uD......%.Qz.L.Nln.....=\.;....z5wX.!u....J.Q..b..=j.............W\|....;u...KN.n.c.....n.....X..+Q.s..^K.y.........k.Y..K..,.x...o....>....Q.......>.r_.i.z.......k.n-..=.7/............-.r....b.../)..<.T..e.XXZ.!...L^...<.V>...6.....W%.+.U.1%...v..`t+{..q.......L._.[.Y9.c..,\|D..p....<.lZ.c.+...y.'...y(k..Q.F.v......Y5hl...U..&uX..-J?5V............*.._].B.,.'6v;.mX/..bY.#..Y.PZ..h.....k.y'.........m.e...#...`.....s...tx....e..

Chrome Cache Entry: 1832

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:a2yb1tMn:aN1tM
MD5:	D06F04FCCF68D0B228A5923187CE1AFD
SHA1:	5DE9DF9FDD66A91EED06E31981553D4AB9CCF490
SHA-256:	830E67BDA2532CD5880EE86E3B33E69721082F8458BB0DF0CD4EDBB1577FD375
SHA-512:	9888104E0C9311D58B52A9B7030725C8BDFBE54F581246E4DDE0366F046671B3CE6838D09DDB4A384C6145248D4AB46D16BAE8E92F943488E2888982D6DB0D3A
Malicious:	false
Reputation:	unknown
Preview:	{ "status": "ok" }.

Chrome Cache Entry: 1833

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 50, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	947
Entropy (8bit):	7.297837621784841
Encrypted:	false
SSDEEP:	24:JL4b4ZieukCBsSsoX1DvprwWj0vHvLljavklY+86a/6OPTJ7d:ib4kDpvsoX1rpX0vHTBlY5xSMX
MD5:	E761E5BEB054A084D08CA4622B59873A
SHA1:	121A54DA8E6617FF3B4C051F96CC651EED3F45AE
SHA-256:	AC076D51EB2A2DE0A2C21B47DC456193CB0FDDCF30EE422667DDDC9A44D288BE
SHA-512:	91402B7AF42518AC755CA804D5B5A17F92BF6722126A9D3806FB4F5C47CADD2F121ED1E643D3CECBEB1BEF39A0DA239B049E8A03AF74C4A3C4048133863CC9ED
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2.....).x.....PLTE.......w`.t_.u`.t`.t_.t_.v`.t_.wf.u_.u`.t_.u`.v_.x`.ye..j.vb....ua.u`.t`.ta.ya....t`.ya.t_.t`.{c.td.t`.u_.vb.vc.td.t_.u`..h.v`.t^.t_.t_.vc.t_.u`.u`.ua.u_.u`.v_.v`.u`.u`.u`.v^.vc.u_.u`.u_.u`.u_.t_.t`.ua.t_.t`.t`.t_.t`.u`.vb.t_......JtRNS..-{.........[@&.......7........46O.......C...?.C..%.66..~0...\|.Z....NKb......orNT..w....IDATH...[.@...D....D......v[55...=......\ph.g?u?.........+.-%..3..I.)%vK.(..H..?.\|A...r.j..r....;H.....j.G....I=..:.v.......C..$5.wC..q.2i...v..XW..a....Yq...-....w.^.S.!..?.O.n.'Q$o...2V@.g.7....n....#..@.E77....x.i..hKl.b..B.,..n...4T.t.....$.9...o.4.... X.9.8(r].....j...gBoE8.Y.$.w.'..0.wJXsD.o.?.G.i{..2T..Q..c,../0........'XRd.._W......_.4.&H.#H. .........C...9..).(D0l...P0O..`......%...".....c&...x...b....Oc....x.1.9&1.6.$.`..b.J2"d.C).....27.....0..i.3............aq.....`......7...E...z....:.UX;I.._...;.tUr.wF....IEND.B`.

Chrome Cache Entry: 1834

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4179)
Category:	downloaded
Size (bytes):	226358
Entropy (8bit):	5.547283241503972
Encrypted:	false
SSDEEP:	3072:NLQaf5qZ3fhO+Accb8HG1LceF2/ea8LR9Wk9As6UOQPGA2STnXDL9btIMP8PL:FQX5NAAYLceF+o9TnXP9RIMkz
MD5:	36F6EAF236F260A00658F8F093847AB0
SHA1:	5B789ED3698047A0B3A721C4217BDB41E7E5393A
SHA-256:	7E0331A1E0E9447CE7C45B0A0690E827E022C560815FC9B30045DC3A6F242FAE
SHA-512:	4383CB8D9D362BF2281A16E35DA09AD84EAE430B81A5CB58879D91AAE74DAC9136A7CF94DD9AB93898E1A75880C92AEC6E76F2CEFD85D6B1E88271FF65DECD70
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/destination?id=AW-1004581587&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_1p_data_v2","priority":3,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"","vtp_isAutoCollectPiiEnabledFlag":false,"tag_id":4},{"function":"__c

Chrome Cache Entry: 1835

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	168
Entropy (8bit):	4.653178622293149
Encrypted:	false
SSDEEP:	3:YTyLSM9HJHWMRAMf88hjNJFA/dA7EEVrACq7A3BxKYM2ZD9DXgcVYY:YWLS+YQa4ZfAdAprACLxxDdbgc+Y
MD5:	015BF681509A6A2207672504CA4453FE
SHA1:	113E3DAF67580A7BEB950CF8D51DA1E6FB4EECC7
SHA-256:	DD21BFAAA3B2CF85FF85AF9F2580D329ECF4D98D05FA521359EAAD83AFB3E148
SHA-512:	9CD13B74A0DF56856884BABB30B541919966995E1B3700872225035D055DA9D38C682EF8E226612B4B91B4C0688BF1FF1991C59E851A879B66B70B59187E1AFD
Malicious:	false
Reputation:	unknown
URL:	https://script.crazyegg.com/pages/data-scripts/0104/8432/sampling/www.wondershare.com.json?t=476132
Preview:	{"version":"11.5.202","sites_sampling":"%8&4!}%\|%]!}$<$4$8$;$9$6$6$,!}&%%?&$%^!}$<!}&0&&&%%]%^&&+%{%?&%^$.%[&&&$!}$,!}&%^%[&&&%]%\|&%%`%=&*%?&,%\|&&!}$<$3$6$;$6&6%;"}

Chrome Cache Entry: 1836

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48316, version 3.0
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	7.9944129416390295
Encrypted:	true
SSDEEP:	768:Lp8jSyYzN5Be0yyiSU2/zh7VF0e14F9rqBoihRmas5kRirNO3nha1ypmWG1+aFOC:L2jR+My1UAhfy9rUj7mackRirNO3nhoJ
MD5:	2BBBA9FD8CA5E556987208A690C46002
SHA1:	B398A299AAB266EF15A8427945A20ADF1800BEAD
SHA-256:	527B43D01C82EC930C7EA58214BE131DA9464F687D113460D3E5B4DC181F9B36
SHA-512:	362A4A24DFAB9127E75C3EBEEC6251A9F554116146126762690F304C71E820E5F638285EF5C71781C5495DCC23C45E05FEAD23B36670965640539F3401E1A497
Malicious:	false
Reputation:	unknown
URL:	https://www.wondershare.com/style-fonts/fonts/freigsanproLIG/207add5d-09f8-4df9-a0aa-e5f02f8bcb52.woff2
Preview:	wOF2..............y....U..........................."..z.`..`..H..d..P......g.6.$..8...H..<.. ...Y. ../[.;......9.....[.V..P.sl[..!5..'.j......$..C.t.R.......=":.+.....,/...............&..4@Z.[....#.xx@R.8i..Z3^{a....8.Y..../d.Z..m.p....3.3.3.&.>.02....i.i#._W...Nl.S...H$8..=..\f..v0....0..%.'D.F.3YG'gkw&.i.w+.....2...X...$sK#w.P.}....v.f.=.dc.K:.7......U.O..........U..4....e."........p...<k.}.....t....G...YMh...3....-v....L.L..N..\c...h.\|z).f~1uv.r#.-.Z/..._qn..d.s'-.p...^..wx{ Kv.p..\T.....r..M.9...)#?L.[......"q.F/.3...z02...O....#.....0.H..2\|b!Z..V...hM.../<CLJ{....-I.{.....8..Z.I+.:q6&.r...iQN.....\|.Mi^NK.i..g<...1..Tv...-...i.......5m....u.c...A...C.X..8@i......7._.e.{.u...&\..9.d...@.A$...;.u.I.M.n...bf..\...H..m..y".....+]&..t...0seV.U..........n..bk`Yl....i.%.......V\|......_I..v,.9.... ...63...K.P..c....g..7H$B.H$...Te).?.Nu...u.j.e+c..I...h.....z.4.rz......,d&B.....(...:s@.Y<R}zB...>......Zk.$.#..e....8...F[.rp.}..<.`@`....6::..O.!....

Chrome Cache Entry: 1837

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 50, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	6.959383504461844
Encrypted:	false
SSDEEP:	24:NBg/2eVoFUzEuahG7F1dxlhebm/kc65nTyu2v9wcS08bUneuPN:NBg5qOzEuMePdxlhe395nV2v9FS08b4F
MD5:	FB48F7AF0C3EC72B41C289603A468ED6
SHA1:	24AF5FE7595CA6EC77D2C7CF35F022D0F0907B7E
SHA-256:	FAAE15093AA231DCA93218011CFA8016F3BF8F03D63E9F3511700EF9792BB232
SHA-512:	94020E69FEEF92EF5E94942939CF8D950A5E4D76410F2E107BC7C8AD461336D7B652D779F6B582420FC9D00FBEAB03B30F8D6B1BF77B7C1D0646BE088F5BFBC0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2.....).x.....PLTE.......xi.vb.u`.t_.t`.u`.t_.t_.u`.u`.u`.v_.tb..m.xc.v`.t`.u`.t`.u`.u_.x`..f.u`.s`.u_.u`.u`.v^.td.UU..c.td.t`.v`.u`.t_.t`.t`..`.yk.t`.t`.v_.u_..q.ra.s`.u_.t_.u`.{a.vb.t`.t_.u`.v`..f.wU.t_.u_.ta.u`.t`.xb.xa.t_.u^.v`.ya.u`.u_..m.y_.u_.v_.t`.u_.t_.ya.w`.x_.t_.u`.t_.....h.u_.u_.zd..j.t`.u`.v`.wb.v`.va.sc.u`.ua.t_.w`.u_.u_.t`.v`..[.t_.u_....u`.}e.t`.u`.\|d.u_.u`.wc.ua.u`.vd.u`.t`.v`.mm.s_.t^.u`.t_.u_..k.w_.....f.u_.t_.u_....ve.u_.vb.u`.t_.ua.wf.v`.u`.t_.u`.u`.u`.w_.t_.x`.xa....t_.t`t.Q.....tRNS...N........s9.1.....v .o...._...Br....p.....k..................SW.bR....;.y..7-[..........VE...q.e...h.....+..!..X..)b.R...=...^......N.A0...}..U..K.@B........orNT..w.....IDATH....W.A...\...%l....c.v..u..b...^..+.....W}.egv&$>...e.....s.....I..a.e.....1r..1c...d.........R.%'8..I...)S.M.Q%".3g.S....jmd~*....Z,z.,]. ]..$+V.B.^.VlY.Z...%:...7.;....:.-.?[.$2X.?.{ME.?.W..3d..H .&..P........"^........y.P.!....M.!.l.MD4..I..#D..`.N..j....Tb.N.4{.....}f.)e

Chrome Cache Entry: 1838

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	14620
Entropy (8bit):	7.977552965225324
Encrypted:	false
SSDEEP:	384:r3jgZKP4djcmsNbgBZr0Ar/ZBIPL9YaSbQXMSyV+09Iv:3ggP4dwmooeW/ZBIPpYFiv094
MD5:	15AA082065E59D7984FB6A5DAD0264B7
SHA1:	CC1FD133344F1ABC6AAF4543198775B872FE939F
SHA-256:	9D2B33DF847CEFD0FBFA6D48F253DAE5A932A43D8BE9788DB30DB39CF1BA70C3
SHA-512:	BEC43B63B049389F3082F0324DFF7B4DC3506414C6D05BD03742B13501A8A41AD418465F8B9933A08AD0178D7D05AE63A09AC9757A5D94311C63691F987F82B1
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/guide/images/free-youtube-downloader/code.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................8....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......X...w....pixi............ipma.................8.mdat.....f%{......2.o.....a@.k&9.o.....F...C.no..w..\|'...<..]N..$.r....n.`F....1l.\..#......+t.G.m<..%...D$....\g6.rEL......n.q..1l..Z..7_.......O...~.N....[.jx..`..2...1..p....M......rI.Gi....l...?eue..!P.q+..K.\..2..R{H.K..k.>......f.I..$..<.].n.E..q.!.4.........I.<.........?..HRY#u~Z@2.........N......A....Xj...Y3=......._.1i...='.2../M%..$...L.iG.U..EQ...n...+.C......\A.<...s'..6..$q..}U..s...E=...;.!.=.B9......{A.............Q....u+..i...E..B.b.A...g.'...]V6M..x .......A.......).B.m?.. .!...v.Q...I....5..=.fo..........&J...2.a'o..H0...d..w.,..Fm7.Y.t.UI8....h.X....C.c.OQ2..o..N5....].....I.`T1..97rv....Vsh.[.Qq58......S....D.y...[....:.p^8....#........X...>O.H..N.M......7..pE.F......@."09.{

Chrome Cache Entry: 1839

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20443), with no line terminators
Category:	downloaded
Size (bytes):	20443
Entropy (8bit):	5.406067885872386
Encrypted:	false
SSDEEP:	384:tPfCn05b4J6+4vrCj/nd5s1udQaAWjreJvj/aRa0kJo0kM+cQZD326l/kXeD+1RY:tP6n05EOvrCjPHBaapjreJvj/aRafoO0
MD5:	0F72A2D9B487C74A6E704AE9DAD565D1
SHA1:	2750D02B046FED45595AC2350292492BEE1B014D
SHA-256:	7AC3DA9CFD5C1A08A07B9B3A69D4BAF42D25FF62DCC6B65789B94A770091FE30
SHA-512:	203AE13B126C76C1E9FAB7E245C1B8ECC688B648E12102D3FBDBDE9D77491D91C39B01CE33210F002BA9430877540128B1E735F20F0BF657F8B5986C8436A187
Malicious:	false
Reputation:	unknown
URL:	https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/dda53996456118190a640875fa0663b1.js
Preview:	(self.webpackChunkCE2=self.webpackChunkCE2\|\|[]).push([[544,812],{7353:function(e,t,r){"use strict";r.r(t),r.d(t,{pageState:function(){return P}});var n={tagsOfIgnoredDocHeadElements:["script","noscript"],tagsOfIgnoredDocBodyElements:["script","meta","noscript"]},s=r(477),a=r.n(s);function o(){return a()('/! For license information please see diff.worker.worker.js.LICENSE.txt /\n!function(){var e={342:function(){!function(e){var t=e.CE2BH={};function n(){return t.extends=n=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},n.apply(this,arguments)}t.defineProperty=function(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e},t.extends=n,t.objectWithoutPropertiesLoose=function(e,t){if(null==e)return{};var n,r,s={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0\|\|(s[n]=e[n]);return s}}("u

Chrome Cache Entry: 1840

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2186)
Category:	dropped
Size (bytes):	55392
Entropy (8bit):	5.0697787430027415
Encrypted:	false
SSDEEP:	768:lmEwKXfcNnCOEOaik1vpx5s2nbIqCeIPCCINygG:lmEwKX6jk1vpx5s2bIqCeIPCCINygG
MD5:	11230BF9A34710858918AD68AD166DE7
SHA1:	03AFEF97A9169872EF921DBE3A30E4ADA5E62043
SHA-256:	935CD2EEF804AF18DC6C3B8BDCD0FC372746FAEF0FA1121E50198BB46BBE7B53
SHA-512:	2A18CA2892CCE3F6B77C2D365063167C1F8E5559257C08505245A4F862E33D1F7C46855D6D252BE7FFC8B28F00EB4AE74F79319ACA48E5F565C03E437927B596
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. Google Tag Manager -->.<script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':.new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],.j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=.'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);.})(window,document,'script','dataLayer','GTM-57FR6ZG');</script>. End Google Tag Manager -->..<meta charset="utf-8">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<meta name="viewport" content="width=device-width,user-scalable=0,initial-scale=1,maximum-scale=1, minimum-scale=1" />.<link rel="shortcut icon" href="https://www.wondershare.com/favicon.ico" mce_href="https://www.wondershare.com/favicon.ico" type="image/x-icon" />.<link rel="stylesheet" href="https://neveragain.allstatics.com/2019/assets/style/bootstrap-wondershare.min.css">.<link rel="stylesheet" href="https://www.wondershare.com/assets/global.min.css"><tit

Chrome Cache Entry: 1841

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	96948
Entropy (8bit):	5.434913286427694
Encrypted:	false
SSDEEP:	1536:lFXud+Zcy8lZeTE3A+s5RQ7sAtofvHm0iTdRn3dRKur6xeJNKfH:dEl6etwZfvHl0Our6z
MD5:	D8C3BC670202E496D16339F58D426394
SHA1:	C9CAAE440E55546E4A69BBBB3DC32089AF2F0186
SHA-256:	31FC7B35533D223CE9B8820FA8F3AFE418A927272C5300F3A01129E40B959365
SHA-512:	131A0167CFAD682392335C1035F667F0A8D1429E8764912FB35345CE321EA605363A60EAF66CD8130722A7D56BB47640B874BD3D4F64355AD63E41C2C7B8342C
Malicious:	false
Reputation:	unknown
URL:	https://script.crazyegg.com/pages/versioned/tracking-scripts/3662e64da986368bbac2da241549a35b.js
Preview:	(self.webpackChunkCE2=self.webpackChunkCE2\|\|[]).push([[459,150],{1839:function(t,e,s){"use strict";s.r(e),s.d(e,{EventHandlers:function(){return Is},V11Tracker:function(){return De},compress:function(){return As},fp:function(){return Os},getCensoredElements:function(){return Be},timing:function(){return se}});const r="[\\s\\u00a0\\u2028\\u2029]+",i={whitespace:new RegExp(r,"g"),strip:new RegExp(`^${r}\|${r}$`,"g"),href:/\bhref="(.?)"/i,ipHost:/^([\d\.]+\|\[[a-f\d:]+\])$/i};function n(t,e){const s=t.replace(i.strip,"");return e?s.replace(i.whitespace," "):s}const o=`cesrk${Math.random().toString().replace(/\D/g,"")}`;function a(t){let e;const s=(t=t\|\|window).document;return t[`${o}_path`]!==t.location.pathname&&(t[o]=function(t){const e=t.defaultView;if(t.documentElement.scrollHeight>e.innerHeight)return e;if(!t.querySelectorAll\|\|"number"!=typeof t.body.scrollHeight)return;const{body:s}=t,r=Array.from(t.querySelectorAll("html, body, body ")).filter((t=>!t.ownerSVGElement)),i=s.getElemen

Chrome Cache Entry: 1842

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3039
Entropy (8bit):	5.154275868122011
Encrypted:	false
SSDEEP:	48:alwkI44N6btBhoyHlSCVIVr1z92QrsvN4KksqLvHjQ1oGAK81D7Nue7:alwkIdN6btBhoyksIFF9hrBKktvHc1oB
MD5:	B589207638106662C0D73AE6E0954266
SHA1:	60A799DB793659A172E7F0B0AEE509A35524692C
SHA-256:	09A3009CB995291C9621A11BAEE8934392D3D06A85E3C9DB8046F928B10E62D9
SHA-512:	650FB90C7AD4904BA2F383C16384BDEF495FC6EF0F12B380E3408A197829AB922861A3452402789576552AC37EF0CE7D76DC65D0E9DCD3964664FCD8674211F2
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style2016/pro_nav.css
Preview:	@charset "utf-8";../* CSS Document */.....pro_info {padding:10px 0; overflow:hidden; position:absolute;top:50px; z-index:10;}...pro_info .pro_icon {float:left; width:76px; border-radius:8px; background:#deebfa;}...pro_info .name {padding:30px 0 0 90px; font-size:16px; line-height:1.2em;font-family:freigsanproMED,Lato,Arial,Helvetica,sans-serif;}...pro_info .name span {font-size:18px; padding:0 5px 0 0;}...pro_info .name strong {font-weight:normal; color:#259bdb;}...pro_nav {padding:10px 0;font-size:12px; line-height:1.2em; overflow:hidden; position:absolute;top:140px;z-index:10;}...pro_nav a {font-size:12px; line-height:1.2em;}...pro_nav .curr a,...pro_nav a:hover {color:#fa745f; text-decoration:none;}...pro_nav .fm {display:block; width:40px; height:40px; margin:0 auto; font-size:30px; line-height:40px; text-align:center;}...pro_nav .name {display:block; text-align:center;}...pro_nav ul {float:left;}...pro_nav ul li {float:left; border-right:solid 1px #353132; padding:0 15px;}...pro_n

Chrome Cache Entry: 1843

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 600x364, components 3
Category:	dropped
Size (bytes):	25318
Entropy (8bit):	7.879111459822906
Encrypted:	false
SSDEEP:	384:Man1DDY3MyYEO23ibRgg4sQV7TIKLCN+b27T7qhS9a6nHQFMD8:MaBYpbZSSZ/IKLC0k7CIa8wB
MD5:	832AB2B17B24CFB6AF1FCCB5A8B01A72
SHA1:	8CF7617AF34841743882F0BDB10094B8E083C66D
SHA-256:	A61B5ABA7232F074FDD16BBDB9A00014631DD500B3EACEBD37CF57F40983AB57
SHA-512:	8D5B175A6CAA9271C5CEF88308CEB833281A818FAD498D97F6CED8568CE309BABE1EA55768F8B4785B5A2C84FC7776460C1C5DB92EEE3D5FEA79F1C20E6F5A56
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......l.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...o..x..g...>...Gn:WI....o.....~Z.~...........A.........wg...aC.R.*.I.+G.G......Q.....,.......zm...~....p..........e...._..E..~Z..T....j/....Q...._.........._.e...._.....K/......-^.E......X..........e...._..E..~Z..T....j/....Q...._.........._.e...._.....K/......-^.E......X..........e...._..E..~Z..T....j/....Q...._.........._.e...._.....K/......-^.E....

Chrome Cache Entry: 1844

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1821), with no line terminators
Category:	downloaded
Size (bytes):	1821
Entropy (8bit):	5.285473585785665
Encrypted:	false
SSDEEP:	48:r/svUMfSYX5UDd6IlW2Z2enuuS1z7REi5P7ujVUqcmI:YvJBiJ6DMuuS1z7RyZhxI
MD5:	21687D781510E8548771FC69EB39B2C7
SHA1:	10A8DDEB1921D5CCA90AED1DD371D93E3C110E75
SHA-256:	C3BE293BF9123827A61A2D0C23C55407D16BE4D1A98A357023429F65BA294608
SHA-512:	F642203751BE7D05F2A5666DDA1D538BBEA6FC171BA307B27B4DEC18C1D983859C098B70D00860483E2562AA4D27F4BFAB5337E0FB5D8C4BB29FEC37D5C5E396
Malicious:	false
Reputation:	unknown
URL:	https://lantern.roeyecdn.com/lantern_global_20200.min.js
Preview:	var lanternTracker=function(e,r){function n(e){return e?(e^16Math.random()>>e/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,n)}return{doTrack:function(o){var t,a,i,c,l;if((o=void 0===o?{}:o).site="20200",r.cookie.indexOf("lantern=")>=0);else{var d=n();t="lantern",a=d,(i=30)?((c=new Date).setTime(c.getTime()+24i60601e3),l="; expires="+c.toGMTString()):l="",r.cookie=t+"="+a+l+"; path=/; domain=wondershare.com.br"}var p,s,f=r.referrer\|\|"",u=r.referrer.split("/")[2]\|\|"",h=e.location.href\|\|"",y=e.location.hostname\|\|"",v=navigator&&navigator.userAgent?navigator.userAgent:"",m=(p="lantern",(s=r.cookie.match("(^\|;)\\s"+p+"\\s=\\s([^;]+)"))?s.pop():"");o.action_tracker_id&&(o.order_id=o.order_id\|\|"!missing",o.order_value=o.order_value\|\|1,o.lantern_type="conversion");var g="";for(var w in o)g+="&"+w+"="+encodeURIComponent(o[w]);var k="https://www.wondershare.com.br/",A=[],_=function(){u=y="internal"};if(Array.prototype.forEach.call([],(function(e){u==e&&_()})),Array.proto

Chrome Cache Entry: 1845

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1220
Entropy (8bit):	7.375013011073679
Encrypted:	false
SSDEEP:	24:rGA0X/jcqJX6V7UPg9RHbAKim6Ow80w0R3Pwzxn/eqs9pxfnNhia9NZxU031Q:rGAc/jZ6V4PgzEKV69RxPwzVvo/vDiKg
MD5:	789FD56C86238EDF27F205B44CF5ABC8
SHA1:	EC89D9299704264446B4DA40652A21C96111D9DF
SHA-256:	42F97BD470CEB268AE54676C32E0A540F838AB3415D40775593D591908BF050A
SHA-512:	FAC05771175DA0C2DC48D2FBA23EE7AD72A55183FD2C5FB7BDB561CC624E398AD7E9C43F31E0C551F967D135AAEDE480697E9160055216D6662E35F8761C3125
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/drfone_logoImg.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@.......................#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma...................mdat.....!..l...h@2...0.M4.@...+6.....:...\|.....~.cbo.N..."..d...._....1~.....KV.r.8....9..X....[..S.0.}.4..6......3D@.".._s......MY.!....T...p.K.^.F.^.# .[c.s{.o.k,.mC.../.':.T\..w..u....x....UT.F.x. .....]..]3..q'Kt.rS\|'.0.NE":.t.I....N...@.\.@k..?.H..\..A>...3T.....N!5.q...<0,>\......~.4.>.~...Dh.<z.Mq...F......."..M\|....k../L.Z......\|.V].i"..v.J.7..%..8K...z -Q....9......]aDs...$.aAy...+..3.<I.e !..\p.(..P.;%&..i...o..{...)..........@.0Y...v9x~2w..~vb..l....V.a...5V..>..5.\|.^.U..Q..N.#.]M.E.}.41.@..a..K..<..m;.u.D...?.. ....E7......l.=9o...lM..Fo.IaOd....F.G.kX.>.Jp..K..n...'f...`]...-.F`.b.....F.iqb....tf.....[P.oA....x.[t.[...J.=w....V.(".t..F...1s....&... .L.......:.L.Nn.v....p.

Chrome Cache Entry: 1846

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39480), with no line terminators
Category:	downloaded
Size (bytes):	39480
Entropy (8bit):	5.430584458539145
Encrypted:	false
SSDEEP:	768:/8FbETw0esXkP2LKoCZPAX1jpTywcsCxot:/4YS12LpX1FGxsam
MD5:	6FEFF9B75343B6BE10EE9EF18A6B3FCA
SHA1:	28889D15D38072532074DACCB98E50D6F9AB8822
SHA-256:	36DB1BB920509B91F7ED39A3469E12EFD7095AA86EC8C0E3B75065A794E61A5A
SHA-512:	B56B47DB87ABFE45213B980CDC47C53134149571E6933D81E3AFF04AD4239F171F6241A0C4A0CA326A9232A3D0749DE382867CB1AFE3E63729F9EA8BC9F74CC3
Malicious:	false
Reputation:	unknown
URL:	https://utt.impactcdn.com/A3249244-0e36-42f8-aac7-447bef0e6e601.js
Preview:	/! @build e436e5b4 @date 2024-03-22T16:01:32.768Z /!function(){"use strict";var r={3272:function(n,t,r){var c=r(3328),f=r(4994),d=r(9725),s=r(6610),l=r(4546),v=r(3159).t,m=r(7786);n.exports=function(i,o){var n=new Date,t=f(i.i.z9),r=s(i.o),e=l(r,i.v.zg,n),u=d(r,e,i.g,i.o,i.v,n),a=c(t,u,r,e,i.v.ze,n);return function(n,t,r){if(!o[n])return r(m("unknown action"));r=v(r);try{o[n](r,i,a,t)}catch(e){r(m(e.message,{z10:e.name}))}}}},325:function(n,t,r){var d=r(637).$,s=r(3272),l=r(7754),v=r(8742),m=r(3638),p=r(9336),g=r(7219),y=r(2578),$=r(997),h=r(3159).h,b=r(5814);n.exports=function(n,t,r){var t=h(b,t),e=p(m(n,t,d),{debug:!0}),i={I:!1},o={k:i,v:t,i:n,o:e,D:y(),g:l(e,i)},u=s(o,r),a=[],c=(e("app",g.C,{acid:n.acid,zn:"e436e5b4",zo:+new Date,zp:1711123292768,ver:o.v.ver,zq:i}),!1),f=function(n,t){switch(n){case"enforceDomNode":o.k.I=!1!==t[0];break;case"setPageViewCallback":"function"==typeof t[0]&&o.D.S($.T,t[0]);break;case"setNewSessionCallback":"function"==typeof t[0]&&o.D.S($.A,t[0]);brea

Chrome Cache Entry: 1847

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.066677073707229
Encrypted:	false
SSDEEP:	3:YG6dd6aji:YG6dEaji
MD5:	AB029DA7039880B6ED50A5339B09CDBA
SHA1:	E80EDD378E63EE4ECC3774C9655311E3D1CCBAA1
SHA-256:	029F04C9B43406573342370C74F28FAC0F8F40FA457960AF3F09E52BAF3C30ED
SHA-512:	0D44C16BA6E01223FDB70406D8F8D1C8FBAA931E4430D360DEFF1C7C200B5B87C39722447A8EE4CF3241A204D9D7BD55BC0B381CB14C3A64B122E651523A2E8C
Malicious:	false
Reputation:	unknown
Preview:	{"c_type":0,"country_code":"US"}.

Chrome Cache Entry: 1848

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	9416
Entropy (8bit):	4.4722529963459765
Encrypted:	false
SSDEEP:	192:2aGsLuFWgyBXDx78HZqVRd1qBD+x1QiNlJYCybM/SV1mE1zw:+FyB6HZmd1qBCxOiNr+Y/SV1mw8
MD5:	B31B81A9509903BFC05647E2DB7B0810
SHA1:	AC3278CC1802ABBB8A07B09B09E7F11F3C3E8CEE
SHA-256:	B82B910AD6685C06513CAEEB8987098268AC58218A8B31C68C187E17AE77E0C1
SHA-512:	1FB479FDD8697EB97897E66BD28A19D553F42EE1BFE6DF925CCCB1ABF0B6AA73A9300FB3CA8EFBCDFA7608B5DB3C4A016106375453131E4A752809CCD75E4B99
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style2016/images/ws_logo_g.svg
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg width="226px" height="33px" viewBox="0 0 226 33" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: sketchtool 40.3 (33839) - http://www.bohemiancoding.com/sketch -->. <title>63F0FDFB-1E58-4086-8FE8-E1FB2D039627</title>. <desc>Created with sketchtool.</desc>. <defs>. <polygon id="path-1" points="65.2166524 32.3088633 0 32.3088633 0 16.2956284 0 0.282393537 65.2166524 0.282393537 65.2166524 32.3088633"></polygon>. </defs>. <g id="Symbols" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="WSCOM/Footer" transform="translate(-391.000000, -46.000000)">. <g id="Wondershare_logo_RGB_light" transform="translate(391.741621, 45.817176)">. <g id="Group-5">. <mask id="mask-2" fill="white">. <use xlink:href="#path-1"></use>. </mask>.

Chrome Cache Entry: 1849

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1668
Entropy (8bit):	7.345232244153036
Encrypted:	false
SSDEEP:	48:rGo/jGIBVehexp+bZkTJwYTKLjrL0G2z+nkSWacuoI:rGghMs+VofKLjrL0MnK0
MD5:	80B43170D51DDE3BFB591622743F944D
SHA1:	C504F37BE7B25E691FE789776C616222D03DCF70
SHA-256:	A07CCEB742E2E9EC9017A577E8BAC6413F2A6EF605596F39D7E218F8363BD71E
SHA-512:	BCD3C96E57C2AE2A12A03B44A5234F07404DB28E6D54567620647F6B9A838FED70C345F6367EEF1D719486735035885B3483E5FD8BB29AEAD2CEB84A6B398938
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/pro-icon/freeyoutube-downloader.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm.........4iloc....D@.........................................8iinf..........infe........av01.....infe........av01.....iprp....ipco....colrnclx...........av1C........ispe.......P...P....pixi.........8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....av1C........ispe.......P...P....pixi............ipma..........................iref........auxl..........mdat........aP2..D........=.'<.D...._X.bP...q....x..z#...}>..?..o...J._DA;.z=..J.eF...\..>.P.....Gr0@..z.2....K>!.!..;M....h.....n.e....~QU}.{e..~.O.......p..?.j........C"f.lO..V..........^B;t.\..>........`...B2...P..<.@.,...Li^f.R+..M.t.r.h+.:T8.%i....G.n..~.....Q.O(q..gC.7$.....4.Z^j...../..z.E...EX....W.(..2.+Her....k....,.z0..U.:.:.....VJ,.pZ.`..C4......N..&.V;]...5......S.Z.Q......iq..9:.+....O...w.?g6.[N.H...F.j..\s.WxG..L_.K.\|.....o....L....M.F.X59....E.w.bu...MV..%.............U...V..e.T].W...f.u..s..xK.k.m..+B...-a...a.u..V

Chrome Cache Entry: 1850

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1851

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	8525
Entropy (8bit):	7.957502681367919
Encrypted:	false
SSDEEP:	192:rGDelZrRkj33hXz7rkplzMCriknZKfh3WG3:r90lrCFttkJ3Wa
MD5:	B9D8244D3AD552EEBBEC94225F96B786
SHA1:	83C9835AA598C14AD5F6659B80D32C90A88E131F
SHA-256:	C1AEA4EC60A7FA19B12A7464CD772319CBEE71F990E76FBD6DEA36087361F311
SHA-512:	9D1D75B826C051F5F08B445AB8BADDBFB5CDB2BBEC533ED8EF799C1B16B332A4F697A17F83C739EEC45D1B1B50E205AB41A2CCA84D8A203DCC8F3E228C942BD5
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/mg_booster.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@.................. ?...#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe...........P....pixi............ipma................. Gmdat.....%.... h@2.@.....q@..{..dkE..U...Y.2.$`......Y.7.d.-.#.o..w...V.15...................5..7..$..;.{HX.9.i......%M\.L.bw.[?.a).T...L...8...)3....d.UC.D..}..y..F..M.o.[....0@..u..\.pU.&W..L...\)\|.'J.A..}..*.'..0V........F.bI.......!...&Q........./..%ghJ`..m..U.).=G...uD.cP..dO.x.E.L.B.+S.....JB)..M..B ......y`.2..tyL.0..{.....w..o...l.0.J.....2=.H.F.......w....S.8Z.<..B..,...QR]...d........>..&_..C.NQ........ZD.F3e..A=n.......U.....).2....5!..H..2w.{......$..c.....l....(....k.EL......'.>......3..@g.c.Vct..{.tL.....z..@x...]...../.H..p..qf..i...J:..=5e)g!.V@.y.E.=P.I..C....>:...}..^Z..&.......e.....!..%.N)..\|.....Xw......o...'.5...$..8.!.BJ.=/..km....:...E .....qI.H..E...` ...p}s.b....-WQJ.<.$xx..

Chrome Cache Entry: 1852

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	9416
Entropy (8bit):	4.4722529963459765
Encrypted:	false
SSDEEP:	192:2aGsLuFWgyBXDx78HZqVRd1qBD+x1QiNlJYCybM/SV1mE1zw:+FyB6HZmd1qBCxOiNr+Y/SV1mw8
MD5:	B31B81A9509903BFC05647E2DB7B0810
SHA1:	AC3278CC1802ABBB8A07B09B09E7F11F3C3E8CEE
SHA-256:	B82B910AD6685C06513CAEEB8987098268AC58218A8B31C68C187E17AE77E0C1
SHA-512:	1FB479FDD8697EB97897E66BD28A19D553F42EE1BFE6DF925CCCB1ABF0B6AA73A9300FB3CA8EFBCDFA7608B5DB3C4A016106375453131E4A752809CCD75E4B99
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg width="226px" height="33px" viewBox="0 0 226 33" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: sketchtool 40.3 (33839) - http://www.bohemiancoding.com/sketch -->. <title>63F0FDFB-1E58-4086-8FE8-E1FB2D039627</title>. <desc>Created with sketchtool.</desc>. <defs>. <polygon id="path-1" points="65.2166524 32.3088633 0 32.3088633 0 16.2956284 0 0.282393537 65.2166524 0.282393537 65.2166524 32.3088633"></polygon>. </defs>. <g id="Symbols" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="WSCOM/Footer" transform="translate(-391.000000, -46.000000)">. <g id="Wondershare_logo_RGB_light" transform="translate(391.741621, 45.817176)">. <g id="Group-5">. <mask id="mask-2" fill="white">. <use xlink:href="#path-1"></use>. </mask>.

Chrome Cache Entry: 1853

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	17766
Entropy (8bit):	4.752232181072726
Encrypted:	false
SSDEEP:	384:ggvobiaNjeNGN/NSCN9NVNrU4fNSTlNSTZNSTMNSpNSPNSPNSsNSMNSwNPNLNSiJ:ZogcUpTCTmTTW44zTTt+WUEkzzsx2Zh
MD5:	5D3E237042274CD641A11D61C02811B5
SHA1:	DB6F829E3756995BC20E7988805B9ECABD7D1BE9
SHA-256:	CB646CBD0ACC43BE954B299A29F1E7C24A5148A0A5C3F4F3CAA58202A38CB1AD
SHA-512:	4045E0C83DA1730C7A1414FA5EB69F3E61C4E92CC633EFF89E2FA2B5A8A7C829472829D717B939A8B2D1691E7C119C6A2B27192EBCA7D824589D1DA2B5E39763
Malicious:	false
Reputation:	unknown
URL:	https://script.crazyegg.com/pages/data-scripts/0104/8432/site/www.wondershare.com.json?t=1
Preview:	{"uid":1048432,"dkey":"b1136c244609cca59359b59765a2806c","updated_at":1714069283,"version":"11.5.202","site_data_url_template":"https://script.crazyegg.com/pages/data-scripts/0104/8432/site/SITENAME.json","hud":{"host":"https://hud.crazyegg.com","script_url":"https://script.crazyegg.com/scripts/hud","core_api_auth_key":"e252d21c4d7e25b2b67b1020b98cc70fd41128eaa10b9b6722f0b7d50b8f8753","launch_origins":["https://core.crazyegg.com"]},"survey_preview_dest":"https://api.crazyegg.com/surveys/preview","survey_launch_origins":["https://app.crazyegg.com","https://core.crazyegg.com"],"addon_preview_dest":"https://api.crazyegg.com/surveys/preview","addon_launch_origins":["https://app.crazyegg.com","https://core.crazyegg.com"],"ce_app_url":"https://app.crazyegg.com","flow_preview_url":"https://api.crazyegg.com/abtests/preview","clock_url":"https://tracking.crazyegg.com/clock","common_script_url":"https://script.crazyegg.com/pages/versioned/common-scripts/6735f9594d6bb8a4f1fe56c6b3e21cf5.js","stat

Chrome Cache Entry: 1854

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	11796
Entropy (8bit):	7.970285853768925
Encrypted:	false
SSDEEP:	192:rG1jpPbvNQjpc7KyBeQaWmHtKm7Y94Kh0xHB6pEmV5G/xLRDUL/CALimA2xLrKoV:rK1bNQpaF7mtxY94TxHiEmWTDUO0imfl
MD5:	9BF7DB8CD0D002DDA09912CEA2DD3DA8
SHA1:	521C7AD33E1382833B4ED21227C61E13E9C5B713
SHA-256:	6C3A8C3BF84B58E2D69AB05161B7EB3676CC27A82193DA77458D23678C16EF23
SHA-512:	16BC538192A122C4236212987C203EBE41D2B1077031EDBA4DE2184129AC1FC700B5F17C512C8A96602ACD245F606486E1FC57A1F1DEADB73700E81E85DA7888
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/guide/images/youtube-downloader/scan-code.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................-....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......X........pixi............ipma.................-.mdat.....&exo.....2.Y.@...A@..0L.z.............:...M:.d.....u......o.gJ...g.r..... ..sn'%..P=...&..Fw.NA..Y.XP...@.\|%,kv.-..X.7u...C..~......>a.0....93..J.Z8.w.y(]nb...L....0.:......*=.W}....$0Iu..H!..M..<Eo.oeb..i.%..M...M...;..0O.]...p?n..%...;.3..s.F..^P.y.L...UF.C'...o...b.b....;<...p..h..e.>..J.....Yi....\|....9P>..[......o.S.@..[\|.?9.7 .G..A.xn.../.i..uV\..j.......US..<~1@..&xL.16p..i.i.I......[M..k.e..Z.A....h./.1..wD............. ..4.............4X;t.3.;..f....pY..L8.v.`.WA..uf.r9.....:....l..W.a\._#x'..Xk.=X.........'=)..p.....S..O...X.....c~}..9}.&.v_.....8........5.&.OD...9...3.n.D}.i1k..+0.O..`...........................6.^.;.vm......c..P.....-.yS.:..p5.?.x.\|.L..p...9t..2N.

Chrome Cache Entry: 1855

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17766
Entropy (8bit):	4.752232181072726
Encrypted:	false
SSDEEP:	384:ggvobiaNjeNGN/NSCN9NVNrU4fNSTlNSTZNSTMNSpNSPNSPNSsNSMNSwNPNLNSiJ:ZogcUpTCTmTTW44zTTt+WUEkzzsx2Zh
MD5:	5D3E237042274CD641A11D61C02811B5
SHA1:	DB6F829E3756995BC20E7988805B9ECABD7D1BE9
SHA-256:	CB646CBD0ACC43BE954B299A29F1E7C24A5148A0A5C3F4F3CAA58202A38CB1AD
SHA-512:	4045E0C83DA1730C7A1414FA5EB69F3E61C4E92CC633EFF89E2FA2B5A8A7C829472829D717B939A8B2D1691E7C119C6A2B27192EBCA7D824589D1DA2B5E39763
Malicious:	false
Reputation:	unknown
Preview:	{"uid":1048432,"dkey":"b1136c244609cca59359b59765a2806c","updated_at":1714069283,"version":"11.5.202","site_data_url_template":"https://script.crazyegg.com/pages/data-scripts/0104/8432/site/SITENAME.json","hud":{"host":"https://hud.crazyegg.com","script_url":"https://script.crazyegg.com/scripts/hud","core_api_auth_key":"e252d21c4d7e25b2b67b1020b98cc70fd41128eaa10b9b6722f0b7d50b8f8753","launch_origins":["https://core.crazyegg.com"]},"survey_preview_dest":"https://api.crazyegg.com/surveys/preview","survey_launch_origins":["https://app.crazyegg.com","https://core.crazyegg.com"],"addon_preview_dest":"https://api.crazyegg.com/surveys/preview","addon_launch_origins":["https://app.crazyegg.com","https://core.crazyegg.com"],"ce_app_url":"https://app.crazyegg.com","flow_preview_url":"https://api.crazyegg.com/abtests/preview","clock_url":"https://tracking.crazyegg.com/clock","common_script_url":"https://script.crazyegg.com/pages/versioned/common-scripts/6735f9594d6bb8a4f1fe56c6b3e21cf5.js","stat

Chrome Cache Entry: 1856

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1692
Entropy (8bit):	7.588431844816773
Encrypted:	false
SSDEEP:	48:rGAc/jD6AVLUvTKHDI3qNGWDmB50yEn/moZDaKWL:rGPD6RbKH6EmB5y/DW
MD5:	D8C134846807E9946510432EE7664C35
SHA1:	4D7114A4C9AB92995F2E91FF86700E4EA424A8D4
SHA-256:	98EBE59857A99F6C49CE488770A6BD9527595E2906EFB21DB798B2E13775F2CC
SHA-512:	366E0EBBB14DE8842C21D5D946BD04A61B5D6CBFB6EC996E13C7DA8AF87780BE8317BF44AD309AD0B0F22CBF9760B941310E6F0B15AAFA7FC36CFB39C5FC232E
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/filmore_logoImg.png
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@.......................#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma...................mdat.....!..l. h@2...0.M4.@.0.x...%......."..b.,..S.I....pR+(.....O..}.<sc.>..d?.#.q..9.....m..p.'..m<j.."..n'...E\...R...+...K.....A.t.....f...M.l_..8,t_b..gp......n.5./.....(v7(.G[....uW....2[..Nd..I.^..l...........^...z.l6,O.g.Nqx.........#mip]d.$...RXm%.J....$..L..g.m..p...&J...Lb!5.f...A.._....(?n.fsl#P.(..b4.".v.....j......A.^.Y..[w.A./......'+\|....knw..#.,.F=I..'NZ....\|..\.NVY.....L...bx..z./.R...)..\|.k/....H.......+.....<B.7d'......a..t..4~.)J$.......v;3....E..o..7.J.6v.k.../rB...G..:.^.L7......-...m...VE.$.y..I....Z.....m..g=5&..[....5...j.....-..M.W.l.[k....nj.V...e....6...u./......"."..J1...RG.......d../..........1`..`Z....y..hL.R.@G..Q\[h.C.'....I........~....AO.!..v.#.P.

Chrome Cache Entry: 1857

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 400x220, components 3
Category:	dropped
Size (bytes):	4048
Entropy (8bit):	7.703084790016446
Encrypted:	false
SSDEEP:	96:/8qsnrCkyPymtViG11/oE59q1kxCK+emC9jjx4MITJ7KT+xNv:/8qsnrJdS1r9SuCK+eFj9UGANv
MD5:	DB24877344C458D5E7BF25B8BA9A1DD9
SHA1:	9F7D8EAAD2B51E917988DFC93E9D9FE2B616D287
SHA-256:	BF5A458278D06D13F6F98DE5836583A27E95AC942134A89FE478A904E281FDA7
SHA-512:	A7031FE40351E408F6E47CAD55248BA446006C39B09945B82DEDE80E61C64502DCDEBF57EE7E8C607E30967298CD9D941094E5641C170BEB398CE91C4CAA0DB5
Malicious:	false
Reputation:	unknown
Preview:	......JFIF..........................................."......".$...$.6&&6>424>LDDL_Z_\|\|.............................."......".$...$.6&&6>424>LDDL_Z_\|\|............"..........5...............................................................................................!".!".!".............$..D.D.$BD..h............`H.D....s.....3p..@..^".................D.{....c....x...k...}?..eb..!+.Z............$.%.8...z...a....?...+l..~.%.....................=..Q{-..V.=x......H..$.(...........$BBQ$.U.\|T^7.G..`..!x............G{&7.y.N{.:........Y..0I.T%...D..Bb..........8...-.{C.\|.z..d.K/.R...Z....;(.:..Y.-gC.{J.Z..4...o..,.......<..2]...%w.h........O..>..-.........)\|n......7....u.jj............h.....;:...e.t.ou.x....m.u....?..O..................L.hFO......W.}.\F^,...+..&G..=.\L.0.................................................3.............................P.!16V..578@A "R.$4E............D..............V[..o(..8...........^...&e.....T.!.....!.....Z.N...U..G._`:.W.*"...5^

Chrome Cache Entry: 1858

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (708), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	46101
Entropy (8bit):	5.091798180287932
Encrypted:	false
SSDEEP:	768:3eEStF7gwZPSETylsxibdlvSxZm8Sv71yKYVGazX:3eESv7gwZrTQbdlvSxZmFdYVGazX
MD5:	2F6E1F2FC6E1662E61C1FBA6A086D54C
SHA1:	D198594D313FFF382DC843683A4328154924BDC8
SHA-256:	388B5D7666BDA34612D852DD695DE295481501F0C8AE90D24A121B3D57A2F3BF
SHA-512:	4E91A243E6289A4AAEB0CBE87B28404CEAD48F33502E78EB99CB620DF980A74F4365F0DDCB11B6AC22143B2F08297906A47E2EE0086356B4C3DEFC90C98F2380
Malicious:	false
Reputation:	unknown
URL:	https://www.wondershare.com/guide/free-youtube-downloader.html?act=install
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. Google Tag Manager -->.<script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':.new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],.j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=.'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);.})(window,document,'script','dataLayer','GTM-57FR6ZG');</script>. End Google Tag Manager --><meta http-equiv="Content-Type" content="text/html; charset=utf-8" />..<meta name="viewport" content="width=device-width,user-scalable=0,initial-scale=1,maximum-scale=1, minimum-scale=1" />..<title>How to Use WondershareFree YouTube Downloader</title>..<meta name="description" content="This is a step by step quick start guide for Wondershare Free YouTube Downloader." />..<link href="https://www.wonder

Chrome Cache Entry: 1859

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
URL:	https://ad.admitad.com/tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=ad.admitad.com
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1860

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	11814
Entropy (8bit):	4.794609010984336
Encrypted:	false
SSDEEP:	192:sX0hDEFofEPxVFJrtonLhgizSuyDz7VejVLEHAyU7fWVvXFEYlU22Z2NYBsKh5/2:VS3JonNgdL/OyU7fWVvXtGXNWVvXzcO
MD5:	653CE6FF02ED7C572A9C74D65BCD2C1F
SHA1:	717A44A3ED6E2725ED0978E259AEC0E90BD3DCB8
SHA-256:	B9D0F7D8C9C6E390DA45695F0559E1A5F4EFE0F971E46E7D7B788A071895C279
SHA-512:	EC963797EF9EA16EC2621958D5F52302614C14E468BD0A821C0B163DD8CCFFC098502A89BDDA1B24CD4FDCC9BA6BB18EA39B41B6870D8EE73C4FB92ED8E4C01F
Malicious:	false
Reputation:	unknown
URL:	https://www.wondershare.com/web-notification/sw.js
Preview:	/*. Web Notification. . Auth: ligz#wondershare.cn. * Date: 17:12 2019/6/25. * Copyright: Wondershare Inc.. */..(function () {.. 'use strict';.. var. pushContent,. afterCloseCallback,. gtmReportObj = {. gidckv: "",. gackv: "",. location: "",. path: "",. GTM_ID_SUFFIX: "WPNBJKV",. EVENT: "DC_WGP_Message",. TID: "UA-4839360-64". },. sensorsProject = 'UA_CscOperation_Web'; // .....UA_CscOperation_Web.. function logConsoleError(message) {. // needed to write it this way for jslint. var consoleType = typeof console;. if (consoleType !== 'undefined' && console && console.error) {. console.error(message);. }. }.. function parseJSON(text) {. var data = {};. if ('string' === typeof text) {. try {. data = JSON.parse(text);. if ('object' !== typeof data) {.

Chrome Cache Entry: 1861

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	downloaded
Size (bytes):	178
Entropy (8bit):	6.159950980937826
Encrypted:	false
SSDEEP:	3:qlygn1Z/F1/qllTpnhoBMrEj7bTtHTTOYfS9mjX8x3xLDba6a7ltvJxlbtMlTM/Z:qoi1Zilznhgj7d9mnXC3Jxl5kTsDbR/
MD5:	C1177965EFA681A65E823DC27232C36B
SHA1:	463D5504902E067531FEC83F0960629E90F2E173
SHA-256:	DCB1297D431CEB724D774B66919050396EB8B2BFF9367D4327EE4B629E578E50
SHA-512:	E51BD30208A38DAC5E7D53F54002CE1377EAE7807270645004DA0597E4E01E27D7750A9D021361F48EAAADDCFD4976548429F1DC00EA1BADC44212F2EE098E6A
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style/images/download_icon.png
Preview:	RIFF....WEBPVP8X..............ALPH^....`S[{.G.)V.!b...m.W.....^....ve..Q8..:.a5dY..H.)G...l.w..Z..g.n....I.'....(.`...GYm.8....VP8 &........*....>.f.P.%."......i..=.........

Chrome Cache Entry: 1862

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6111), with no line terminators
Category:	downloaded
Size (bytes):	6111
Entropy (8bit):	5.563283615416619
Encrypted:	false
SSDEEP:	96:K/EkLbbNvCl2xQy4VPq1p88ZmDHYDUAQliyCLFP5+fyJS0huD77Rvra9SA:K/l9vCl2gqbvZmDHYDUAQBTyJRyvud
MD5:	DD0CDEA4400E8FB27CB781585DD59A97
SHA1:	3D16E5C2BC5A2778C80733528AEBB4D337E38564
SHA-256:	4A044C9D89CAEB00DC8C302999BF61DC276FB7399C83DD9E4862F3711EB8F148
SHA-512:	7BB65A71C94E5BCE45DBEC7888AE411916CC618BD4ABC80D3907CD48A4FB362695DD776B6E249E6CC405ED15ADC33205EF0D439806B8683D4C0F85B9BBD356D2
Malicious:	false
Reputation:	unknown
URL:	https://script.crazyegg.com/pages/scripts/0104/8432.js
Preview:	if(CE_USER_SCRIPT=!0,"object"==typeof CE2&&(CE2.uid\|\|CE2.data))throw Error("CE: multiple userscripts installed");if((CE2="undefined"==typeof CE2?{}:CE2).userDataToJs=function(t){for(var e=[["uid","uid"],["snapshots","snapshots"],["status","status"],["flows","flows"],["sites","sites"],["USER_SCRIPT_VERSION","updated_at"],["__CE_HOST__","ce_app_url"],["COMMON_SCRIPT","common_script_url"],["COMMON_SCRIPT_SECURE","common_script_url"],["TRACKING_SCRIPT","tracking_script_url"],["TRACKING_SCRIPT_SECURE","tracking_script_url"],["AUTH_KEY","hud_auth_key"],["HUD","hud"],["GLOBAL_IP_BLOCK_LIST","global_ip_block_list"],["IS_USING_IP_BLOCKING","is_using_ip_blocking"],["TRACKING_DEST_NEW","v6_tracking_dest"],["TRACKING_DEST_NEW_SECURE","v6_secure_tracking_dest"],["DEST_V11","v11_tracking_dest"],["FT_DEST","flow_tracking_dest"],["PAGE_VIEWS_LIMIT_REACHED","page_views_limit_reached"],["NUMBER_OF_RECORDINGS","recordings_number"],["RECORDINGS_ACTIVATION","recordings_activation"],["ERROR_TRACKING","error

Chrome Cache Entry: 1863

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (57025), with no line terminators
Category:	downloaded
Size (bytes):	57065
Entropy (8bit):	5.514091857982549
Encrypted:	false
SSDEEP:	768:ncz9X5HxlIkI1UA0XOTQpzLrewPH2MPYDPbu7PoikQQRZsFblbvcqhjHO/FnA01P:nwX5RukIWA0XTLre+WKLvcqZ1c
MD5:	98B7A5233450DE9ED1142FDC8A41AEE7
SHA1:	A61D468EDC343AC7B1C64EFE4BB17BD98CCDD6E8
SHA-256:	12736A20E71870C848742569F5F407C2A4C879BD101B17D82F58EA404FF9C286
SHA-512:	FCCFC21CBFC02AE1AC77DA637080D464C6B5DD6849B6A2586BCA6AF7F510961BB011200CAB44DBF2D5FF3316BB55F70A41FF8C95C50AC7E21B8146DACA61B0E7
Malicious:	false
Reputation:	unknown
URL:	https://analytics.webgains.io/clk.min.js
Preview:	(()=>{var e={820:function(e,t,n){var r,i;!function(o,a,s){"use strict";"undefined"!=typeof window&&n.amdO?void 0===(i="function"==typeof(r=s)?r.call(t,n,t,e):r)\|\|(e.exports=i):e.exports?e.exports=s():a.exports?a.exports=s():a.Fingerprint2=s()}(0,this,(function(){"use strict";void 0===Array.isArray&&(Array.isArray=function(e){return"[object Array]"===Object.prototype.toString.call(e)});var e=function(e,t){e=[e[0]>>>16,65535&e[0],e[1]>>>16,65535&e[1]],t=[t[0]>>>16,65535&t[0],t[1]>>>16,65535&t[1]];var n=[0,0,0,0];return n[3]+=e[3]+t[3],n[2]+=n[3]>>>16,n[3]&=65535,n[2]+=e[2]+t[2],n[1]+=n[2]>>>16,n[2]&=65535,n[1]+=e[1]+t[1],n[0]+=n[1]>>>16,n[1]&=65535,n[0]+=e[0]+t[0],n[0]&=65535,[n[0]<<16\|n[1],n[2]<<16\|n[3]]},t=function(e,t){e=[e[0]>>>16,65535&e[0],e[1]>>>16,65535&e[1]],t=[t[0]>>>16,65535&t[0],t[1]>>>16,65535&t[1]];var n=[0,0,0,0];return n[3]+=e[3]t[3],n[2]+=n[3]>>>16,n[3]&=65535,n[2]+=e[2]t[3],n[1]+=n[2]>>>16,n[2]&=65535,n[2]+=e[3]t[2],n[1]+=n[2]>>>16,n[2]&=65535,n[1]+=e[1]t[3],n[0]+=n

Chrome Cache Entry: 1864

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	9770
Entropy (8bit):	7.961929662605795
Encrypted:	false
SSDEEP:	192:rGnnZTnoNs2cGjjozcR4pHo/OJCOucLUK1ocxMSbxqGSbs0Bt2okMCZYxehPl:rA1nYs3Gu9Ho/MtUK1HxPs1sBQUN
MD5:	5A7BEC043F5FB27A4567B7D2024C1DD4
SHA1:	BD19CD2D3E94DB969DFC43F7FF52F083ACD79CD8
SHA-256:	FBE2939739A1632CD9EF119B12AC8C6B8C006A657305B4DF5AA4AAC0AB1C713C
SHA-512:	7299D1BEC49429F36A9E6C6921D1A6614D89B19A5E8C8FA9FD61BEFADB15139950BE1107E1F0B608F113BA3263CDB9ADF57DF0F65AE14927E03BC773A8FD21F4
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/guide/images/free-youtube-downloader/settings.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................%....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe................pixi............ipma.................%$mdat.....f =......2.J.p.E.Q@.k..jV. .~..-..V.....f.<.P..n.r+....%qTnP...vo.e.#8.....&.n....l..KSs.w....:K2......#b\|.j.@)..>.lT..9..T....6B......N......?Nd...k/l...tz.1.O....=...Y.4}.b0H.i..;.U.-A..6.g1.q....k..)..?x..Gib.u.ZB2.8...P..vZ..] .k.'.@..$.I...P.t.1.~...}...g6..Ww.....$78.K.4;...S.cq..{......>.E..s....(..t^.q..[.:..'3.7.r..E.2.sIV....Q....M...$..1-.#/.Q...~..G..\|..Uz.v.r.."R.&.+.lsds.T..U&>..R.{.*.p...tqy......i..r...`...%8...S......10.X.A.G.uM......&/.cn...y9.77.V}...~....k...z.rd....s...m\|.{~}...\...d...8......4....1)..Rk.....zxDK..TF..\S...>o.2.XB.......T..,. ....:0.5v...........y6....+.;..E.-6..B..i...:J?......;..1.J!....C.?#&...h...N..$_UbIK-.mT.#.o.8.,c.....u..MA...8z..;{&.J

Chrome Cache Entry: 1865

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	9832
Entropy (8bit):	4.189559567240209
Encrypted:	false
SSDEEP:	192:4q+0bCxY0yiCjqMEq9Y6q9CoqVf+dk228d4qe/zmRFyc4KnAYuow1dnAkHt4CGEA:EdC6nAYuPFBtUEA
MD5:	73793C61C3B7FA58626000939397585A
SHA1:	496064516BD2CF3EE74A55F102ED34FEB5CB6F6E
SHA-256:	9360CBD82030640F4D76A0D6318C603926DDB698A12986FECD61BA2D2C42FB51
SHA-512:	46BBE3C15AF358B14E049D2B7F0E50CC4F2E9560C91AEDD1A8DED6A09896DA1D7CDCA6D2D6D3D87E5E7245F5034839E54D4EA972DA9B10878E4C2005E066DBD1
Malicious:	false
Reputation:	unknown
URL:	https://www.wondershare.com/web-notification/wsNotification.js
Preview:	/*. Web Notification. * . * Auth: ligz#wondershare.cn. * Date: 17:12 2019/6/25. * Copyright: Wondershare Inc.. */..if (typeof wsNotification !== 'object') {. wsNotification = (function() {.. var _wsNotification,. tracker,. notificationAlias = null,. navigatorAlias = navigator,. windowAlias = window,. serviceWorkerScript = '/assets/src/js/sw.js',. swRegistration = null,. isSubscribed = false,. applicationServerPublicKey = 'BPc5waOW4ChDckg3SwS4C5OU5srytDEYFsVtwDefMv01IHqlbvQKguG5QW18r8EFSoPokjThYvciOrtjuzsrbLk',. sysConfig = {}. ;.. if (windowAlias._NOTIFICATION_CONFIG) {. var config;. try {. if ('object' === typeof windowAlias._NOTIFICATION_CONFIG) {. config = windowAlias._NOTIFICATION_CONFIG;. } else {. config = JSON.parse(windowAlias._NOTIFICATION_CONFIG);.

Chrome Cache Entry: 1866

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:a2yb1tMn:aN1tM
MD5:	D06F04FCCF68D0B228A5923187CE1AFD
SHA1:	5DE9DF9FDD66A91EED06E31981553D4AB9CCF490
SHA-256:	830E67BDA2532CD5880EE86E3B33E69721082F8458BB0DF0CD4EDBB1577FD375
SHA-512:	9888104E0C9311D58B52A9B7030725C8BDFBE54F581246E4DDE0366F046671B3CE6838D09DDB4A384C6145248D4AB46D16BAE8E92F943488E2888982D6DB0D3A
Malicious:	false
Reputation:	unknown
URL:	https://pagestates-tracking.crazyegg.com/healthcheck
Preview:	{ "status": "ok" }.

Chrome Cache Entry: 1867

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (891)
Category:	downloaded
Size (bytes):	4861
Entropy (8bit):	5.615327680680721
Encrypted:	false
SSDEEP:	48:qOkerOHqo7hGwsRzJ9hJKw5yL7nXSvkRbn37J64t7QKP0P//RVWVxtrbbr7KK/il:qOUX7hGwsRzuAcm8d3LtaIbr2Kr07v/
MD5:	E24BB707A6B03F587C4F85C43FA8592E
SHA1:	E13E88BA323C4117563CE8F5205ED6042CA83954
SHA-256:	3049BD22BD35B5D40267AB2F27615154C6595D3A303066DA194D1F4BE2E1F5AA
SHA-512:	6582D82C070DB0F5580245D54A55E034004854E266E045C22967EA878CFF1446BC92A4CC8CCEBB6D9AEDBC6F2DE3CBF3D17BF53EA1294A0E11240694C720CEFD
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/script/gdpr_ws.js
Preview:	var gdprAgree = window.gdprAgree \|\| {};.gdprAgree = {..obj: {...text: 'We have updated our <a href="/privacy.html" target="_blank">Privacy Policy</a> and <a href="/cookis-policy.html" target="_blank">Cookies Policy</a>, by clicking any link on our sites you are giving your consent to the terms.',...btn: '<a href="javascript:;" class="gdprAgree_btn" onclick="gdprAgree.agree()">Agree</a>',...target: 'body',...wrapCls: '',...wrapTarget:''..},..apiServerAddress: '//dc.wondershare.com/v1/setPrivacy',..domain: window.location.hostname.substring(window.location.hostname.indexOf('.wondershare')),..setCookie: function(name,value,day){...var exp = new Date(); ...exp.setTime(new Date().getTime()+day2460601000);...document.cookie = name + "="+ escape (value) + ";expires=" + exp.toGMTString() +';path=/;domain='+gdprAgree.domain;..},..getCookie: function(name){...var arr,reg=new RegExp("(^\| )"+name+"=([^;]*)(;\|$)");...if(arr=document.cookie.match(reg))....return unescape(arr[2]); ...else ....ret

Chrome Cache Entry: 1868

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 50, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	947
Entropy (8bit):	7.297837621784841
Encrypted:	false
SSDEEP:	24:JL4b4ZieukCBsSsoX1DvprwWj0vHvLljavklY+86a/6OPTJ7d:ib4kDpvsoX1rpX0vHTBlY5xSMX
MD5:	E761E5BEB054A084D08CA4622B59873A
SHA1:	121A54DA8E6617FF3B4C051F96CC651EED3F45AE
SHA-256:	AC076D51EB2A2DE0A2C21B47DC456193CB0FDDCF30EE422667DDDC9A44D288BE
SHA-512:	91402B7AF42518AC755CA804D5B5A17F92BF6722126A9D3806FB4F5C47CADD2F121ED1E643D3CECBEB1BEF39A0DA239B049E8A03AF74C4A3C4048133863CC9ED
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images2016/icon_support2.png
Preview:	.PNG........IHDR...2...2.....).x.....PLTE.......w`.t_.u`.t`.t_.t_.v`.t_.wf.u_.u`.t_.u`.v_.x`.ye..j.vb....ua.u`.t`.ta.ya....t`.ya.t_.t`.{c.td.t`.u_.vb.vc.td.t_.u`..h.v`.t^.t_.t_.vc.t_.u`.u`.ua.u_.u`.v_.v`.u`.u`.u`.v^.vc.u_.u`.u_.u`.u_.t_.t`.ua.t_.t`.t`.t_.t`.u`.vb.t_......JtRNS..-{.........[@&.......7........46O.......C...?.C..%.66..~0...\|.Z....NKb......orNT..w....IDATH...[.@...D....D......v[55...=......\ph.g?u?.........+.-%..3..I.)%vK.(..H..?.\|A...r.j..r....;H.....j.G....I=..:.v.......C..$5.wC..q.2i...v..XW..a....Yq...-....w.^.S.!..?.O.n.'Q$o...2V@.g.7....n....#..@.E77....x.i..hKl.b..B.,..n...4T.t.....$.9...o.4.... X.9.8(r].....j...gBoE8.Y.$.w.'..0.wJXsD.o.?.G.i{..2T..Q..c,../0........'XRd.._W......_.4.&H.#H. .........C...9..).(D0l...P0O..`......%...".....c&...x...b....Oc....x.1.9&1.6.$.`..b.J2"d.C).....27.....0..i.3............aq.....`......7...E...z....:.UX;I.._...;.tUr.wF....IEND.B`.

Chrome Cache Entry: 1869

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	13914
Entropy (8bit):	7.975454778895408
Encrypted:	false
SSDEEP:	384:rkiaETSw6LjkrmBdveHIWF9BrsYX67o63:HaBbjkS/qFEYX6p
MD5:	D0FA1EED81B0806C44B23C57B474934C
SHA1:	429C8C9026C3BA4BC7287AAA7299D5DFA35248F4
SHA-256:	9DE369B481F399D055C45388AFE5668A7403C46993236B62AD6FD085A89904C9
SHA-512:	F3DE51339DCE606C3A327E420ACDA6287C66B3B80EA4F21B3A28DD9566144860CD7D5869D7EC4840F337DAE1A4911169C06953AF58CBDCE48F4035492DF985DA
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/guide/images/free-youtube-downloader/connect.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................5L...#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......X...w....pixi............ipma.................5Tmdat.....f%{......2.j.....q@...5..G....[__..\|.Wr...S..R?}..p4..P.."..r.@.'....,..;..I;I#..9..n...~M..._..o.s".r..aSv...H...l..Ig'.[.kW.r.R.U......e..../..=..E."6].n.J...r{...^...e..Y..~..w.Xs..c.u.3.;..B..9..<...d.2;...\|......~.a.u.(.......G.L..F.&....dGO.z..........3Y...0 ..g.O.6......s...y?...7..&.1)m.........N..5e.`..^+.p.A..$....:K.Z\|.....x..."U.Q....&f~..u.r.%......9.V..T.g......{....b=..t?F...I.c&Z~r5.4.R.l.M..S.....W../]..*.....Dw+9.....6;../.3......<?W).c.U..('..%U.@..38Q..q.^.c.q..B.........Y..Z..,....;...2.wY.....F.>.8.0....4..t3.5u..Qk.p!.u.xx..)..uh...rg.3....P...-c......../..Q..;...:.........<...J....$.y.....6...."...C2.J.._..v.....W....~.nL.;.$....$.6.....QOu0.....s..i....

Chrome Cache Entry: 1870

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HoUinYn:IUyY
MD5:	903747EA4323C522742842A52CE710C9
SHA1:	9F806EA4288867A31A4AD53AC171AA4029DF182B
SHA-256:	4BD8B60F91849C936AE45615145A7B7BE2CF803322A30BABBAE7267A142CA5BB
SHA-512:	EEF73DC29A38ED70FFCFC321931BCB5B5A29FAAC356E8F6D84F57C532EEF44AE75021C341CF7DAE26B8211924A1C0E0EC4735F6BFC4AF3970A48EB63BFB7895F
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmulceojplEWhIFDYOoWz0=?alt=proto
Preview:	CgkKBw2DqFs9GgA=

Chrome Cache Entry: 1871

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7206), with CRLF line terminators
Category:	downloaded
Size (bytes):	50281
Entropy (8bit):	5.765080763417503
Encrypted:	false
SSDEEP:	768:oU90GiTd5sUJZP+1T2k8XTYRsRabFXd+PaO+5LfRSqC:0GKHZPG2k8XTYRsRabJd+P45LDC
MD5:	C469F1A335B81A637243058B0F0441B2
SHA1:	5FC2B76D1159A299A3D565428C0E495D30A7E0D8
SHA-256:	EF67712158A9CF8666E7B7EE3ACB4566CC09366785DB633E4A6513FBF4E0E733
SHA-512:	8DF826EA44D397E5C87EE0ABA538C5806FCAED9C3BBF4A8A15D8514CD65F81D3B2837331CC79071D37D12EA6302507B4F07E48F57AD10413290DCB52D405E5D4
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style2016/global.css
Preview:	@charset "utf-8";../* latin-ext /..@font-face {.. font-family: 'Lato';.. font-style: normal;.. font-weight: 300;.. src: local('Lato Light'), local('Lato-Light'), url(https://fonts.gstatic.com/s/lato/v11/dPJ5r9gl3kK6ijoeP1IRsvY6323mHUZFJMgTvxaG2iE.woff2) format('woff2');.. unicode-range: U+0100-024F, U+1E00-1EFF, U+20A0-20AB, U+20AD-20CF, U+2C60-2C7F, U+A720-A7FF;..}../ latin /..@font-face {.. font-family: 'Lato';.. font-style: normal;.. font-weight: 300;.. src: local('Lato Light'), local('Lato-Light'), url(https://fonts.gstatic.com/s/lato/v11/EsvMC5un3kjyUhB9ZEPPwg.woff2) format('woff2');.. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2212, U+2215, U+E0FF, U+EFFD, U+F000;..}../ latin-ext */..@font-face {.. font-family: 'Lato';.. font-style: normal;.. font-weight: 400;.. src: local('Lato Regular'), local('Lato-Regular'), url(https://fonts.gstatic.com/s/lato/v11/UyBMtLsHKBKXelqf4x7VRQ.woff2) format('woff2');..

Chrome Cache Entry: 1872

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	126
Entropy (8bit):	5.210686305614921
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM7CJl0tRthwkBDsTBZt1BxdRtlcB/kg1p:6v/lhPfZMgl0znDsp1B76kup
MD5:	E714C69CA26DCDABCF9016341F66B5B9
SHA1:	1C78ACE0E38129460966521ECB9F3CE70563A5E8
SHA-256:	A607B3C3E0D09D7F339E0035F16F99BF93637DEE0EB27B2B9C447701FEFA2ACE
SHA-512:	14179E1E37D02CD4E31A6997DD06F4AF685BEC694967ADBFDCB341BC50D8558664A884694E670C76BA04795BBACA6E5AF756472F9BD18CE2344F936BC15F9943
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.@..........d....IEND.B`.

Chrome Cache Entry: 1873

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	9429
Entropy (8bit):	4.4562886365322845
Encrypted:	false
SSDEEP:	192:1zlurGJF4UY7/XTOxJtdnjFw81SucG7yYSiKWXwUv:1z8Uddl1hcG6SB
MD5:	ED7F8256D329B0DF3B565B5BD04ABF87
SHA1:	4D855F9CEA346C782628FA11A979E4EFA1272090
SHA-256:	B4B1338DCD5D500F70397B7DFCF09F0EF3CB323EC80C92C5582672A4D8436CE4
SHA-512:	FC51DE02E0CEAACBBF5145AB1180BEC6191016513C82188D3609E0F90D0EBE7EA64E4A03B621ACFE7F0A3524C799668BD3E2F7554488C5D9F96E44B3A57B4895
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg width="219px" height="31px" viewBox="0 0 219 31" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: sketchtool 40.3 (33839) - http://www.bohemiancoding.com/sketch -->. <title>6FBF7252-F20C-4481-BA8E-02FFE3B4F95C</title>. <desc>Created with sketchtool.</desc>. <defs>. <polygon id="path-1" points="63.4275711 30.9752593 0 30.9752593 0 15.6229983 0 0.270737257 63.4275711 0.270737257 63.4275711 30.9752593"></polygon>. </defs>. <g id="Symbols" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">. <g id="WSCOM/Navigation" transform="translate(-369.000000, -19.000000)">. <g id="20160909_Wondershare_logo_RGB_dark" transform="translate(368.836558, 19.000000)">. <g id="Group-5">. <mask id="mask-2" fill="white">. <use xlink:href="#path-1"></use>. </mask

Chrome Cache Entry: 1874

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	14
Entropy (8bit):	3.3787834934861767
Encrypted:	false
SSDEEP:	3:qJu:qJu
MD5:	223145B248890C9DE4EDE511DF3D0D32
SHA1:	125B1C9631D858D5369A6F2305430162247C2957
SHA-256:	F70B7825F4B35B00B7D634D63281703BA5042E6ABF1D1D1E20E10A60AC303A45
SHA-512:	CEF9303551D5AC40C62E248D888D81A6A8AB1EF67E461D9B323C5B1C0CD4B5254361A0EBABDD481C150B46E2BC19AE1CD46413E462BCE48CFABEA16C3EEA70DB
Malicious:	false
Reputation:	unknown
URL:	https://cdn.avmws.com/1020181/
Preview:	Inactive site.

Chrome Cache Entry: 1875

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, progressive, precision 8, 600x375, components 3
Category:	dropped
Size (bytes):	26718
Entropy (8bit):	7.953564916668674
Encrypted:	false
SSDEEP:	768:fvZzT3c69IyUqDLenp8g6U38fL63qBnkABoSeHn:fvZz79W4Lenp8YiLYqGH
MD5:	544FC7865842C25B87E61B9718DC37E5
SHA1:	F45FD3FC222C43CC64CE6247FD36B3198AA8EA65
SHA-256:	1B70DCA11E8F5B7560F1B87B8918C6C7105715EEF43A3AD830F19DA7668F8975
SHA-512:	D13ACA38299CF80D149F3959977EACE17F93ECC78FE764757571FA7AFA432FD601659C7B5FCF255492463CCCCF32ACD2718C648BBB61129C75C8CDC4ED8B82D0
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....%.%..................................................+".."+2(2<66<LHLdd.............................................+".."+2(2<66<LHLdd.......w.X.."..........6....................................................................{...S..A..R....f..x/...a...-.B:.q!..&.....<....\|...:P.k.(...X.<.NC..\|.E..J..."4d...Z ..%..h.Z ..%..h.Z ..%..h.Z ..:v....C1.D.7.._c....'.0o#..l.p...]#..}.\..a......U.N....l.~..;2Q..Fz~7r.o..f..\|...G....M..~<.....5....[.k?a...m....%y~...1..%.eS.D..9.NA..D..9.NA..D..9.NA..D..9.NA..D...@y..;-.B.m......k......M]...O.......z..E..^.>....+...e3h...........`.O...2.n.w.q.H..oR9.-.H<.. ....oR.-.H<.. ....oR.-.H<.. ....oR.-.H<.. ....oR.-.H<..:.\.~W....?ao.nWa.lL.1...............V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.FP.9...y..f..d.z....8....i2.BQ.B..i"%..b"X.."%..b"X.."%..b"X.."%..b"X.."%..b"X.."%..b"X.."%..b"X..0.K.R....T..K.k.q_2.14..\[....\|..@.....................n...v.p....K.n..j.7...g>.......>

Chrome Cache Entry: 1876

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 3840x5, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	450
Entropy (8bit):	7.3627975174885245
Encrypted:	false
SSDEEP:	12:pOYlOBs9sdbQYyu4dYJ07Hx2GrEp+OEbf:yBsWCY+my7HYGS+OEbf
MD5:	B7E2A4A64266B95AFAC87F46CFFE26F4
SHA1:	BAD74D78869D5498476BAE49D90287271FDE019E
SHA-256:	FA436F2041B4D5D4CB9C1582D01FEE851D302A0AAED16892C04B95FFA722DA64
SHA-512:	B4F10D2F70EC70185F46D1554DA84B64C0A7CBB04166C79C65C092A7E08626F5D47D55CE00ABE79FDD38BA15B26A57C666214B78FA59BC0F0873BC19EBB0084F
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/style2016/images/header_line.jpg
Preview:	RIFF....WEBPVP8 .........*....>.l.T(%.. (....in..\.S...x...9.}.r..d.=...{...'!.NC.l....9.}.r..d.=...{...y9.}.r..d.=...{...'\I.{...'!.NC.l....9.}.r..d.7.......L._.7........y.tb./R....c..".%uNX....U.....r.4..XT...I.'.....Vqd....s..r...B..?..m.#v.h..E.A..'..z..Q0...J.".~.$Xs......h..@n.o.Iv...P.<.g..i3.j...".,L.t..%W'.S.......F..!.A=.%.v..2.d.ZM............R.9`...\Kyw..n..z.Ox.........?.....5..yo.+0Y....8."B.I.a.F8%e...v.[....

Chrome Cache Entry: 1877

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 600x375, components 3
Category:	dropped
Size (bytes):	35484
Entropy (8bit):	7.823664107746248
Encrypted:	false
SSDEEP:	768:HuMACXUYCDSokjYOspNCJSfHQ70AN+57AQDtua349///N:HBANTSoGcpUJSm0AUqP///N
MD5:	F967EB582EB5FC63423E0FE6C71F34C9
SHA1:	6ED8CCF1D3DDF581F1D554E3782AE1E62D9D22B2
SHA-256:	84C34DA6735DC1619AE0F120BF53C471F14FE907F348D6A5A882F02471DE4AAE
SHA-512:	7BDB21FC83A0C6053273F1207911E59D61258B380D0B8830CF3F96825CB43B2A60EE5F5D04F0BC73522B5BA1F5533D0A8EAF80E2FA061208136739CBF95B9A04
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......w.X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?._?.{g.T.i.gwPK.:.z...........J.")f ...'.1].Y..........e..~ls.}.J...9..F.lMG...TC.XE..\|.iH.........Aul..iW..Bq.Uk.9.U........F.Pq.....V\....b0...,B?._..........MM.j.2.p.GP=k_.....*d8..I..0s].p..4.I....?../..Q..._.....f.(.)..C4`...2s.J.B.RAt........x.....T....U....xE..\|.1.........Hk......9..9.....Gj.H#qY..$e....#._..{t..L=.^...G...................dYw\...!K.pp3...Va

Chrome Cache Entry: 1878

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13816)
Category:	downloaded
Size (bytes):	313736
Entropy (8bit):	5.608249373823034
Encrypted:	false
SSDEEP:	6144:FxQX5NzJQYLceF+qKXjXP9RIMAu25Y0S7:7+xJ1NG37
MD5:	7238B9466523684E0FB9351DC6DA87B9
SHA1:	14FBD14F2C97FB7D5412C47A97A1724C546FFADE
SHA-256:	F76F7AB3BF70EAF0DD45DE2668EC96D9AE940C0965EE15E0D0D6BCF0A7AFC479
SHA-512:	4669F9198EED3D0809CCA2700AB9D454F485CB692013AEFBAEE8CF38EC037AB66E369ECE602C6BCD849F73D76FB47090041F696765C619C5C28A17632DE15FF3
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=G-24WTSJBD5B&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"36",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":false},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":26,"vtp_rules":["list",".(facengine\|edraw\|wondershare\|iskysoft\|media\\.io\|hipdf\|modao\|virtuallocation\|douga-plus\|keepvid\|mindmaster\|filmstock\|aimersoft\|inclowdz\|filmora\|virtulook)."],"tag_id":116

Chrome Cache Entry: 1879

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48028, version 3.0
Category:	downloaded
Size (bytes):	48028
Entropy (8bit):	7.994466202175746
Encrypted:	true
SSDEEP:	768:BbVNYI7O1vORys6Gi9VghnnPutNTSFjaJiUFZgWy0uEerGbUB9eMT9zmfrOeP8hu:JYIgvORaGiUnPsNWaJicRhG6FP8hcRDH
MD5:	0D4E2A11A944BD11BF82B040C44E7FB1
SHA1:	354A933F87B345FB023AD42429CD88E4DCD4191A
SHA-256:	E6EEE4F42622A00218FF015FF9F9AEE2AF44D2026AF14670AB1DC1DFBAE20A23
SHA-512:	3AA1D5BB275155F301F8204834BF2C7F7509267A527446A42F8C7FFECEBEAC619497F55F5BC2D4EF6A0D10E08656451A500DF8E98C06C209BABA32B09C44E57A
Malicious:	false
Reputation:	unknown
URL:	https://www.wondershare.com/style-fonts/fonts/freigsanproMED/8b338cb3-bb89-40d3-8c01-5580bceb3715.woff2
Preview:	wOF2..............t....6...........................j..z.`..`..P..d..P...4..B.6.$..8......<.. ...b. ../[.7...........(.....)..0.m....K...tE..M..c....,k..A....i......_............_.T.Y...I......cR\.b.Q.U.....4R69........af..y.....Y...M.4..7...S..V..Q....d..N.h.(R......&8.,. ...S).99E3w.n.I..t8.AF..zM}....F<E\|n....%.U..O......R.$:r.k...PS..9...W..D<.&......o..S....4.....`.ae....q...1..t...S.e........n.NR..P(...R....QY..k.G.Z1\/.......Q...V.I..[.8...hI..g.".Y..;\|4.L5...T.R...$1\..;U.y.5....i....)5....wDC....m..J..-.T.....Jf...`.>X...ohi....S..O.s.<..V.,.@.Kq>.&.[.x.DHc[.gqB.s.>..i...%....`J.+....`.f8.8....fc*...6/..mn..~.nm.s.x..<#..z.l.3........P.3...X......v..2=.Otz.Z.).b..#B@.F[hkW.....y.In.....I..m...8...3.1r.PY..b.".U..v..8.O .....07[z.V.l..6rt.6b...._.hP.....Q^.....]1$.0... ).....{.........=6.n..[..O.p....N.5.X..,..O.!.......C.Pt...KT..-.z......yx........"4.Q......=<P..V.....}$ef!$s2.nI.MU.i..D(......)....1_c.k.........._3...a.5(.%Y6....

Chrome Cache Entry: 1880

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	62817
Entropy (8bit):	5.424365052968912
Encrypted:	false
SSDEEP:	1536:gdAsk2l0qOmVGvTUNb2zU1KGp+UXLl3ZrvZb1dVlyiQ:sRk2NLze
MD5:	692325014F9DF26984E121DBD3807D53
SHA1:	F075F6A08D00A8290949F667D1FB1A62106EEE66
SHA-256:	3F1504C42FC5DCC5BBD57E976E22F4E7F9FA287D3300DA277B47A3C18E3AE713
SHA-512:	02C273B9614E00FF9C402C5424EB484286A8F52E8EC92769E4D4B739FB10895C8D269B7A63E4197F155B31E65AC98D4577B4C7B558EA6586029ABAA3C124E902
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/scripts/affiliate.js
Preview:	var trace_channel = "";..// ga..........var gtmReportObj = {.. GTM_ID_SUFFIX: "WPNBJKV",.. TID: "UA-4839360-64",..};....// .........location.href........hrefParams...........key......var hrefParams = {};..window.location.href.replace(/([^?&=]+)=([^?&=#])/g, function (_, $1, $2) {.. hrefParams[$1] = hrefParams[$1] ? hrefParams[$1] : $2;..});..// console.log("hrefParams*", hrefParams);....var scene = "web";....// custom....=......decodeURIComponent..url...custom...............=....var custom = null;..var customStr = getParamByName("custom");..try {.. if (isNonEmptyValue(customStr)) {.. // custom..code_type.type.shopping_id.buy_type.device_id.. custom = JSON.parse(window.atob(decodeURIComponent(customStr)));.. console.log("custom", custom);.. }..} catch (e) {.. console.error(e);..}....var shopping_id = "";..var isB

Chrome Cache Entry: 1881

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 37x37, segment length 16, progressive, precision 8, 600x375, components 3
Category:	dropped
Size (bytes):	25749
Entropy (8bit):	7.950282159283107
Encrypted:	false
SSDEEP:	384:evsyU2I/y0N/IUEzivG7m3wFD2K2xEyETmM28IDcAJQlln0pQA1+DikX+msnY:RyNdcazivim3w9gGdKM2jQll0aZX+JY
MD5:	360AB359615F7BEA4C7D794E3E4D98A6
SHA1:	BA18A90581408EFB3FED664B4DECE9DD7345174E
SHA-256:	D8D3BD63DFF0F12E2CA655338D2287FC01D9F4D2FE127B6F6C213D68862CCE45
SHA-512:	BE5AC2CF6D86A105FCC0387A2CDD6FDF418527D5FB0FC0C9494CC33839BCCDCF951613F5EBD9A7D7BB08FB2C197B0E6AED5B0CDE310160DB0F96A656528A5848
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....%.%............................................!...!.1&""&18/-/8D==DVQVpp.......................................!...!.1&""&18/-/8D==DVQVpp.......w.X.."..........5..................................................................r.......f..5N{......p.....^..>Md#.!.._....C.....D@.83.j..I.<..n#...H..)''.V...4.Q).JE..D.Q).JE..D.Q).JE..D.Q).JE..Y....-..N.l.h.Lf..K..C...f... [.1.7..~.7._....{S.."c....a\|...p.s......I./Al.....a}b.u..nX..r.,[.Z...,.....0..;^.....V.B../..I.bb...&!..bb...&!..bb...&!..bb......&!.1.f......Q.Zh8n.. u.....G u.....@\..oB!....{.....y>.z....m...3........~...3=IK.,OcD..R'.}....D%.w.....wz y...w.....wz y...w.....wz y...w.....wz y...w...w.?F.7#................G....~..*."."."."."."."."."."."."."."."."."."."."."."."."."."."."."."...N.....W8Nj.i....lM+aW(.M..a\|F.]$t.. GH...t.. GH...t.. GH...t.. GH...t.. GH...t.. GH...t.. GH...-!..>.;;..E.[....Q..(......... .........................y.ja...l=..c..x...E.b..uK..........

Chrome Cache Entry: 1882

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 39x39, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	584
Entropy (8bit):	7.637446832511182
Encrypted:	false
SSDEEP:	12:ATORn9dVGDCPmjL8uSaSCdYA7Kd0SXKnI2Jh5Gwl4sgFkkykz4C:4Wn4DC+jFBLOXKOwSBRMC
MD5:	05B86E63F3479439EC4203C3DAAFE963
SHA1:	FE1D44DB92DEAE5300AFB839D250C14695CCDE09
SHA-256:	5E8080682F64E30F0EA1BF4A3252C98A580F0FDED4EAFD43F0E0666C870CAA9E
SHA-512:	8895E2E212B9790E88ABA706702C99C7006F6A3E9AD648E91D96E6BF71455D7992DE14B02925E06D5356053EEEE783C86EF6D5693299AE5FBB5E36D86BF06A5D
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/images/multimedia/video-converter-ultimate/record-5.png
Preview:	RIFF@...WEBPVP8 4........'.'.>.6.H%...1.....l......P.$.m....I.....c.....o....../L.A...I.zmO:o.8.F{....j5.......Yu]-.j.'.$v........?..;..d.&....E9...!.._op17.!L..X....f,A...-..-...dyX..Cm..].N.".-..}....^..6h.k/u....FJ.3.c.$.M.2$.q....A...v.7.W....\~%.\.....r...f..D.....6...i..,].)D...;c.l.\..r..m.$[ ~<`.....ecxG..0!..W....)..x.m..>.a9..t5......V..b..r...{<.....6..M........eA.UP..D.....LUh..~....9.6`L.f.e..=.{3L.p.7.B....`.x. )..D[..Y.....].QA{..KO..}n....:A-...R....y...YQ5......".......&...I....b..cgGy@i...o...Ck.\...v.{?..).}M>g7.'......

Chrome Cache Entry: 1883

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	22743
Entropy (8bit):	7.9861307373006
Encrypted:	false
SSDEEP:	384:rndRm0IN9QhVhoKjC1iCOsK/Anz2yVWqjNEdrh4sbXKCd7LEkhHnMCXyfwlptYw8:LjIi3iiCe/An7bWBh4sbXhZhHnLCoTir
MD5:	A821399A6983FD00894AD6797F7EF01B
SHA1:	4F962216EF1BC4F44E3B2FD9F60A382F0F3818B2
SHA-256:	857DB95062ECD8784A34862CB62B1DB8ED69FCE50ACC28C10C282EC6394B95FB
SHA-512:	91948EB738E29C2374EFF44EFBED6D0312E87B8EA0021C4B96FCC76241A269C72A7B66BA622EE2A222FBF179848230323BF075F34E4053C5A8B3B88183AD3597
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/guide/images/free-youtube-downloader/button-to-download.jpg
Preview:	....ftypavif....avifmif1miaf....meta.......!hdlr........pict.................pitm........."iloc....D@..................W....#iinf..........infe........av01....jiprp...Kipco....colrnclx...........av1C........ispe.......^...{....pixi............ipma.................W.mdat.....f%....4..2........q@.+..h4..-......b....%b...D%.X3.-U=.P..!l..Ty.%.xd6.....q6.t..[...n.....z.:..Z%..X....!...R-g.[..w.~;=.X...}a.P.6.ZL..e.....3Oe.EG.Y.......t.6K..,.W...v.b7.E5....=..w...u.Wml[.Eq..Ui.Q%......=.#\Z[..b..#....PG.,....1o...n.].k...~...C....^..m.,Ks.B..o..f.T....?........}.n;L^....3...$..m..6z..u..$..qi...F..".dA.$..h...R.//..>.\|h..C.t,j.`.(.Gs.P.t.Zp.ec9....W..L...Z,.Y4.ku..G..Sg.3....r.n2...j8...+.h..\|...V..,r._M.+.....jMS.i..I.+.b{..O....W......[...N.......\O.......n..cz.R.e"T.<....^Tp$.LIs...p1.>RV.L...%.....W.*..m`...}.....}.].....aT..`Qp.Gq;..[.......wx!...\l.....}-.....N'......l...gn......g...=R.....Yi.X.Y.rd....&........PL......s!>l.......<]......=^_.......+

Chrome Cache Entry: 1884

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 50 x 50, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	533
Entropy (8bit):	6.770802771388853
Encrypted:	false
SSDEEP:	12:6v/7EZsT2V4il4R+55mnPE77g0RDkIBONLugU3N:u66/IzOPGgq7QvUd
MD5:	49D4635C86324CC91AE15192648DBDF4
SHA1:	5932C1B8B44AEF75918B3F75BA9AA47EFAD7DF16
SHA-256:	3801EC0C6264B67AB54567C6D347D40D52C45260D54C3FA858ED55BD5C53129D
SHA-512:	9FA2BE2FF3F8FF04A7C8CEE63D46FB29FBD5A72D3EAE64A77007B7968E63A5507E6160C9A0A68FB09E2EB531D7A86CE7127D0F424A14E44C78CEA9B856550498
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2.....).x.....PLTE.......xa.u`.u`.v`.vd.u_.t`.t`.t_.{a.t_.t`.t`.v`.xi.t`.u`.t`..`.u`.t_.u_....xc.t_.u`....vb.u`.t`.u`.u`..m.v_.u`.xc.u`.u`.wb.u_..j.ua.t_.u_....t`.u_..f.t`.t`.x`.t_.......5tRNS..B.......u.p...=..1........C.$.x<...........@..S.....orNT..w.....IDATH.....0.E.......b....."...F.X.&..LI.P.#..Y....m\.=Q.7)LW.......d.`.R..R/V2....K.X..2.P......J%......\|S..)...Z....N;..4[.X..:6)....K.X...KK........3b).X....jMT6.R{l.....G......o.D~/..\..%....~.`.$..\|ya.IL...f..r..fU.........IEND.B`.

Chrome Cache Entry: 1885

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 22 x 20, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	192
Entropy (8bit):	6.516933985106767
Encrypted:	false
SSDEEP:	3:yionv//thPlrrt9llkkMlwAACz2vblwYu05TFuNacS7ZvUbnUpmWll/sup:6v/lhPbkwLk2vm05pBvmWTp
MD5:	7FCE4D12EBBF81543730D3478295FC6A
SHA1:	C120B5D31FA92738E504D8AF449D9625BDF523CB
SHA-256:	AA1B9A741176AE08C31FC15A54A69489D8A4F1EA4A90C8AE1C0A703D1FD9910E
SHA-512:	D21CF9593E003851C1EE6F1AAB74070BF1F6E63BD95CC05395F9F3691E9BFD11BBB09B710B3877F4A99DDEB40280527BB43125D07060EDD6087E867EFF89EDA2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............#u......orNT..w....zIDAT(.c.........r....*6.?..o.....`3..?6...s0....ff$.C\.......nDU.-4....+..d..:......!'......Npa~ ....r(..F.R$.Q1>@.b..)<.h..W....IEND.B`.

Chrome Cache Entry: 1886

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2749), with no line terminators
Category:	downloaded
Size (bytes):	2749
Entropy (8bit):	5.069462318190189
Encrypted:	false
SSDEEP:	48:Mnd3gwWYa+m5tCvUW73U3EOv74Fkq6IaNEzi95w:LwWYLMtHWjU3EOv74FkqXUEziPw
MD5:	AFC7A19E7497E7388FA5786AC677C1F1
SHA1:	61C711E7268EAD901BB7EF3A7C349067B9971E03
SHA-256:	21D7161D6081FE8B6EBD56AEE53BFD1A77A48EA86DAB6DB8CA2C8CD042463F4A
SHA-512:	AB3A1DC9CC22CD65F3A2152C8FD28904F6437AF09DB9524ED5B5FBA80C239C4EAA7E9D2B80AD8D222522FB4E5319E8C74A00DCC780139A0DDEA2E35C73318DAC
Malicious:	false
Reputation:	unknown
URL:	https://images.wondershare.com/script/fancybox-2.0.1.css
Preview:	/! fancyBox v2.0.5 fancyapps.com \| fancyapps.com/fancybox/#license /.fancybox-tmp iframe,.fancybox-tmp object{vertical-align:top;padding:0;margin:0}.fancybox-wrap{position:absolute;top:0;left:0;z-index:1002}.fancybox-outer{position:relative;padding:0;margin:0;background:#f9f9f9;color:#444;text-shadow:none;border-radius:4px}.fancybox-opened{z-index:1003}.fancybox-opened .fancybox-outer{box-shadow:0 10px 25px rgba(0,0,0,.5)}.fancybox-inner{width:100%;height:100%;padding:0;margin:0;position:relative;outline:0;overflow:hidden}.fancybox-error{color:#444;font:14px/20px "Helvetica Neue",Helvetica,Arial,sans-serif;margin:0;padding:10px}.fancybox-iframe,.fancybox-image{display:block;width:100%;height:100%;border:0;padding:0;margin:0;vertical-align:top}.fancybox-image{max-width:100%;max-height:100%}#fancybox-loading,.fancybox-close,.fancybox-next span,.fancybox-prev span{background-image:url(fancybox_sprite.png)}#fancybox-loading{position:fixed;top:50%;left:50%;margin-top:-22px;margin-left:-22

Chrome Cache Entry: 1887

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52971)
Category:	downloaded
Size (bytes):	127155
Entropy (8bit):	5.3644805847409645
Encrypted:	false
SSDEEP:	1536:9tdSkA8LLhdaj4U7gLciUkgFbCnsg+EOswcswAOkY40sbZDVaT8:9rdK
MD5:	21D901E933A7282C3083459228051BC6
SHA1:	E1DE172E2CA33759F54B8E0463531B7854686F27
SHA-256:	18A53030C81A50C7BDE906339FC413A286342D058F638B9BA191ADCA64E6383D
SHA-512:	4489ECDED0FD4D06A28560E9503D1CF303DEB16FFABCCA51DE8868E12410AA13DF7B99768177FA5F9AE96CA86D9BC2AD87F7153DE364D118C579902CF52C8B55
Malicious:	false
Reputation:	unknown
URL:	https://cdn.consentmanager.net/delivery/customdata/bV8xLndfODYzMjEucl8ubF9lbi5kXzMwMjQ2LnhfMTA1LnYucC50XzMwMjQ2Lnh0XzEwNQ.js
Preview:	if(!("cmp_config_data" in window)){window.cmp_config_data={};}window.cmp_svg_no=function(){return new cmp_html("svg",{"xmlns":"http:\/\/www.w3.org\/2000\/svg","xmlns:svg":"http:\/\/www.w3.org\/2000\/svg","viewBox":"0 0 20 10","version":"1.1"}, "", function (x){x.child("path", {"fill":"#f64c4e","class":"cmpsvgredfill","d":"M 15,0 H 5 A 5,5 0 0 0 5,10 H 15 A 5,5 0 0 0 15,0 Z M 6,9 A 4,4 0 1 1 10,5 4,4 0 0 1 6,9 Z"})});};.window.cmp_svg_yes=function(){return new cmp_html("svg",{"xmlns":"http:\/\/www.w3.org\/2000\/svg","xmlns:svg":"http:\/\/www.w3.org\/2000\/svg","viewBox":"0 0 20 10","version":"1.1"}, "", function (x){x.child("path", {"fill":"#5ab14b","class":"cmpsvggreenfill","d":"M 15,0 H 5 A 5,5 0 0 0 5,10 H 15 A 5,5 0 0 0 15,0 Z m -1,9 a 4,4 0 1 1 4,-4 4,4 0 0 1 -4,4 z"})});};.window.cmp_svg_yesorange=function(){return new cmp_html("svg",{"xmlns":"http:\/\/www.w3.org\/2000\/svg","xmlns:svg":"http:\/\/www.w3.org\/2000\/svg","viewBox":"0 0 20 10"}, "", function (x){x.child("path", {"fil

\Device\ConDrv

Download File

Process:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.48598447273363
Encrypted:	false
SSDEEP:	6:KCsT21774vVsT2CMVsT2uM3RFX8VsT26K9CVsT20DLzSVsT2l1JeOvVsT2imSVs0:E29002CF2ukjF26K9P2yr2UO02im/e4+
MD5:	841AC02B43B482E1573E064745562C73
SHA1:	5371FCDF8D72EB42067838EBED4F65418181C23F
SHA-256:	6C9AB2DBD065CC814905F60EE6E828C5851129A54DCDEE1B967497B50B004AAE
SHA-512:	8CC7777DB86BAAAD7240E67995FE1AAAB8CC4B3DCA7666998CB9EA445EE5D2F6B8EB7648E3D821D1B669FCF4B53BC2D1E3C5EDAC0655FA88F997D2C2A05E4CB3
Malicious:	false
Reputation:	unknown
Preview:	.Net Framework 2.0 System.Drawing is well....Net Framework 2.0 System.Xml is well....Net Framework 2.0 System.Windows.Forms is well....Net Framework 2.0 System.Configuration is well....Net Framework 2.0 System.Management is well....Net Framework 2.0 System.Transactions is well....Net Framework 2.0 System.Data is well....Net Framework 2.0 Accessibility is well...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.2730251726875625
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	free-youtube-downloader_setup_full384.exe
File size:	754'320 bytes
MD5:	e7d83f875043ece6f2fdb16ec9485ebd
SHA1:	f87e5cae97c621a489ed19a6d6a7a399dad17170
SHA256:	1c019635706305028548ec6fae8e8076c36857d6fd532f6461a6f5ac5676f140
SHA512:	b11640849a83f40bebaf4997d4557f8e8f8595a78cc0d969310b5266e26b7f9e18a7e5d1f21980a56adc975306355e5aad02cab787ec78024b9cf360eb25cb21
SSDEEP:	12288:kFxqifK2DKbDgrWOTBuBgDU+heii9rjIXfh60:kF5PeDjOHDU+hez9rjIPhf
TLSH:	8BF48D02B794C039E07719789A62D7F9DBFABC7198A04B0B23F46E9E2DB06815D34717
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..aO..aO..aO......aO......aO.....~aO......aO......aO..aN..`O......aO......aO......aO.Rich.aO.................PE..L......Q...

File Icon


Icon Hash:	191b1b333130301b

Static PE Info

General

Entrypoint:	0x42d3c2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x51F788E1 [Tue Jul 30 09:35:29 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc2af36bcf7c7490d53ceb8e8bcf9b8c

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	16/02/2016 00:00:00 17/03/2017 23:59:59
Subject Chain	CN="Wondershare software CO., LIMITED", OU=IT, O="Wondershare software CO., LIMITED", L=Shenzhen, S=Guangdong, C=CN
Version:	3
Thumbprint MD5:	A66CFD75AAA12CA20FFE2F8672EDAA77
Thumbprint SHA-1:	5680FD70B18C637B1BB62AF132D6193DA4DFC847
Thumbprint SHA-256:	5EC396398CD4E8E27AB30E00E16C81286CF10416D3D2BC8D3984F3F714070094
Serial:	1F8663313222FF9957A7D5EDD27A3346

Entrypoint Preview

Instruction
call 00007FAE0881EDE7h
jmp 00007FAE0881162Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 4Ch
mov eax, dword ptr [004596E0h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
xor ebx, ebx
push edi
mov edi, ecx
mov dword ptr [ebp-40h], ebx
mov dword ptr [ebp-44h], ebx
cmp edi, ebx
jne 00007FAE088117BCh
call 00007FAE0880F16Bh
mov dword ptr [eax], 00000016h
call 00007FAE088197D3h
or edx, FFFFFFFFh
mov eax, edx
jmp 00007FAE08811A0Ah
mov eax, dword ptr [edi+14h]
cdq
mov ecx, eax
mov eax, edx
mov dword ptr [ebp-30h], ecx
add ecx, FFFFFFBBh
mov dword ptr [ebp-2Ch], eax
adc eax, FFFFFFFFh
push esi
cmp eax, ebx
ja 00007FAE088119DDh
jc 00007FAE088117AEh
cmp ecx, 00000408h
ja 00007FAE088119CFh
mov eax, dword ptr [edi+10h]
cmp eax, ebx
jl 00007FAE088117A7h
cmp eax, 0Bh
jle 00007FAE088117E8h
cdq
push 0000000Ch
pop ecx
idiv ecx
mov ecx, edx
cdq
add dword ptr [ebp-30h], eax
mov dword ptr [edi+10h], ecx
adc dword ptr [ebp-2Ch], edx
cmp ecx, ebx
jnl 00007FAE088117B0h
add ecx, 0Ch
add dword ptr [ebp-30h], FFFFFFFFh
mov dword ptr [edi+10h], ecx
adc dword ptr [ebp-2Ch], FFFFFFFFh
mov ecx, dword ptr [ebp-30h]
mov eax, dword ptr [ebp-2Ch]
add ecx, FFFFFFBBh
adc eax, FFFFFFFFh
cmp eax, ebx
ja 00007FAE0881198Bh
jc 00007FAE088117AEh
cmp ecx, 00000408h
ja 00007FAE0881197Dh
mov esi, dword ptr [edi+10h]
mov eax, dword ptr [eax+eax]

Rich Headers

Programming Language:

[ASM] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x572d4	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x36354	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb3c00	0x4690
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb7000	0x49bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x495d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x51028	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x49000	0x4c8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x47e9c	0x48000	4acb38ed6859c66af74537fddbc5c06e	False	0.5629950629340278	data	6.638650376244158	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x49000	0xfc30	0xfe00	df33b9710225db086be7bd78d25bbab5	False	0.33915169783464566	data	4.590674125453404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x59000	0x2610c	0x1de00	4a5cfaf8fefdfd74d6f495805529675b	False	0.22235388336820083	data	2.9933782683531938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x80000	0x36354	0x36400	8c27098ba94fc379a58bb839129ecac5	False	0.5680803571428571	data	6.740944521448995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb7000	0x762a	0x7800	bcff1f174012f8d068aa066ed7594d62	False	0.4646809895833333	data	4.959420044967922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x80588	0xad3c	PNG image data, 635 x 559, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9602687832596735
RT_ICON	0x8b2c4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.46162021728861596
RT_ICON	0x8f4ec	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5672043010752689
RT_ICON	0x8f7d4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6351351351351351
RT_ICON	0x8f8fc	0xa03a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9983909503144961
RT_ICON	0x99938	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5959488272921108
RT_ICON	0x9a7e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7463898916967509
RT_ICON	0x9b088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5729768786127167
RT_ICON	0x9b5f0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.18286407192712648
RT_ICON	0xabe18	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.312529522909778
RT_ICON	0xb0040	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4475103734439834
RT_ICON	0xb25e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5117260787992496
RT_ICON	0xb3690	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6532786885245901
RT_ICON	0xb4018	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7322695035460993
RT_DIALOG	0xb4480	0x78a	data	English	United States	0.38082901554404147
RT_STRING	0xb4c0c	0x23c	Matlab v4 mat-file (little endian) 7, numeric, rows 0, columns 0	English	United States	0.5192307692307693
RT_STRING	0xb4e48	0x21e	data	English	United States	0.45940959409594095
RT_STRING	0xb5068	0x508	data	English	United States	0.3656832298136646
RT_STRING	0xb5570	0x67a	data	English	United States	0.37575392038600725
RT_STRING	0xb5bec	0x8c	data	English	United States	0.6285714285714286
RT_ACCELERATOR	0xb5c78	0x10	data	English	United States	1.25
RT_GROUP_ICON	0xb5c88	0x16	data	English	United States	1.0909090909090908
RT_VERSION	0xb5ca0	0x31c	data	English	United States	0.41959798994974873
RT_MANIFEST	0xb5fbc	0x398	ASCII text, with very long lines (610), with CRLF line terminators	English	United States	0.5032608695652174

Imports

DLL	Import
COMCTL32.dll	InitCommonControlsEx
VERSION.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
KERNEL32.dll	GetModuleFileNameW, CreateFileW, lstrcmpW, MultiByteToWideChar, lstrlenW, GlobalUnlock, FlushInstructionCache, RaiseException, GetLastError, SetLastError, GetProcAddress, EnterCriticalSection, CreateSemaphoreW, LockResource, lstrcmpiW, DeleteCriticalSection, GetCurrentThreadId, CloseHandle, DeleteFileW, CreateThread, GetVersionExW, GetTimeZoneInformation, InterlockedPopEntrySList, VirtualAlloc, VirtualFree, InterlockedPushEntrySList, SetEnvironmentVariableA, GetProcessHeap, LoadLibraryW, WriteConsoleW, SetStdHandle, FlushFileBuffers, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetCurrentProcessId, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, HeapSize, ExitProcess, HeapDestroy, HeapCreate, TerminateProcess, GetStdHandle, SetHandleCount, GetConsoleMode, GetConsoleCP, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, IsValidCodePage, GetOEMCP, GetACP, IsProcessorFeaturePresent, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, CompareStringW, LCMapStringW, RtlUnwind, MoveFileW, GetCPInfo, GetStartupInfoW, HeapSetInformation, GetCommandLineW, GetSystemTimeAsFileTime, GetDateFormatW, GetTimeFormatW, HeapAlloc, HeapFree, GetLocaleInfoW, DecodePointer, EncodePointer, GetStringTypeW, InterlockedExchange, InterlockedCompareExchange, SetFileAttributesW, WaitForMultipleObjects, CreateEventW, GetFileSizeEx, ReadFile, GetTickCount, SetEvent, SetFilePointerEx, GetTempPathW, WideCharToMultiByte, GetExitCodeProcess, LeaveCriticalSection, SizeofResource, Sleep, InitializeCriticalSectionAndSpinCount, GetSystemDirectoryW, GlobalAlloc, InitializeCriticalSection, WriteFile, GetModuleHandleW, GetSystemDefaultLCID, WaitForSingleObject, GlobalLock, GetFileType, GetCurrentProcess, InterlockedDecrement, InterlockedIncrement, LoadLibraryExW, CreateProcessW, LoadResource, FreeLibrary, FindResourceW, SetErrorMode, FindResourceExW, FreeResource, GetEnvironmentVariableW, MulDiv, LocalFree, GetFileAttributesExW, FormatMessageW, TerminateThread, SetFilePointer, SetEndOfFile
USER32.dll	UnregisterClassA, GetWindowLongW, GetSystemMetrics, GetClientRect, GetWindowRect, ClientToScreen, DispatchMessageW, IsIconic, MoveWindow, GetWindow, DefWindowProcW, CallWindowProcW, SetWindowTextW, EnableWindow, UpdateWindow, SendMessageW, SetDlgItemTextW, ReleaseCapture, MessageBoxW, UnhookWindowsHookEx, SetWindowsHookExW, CreateWindowExW, FindWindowExW, IsWindow, CreateDialogParamW, ShowWindow, LoadStringW, GetCursorPos, SetWindowPos, GetSysColor, GetDesktopWindow, RedrawWindow, EndDialog, SetWindowLongW, GetDlgItem, ReleaseDC, GetClassNameW, GetWindowTextW, InvalidateRect, GetScrollInfo, GetAsyncKeyState, LoadIconW, RegisterClassExW, TranslateMessage, GetDC, wsprintfW, GetClassInfoExW, PtInRect, BeginPaint, SetFocus, CreateAcceleratorTableW, EndPaint, DestroyWindow, SetCursor, GetWindowTextLengthW, DestroyAcceleratorTable, ScreenToClient, GetMessageW, PostQuitMessage, CharNextW, GetWindowDC, RegisterWindowMessageW, FindWindowW, FillRect, IsChild, SetCapture, PostMessageW, GetLastActivePopup, SetForegroundWindow, GetFocus, GetParent, InvalidateRgn, LoadCursorW
GDI32.dll	SetTextColor, DeleteDC, CreateFontIndirectW, GetDeviceCaps, SetBkMode, DeleteObject, SelectObject, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, GetObjectW, GetStockObject, CreateSolidBrush, BitBlt
ADVAPI32.dll	RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyExW, CheckTokenMembership, RegOpenKeyExW, FreeSid, AllocateAndInitializeSid, RegDeleteValueW, RegDeleteKeyW, RegQueryInfoKeyW
SHELL32.dll	SHGetFolderPathW, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteW, SHGetMalloc, SHGetSpecialFolderLocation, ShellExecuteExW, Shell_NotifyIconW
ole32.dll	CoTaskMemRealloc, CoUninitialize, OleLockRunning, CoCreateInstance, CLSIDFromProgID, CLSIDFromString, CreateStreamOnHGlobal, StringFromGUID2, OleInitialize, OleUninitialize, CoInitialize, CoTaskMemFree, CoGetClassObject, CoTaskMemAlloc, CoCreateGuid
OLEAUT32.dll	SysAllocString, SysStringLen, VariantClear, LoadTypeLib, VariantInit, SysAllocStringLen, OleCreateFontIndirect, VarUI4FromStr, LoadRegTypeLib, SysFreeString
SHLWAPI.dll
gdiplus.dll	GdipCreateBitmapFromScan0, GdipFree, GdipDeleteGraphics, GdipGetImageGraphicsContext, GdiplusStartup, GdipGetImageWidth, GdipCreateHBITMAPFromBitmap, GdipGetImageHeight, GdipCloneBitmapAreaI, GdipDrawImageRectRect, GdipLoadImageFromStream, GdiplusShutdown, GdipReleaseDC, GdipCloneImage, GdipDrawImageRect, GdipCreateFromHDC, GdipDisposeImage, GdipAlloc, GdipDrawImageRectI
WS2_32.dll	gethostbyname, closesocket, socket, recv, ioctlsocket, connect, inet_ntoa, WSAStartup, select, WSAGetLastError, htons, WSACleanup, send

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 22:23:45.825532913 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:23:49.745709896 CEST	49736	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:49.927519083 CEST	49737	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:49.937720060 CEST	80	49736	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:49.937840939 CEST	49736	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:49.938179970 CEST	49738	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.119469881 CEST	80	49737	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.119642973 CEST	49737	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.119824886 CEST	49737	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.131825924 CEST	80	49738	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.131915092 CEST	49738	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.132111073 CEST	49738	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.311499119 CEST	80	49737	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.323630095 CEST	80	49737	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.323672056 CEST	80	49737	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.323720932 CEST	80	49737	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.323731899 CEST	49737	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.323754072 CEST	80	49737	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.323925018 CEST	49737	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.325964928 CEST	80	49738	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.334050894 CEST	80	49738	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.334086895 CEST	80	49738	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.334134102 CEST	80	49738	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:50.334151983 CEST	49738	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.334207058 CEST	49738	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.334252119 CEST	49738	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:23:50.527959108 CEST	80	49738	47.88.25.126	192.168.2.4
Apr 25, 2024 22:23:55.435025930 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:24:08.018790007 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:08.018838882 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:08.018920898 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:08.020957947 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:08.020971060 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:08.463349104 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:08.463496923 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:08.468347073 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:08.468372107 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:08.468790054 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:08.516238928 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:08.896375895 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:08.944120884 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.173783064 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.173808098 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.173831940 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.173846960 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.173885107 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.173934937 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:09.173984051 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.174036980 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.174062014 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.174068928 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:09.174093962 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:09.174405098 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:09.187504053 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:09.187505007 CEST	49740	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:09.187537909 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:09.187560081 CEST	443	49740	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:10.222446918 CEST	49746	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.345284939 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:10.413733006 CEST	80	49746	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:10.413877010 CEST	49746	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.414011955 CEST	49746	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.414448977 CEST	49748	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.538783073 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:10.538862944 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:10.539063931 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:10.605247974 CEST	80	49746	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:10.605295897 CEST	49746	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.606400013 CEST	80	49748	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:10.606475115 CEST	49748	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.606586933 CEST	49748	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.732450008 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:10.732640982 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:10.732692957 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:10.798561096 CEST	80	49748	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:10.807017088 CEST	80	49748	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:10.807038069 CEST	80	49748	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:10.807054996 CEST	80	49748	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:10.807142019 CEST	49748	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.808428049 CEST	49748	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:10.813590050 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:10.814582109 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.003706932 CEST	80	49748	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:11.005981922 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.006059885 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.006257057 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.007163048 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.007227898 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.008987904 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.197586060 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.197640896 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.197662115 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.197690010 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.197712898 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.199506998 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205442905 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205483913 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205517054 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205554962 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205575943 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205579042 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205607891 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205609083 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205638885 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205657959 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205698013 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205698013 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205724001 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205744982 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205775023 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205792904 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205801964 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205811024 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.205840111 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.205861092 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.391519070 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.391563892 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.391590118 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.391598940 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.391599894 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.391645908 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.392597914 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.398998976 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399063110 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399065971 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399104118 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399108887 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399143934 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399178982 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399218082 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399224043 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399262905 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399292946 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399332047 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399333954 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399372101 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399389982 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399430037 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399437904 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399476051 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399482965 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399514914 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399518013 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399549961 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.399557114 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.399590969 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.400043964 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.584120035 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584168911 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584187031 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.584206104 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584211111 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.584245920 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584291935 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.584300041 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584336996 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584342957 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.584374905 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584381104 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.584414005 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584420919 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.584455013 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.584497929 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593442917 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593497992 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593533993 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593586922 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593595028 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593626976 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593631983 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593667030 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593698025 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593735933 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593745947 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593775034 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593796015 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593812943 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593822956 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593849897 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593852997 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593888044 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593904972 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593924046 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593928099 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593961000 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.593974113 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593997002 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.593998909 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594036102 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594065905 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594088078 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594090939 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594140053 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594147921 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594177008 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594203949 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594213009 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594222069 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594249010 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594264984 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594285965 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594297886 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594324112 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594326019 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594361067 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594363928 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594398022 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594408035 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594434977 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594438076 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594471931 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594471931 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594507933 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594516039 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594544888 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594548941 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594583035 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594590902 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594619036 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594631910 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594656944 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594659090 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594698906 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594700098 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594737053 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.594743967 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.594778061 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.775806904 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.775852919 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.775861025 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.775891066 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.775940895 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.775995016 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776041985 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776070118 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776120901 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776139021 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776156902 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776158094 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776175976 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776185036 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776204109 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776216984 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776258945 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776293039 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776310921 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776333094 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776339054 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776359081 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776380062 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776420116 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776437998 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776454926 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776460886 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776474953 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.776474953 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776490927 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.776510000 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.787031889 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.787091017 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.787471056 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790002108 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790095091 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790141106 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790184021 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790204048 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790251017 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790282011 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790302038 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790309906 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790327072 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790359974 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790360928 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790415049 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790457964 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790482998 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790514946 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790540934 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790560007 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790596008 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790611029 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790627956 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790671110 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790693998 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790735006 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790756941 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790790081 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790822983 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790834904 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790888071 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790930033 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.790956974 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.790994883 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791059017 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791100979 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791141987 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791163921 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791208982 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791249990 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791276932 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791310072 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791351080 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791368961 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791414022 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791434050 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791470051 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791496992 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791513920 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791554928 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791575909 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791593075 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791631937 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791673899 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791712999 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791877031 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791923046 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791970015 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.791970015 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.791987896 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.792025089 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.792067051 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.792109013 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.792126894 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.792144060 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.792181969 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.792243004 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793389082 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793406963 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793416977 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.793437004 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.793492079 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793545961 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793550968 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.793564081 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793607950 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.793627977 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793665886 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.793693066 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793725967 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793764114 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.793781996 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793915033 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793932915 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793951035 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793957949 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.793967962 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:24:11.793968916 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.793988943 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:11.794001102 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:24:16.182436943 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.182461023 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.182545900 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.183495045 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.183509111 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.413558960 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.413640976 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.418409109 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.418415070 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.418890953 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.458807945 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.504118919 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.623930931 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.624022961 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.624072075 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.624171019 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.624185085 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.624196053 CEST	49763	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.624201059 CEST	443	49763	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.675147057 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.675263882 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.675348997 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.675714016 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.675790071 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.899503946 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.899580956 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.909226894 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.909275055 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.909593105 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:16.911037922 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:16.952121973 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:17.117805004 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:17.117878914 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:17.117924929 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:17.118892908 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:17.118908882 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:17.118918896 CEST	49764	443	192.168.2.4	184.31.62.93
Apr 25, 2024 22:24:17.118923903 CEST	443	49764	184.31.62.93	192.168.2.4
Apr 25, 2024 22:24:21.172480106 CEST	49736	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:21.172621965 CEST	49737	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:35.888134003 CEST	49733	80	192.168.2.4	152.195.50.149
Apr 25, 2024 22:24:35.888279915 CEST	49730	80	192.168.2.4	152.195.50.149
Apr 25, 2024 22:24:35.888315916 CEST	49735	80	192.168.2.4	152.195.50.149
Apr 25, 2024 22:24:35.888437986 CEST	49732	80	192.168.2.4	152.195.50.149
Apr 25, 2024 22:24:35.997343063 CEST	80	49733	152.195.50.149	192.168.2.4
Apr 25, 2024 22:24:35.997395039 CEST	49733	80	192.168.2.4	152.195.50.149
Apr 25, 2024 22:24:35.997426987 CEST	80	49730	152.195.50.149	192.168.2.4
Apr 25, 2024 22:24:35.997477055 CEST	49730	80	192.168.2.4	152.195.50.149
Apr 25, 2024 22:24:35.997726917 CEST	80	49732	152.195.50.149	192.168.2.4
Apr 25, 2024 22:24:35.997769117 CEST	49732	80	192.168.2.4	152.195.50.149
Apr 25, 2024 22:24:35.998728991 CEST	80	49735	152.195.50.149	192.168.2.4
Apr 25, 2024 22:24:35.998775959 CEST	49735	80	192.168.2.4	152.195.50.149
Apr 25, 2024 22:24:46.459594011 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:46.459682941 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:46.459772110 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:46.460156918 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:46.460187912 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:46.903264046 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:46.903357029 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:46.905572891 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:46.905610085 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:46.906014919 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:46.914766073 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:46.960119009 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.320384026 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.320405960 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.320420980 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.320468903 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:47.320488930 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.320501089 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:47.320503950 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.320533991 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:47.320538998 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.320584059 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.320586920 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:47.320586920 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:47.320626020 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:47.324886084 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:47.324911118 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.324943066 CEST	49765	443	192.168.2.4	52.165.165.26
Apr 25, 2024 22:24:47.324955940 CEST	443	49765	52.165.165.26	192.168.2.4
Apr 25, 2024 22:24:47.990119934 CEST	49766	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.186058044 CEST	80	49766	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:48.186151028 CEST	49766	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.186327934 CEST	49766	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.186731100 CEST	49767	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.378168106 CEST	80	49767	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:48.378242970 CEST	49767	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.378374100 CEST	49767	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.382236958 CEST	80	49766	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:48.382515907 CEST	80	49766	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:48.383171082 CEST	49766	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.570034981 CEST	80	49767	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:48.579677105 CEST	80	49767	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:48.579694986 CEST	80	49767	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:48.579710960 CEST	80	49767	47.88.25.126	192.168.2.4
Apr 25, 2024 22:24:48.579787970 CEST	49767	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.579838991 CEST	49767	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.579904079 CEST	49767	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:24:48.771224022 CEST	80	49767	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:02.404642105 CEST	49723	80	192.168.2.4	23.40.205.34
Apr 25, 2024 22:25:02.404784918 CEST	49724	80	192.168.2.4	199.232.214.172
Apr 25, 2024 22:25:02.514031887 CEST	80	49724	199.232.214.172	192.168.2.4
Apr 25, 2024 22:25:02.514292002 CEST	80	49724	199.232.214.172	192.168.2.4
Apr 25, 2024 22:25:02.514378071 CEST	49724	80	192.168.2.4	199.232.214.172
Apr 25, 2024 22:25:02.514405012 CEST	80	49723	23.40.205.34	192.168.2.4
Apr 25, 2024 22:25:02.514470100 CEST	49723	80	192.168.2.4	23.40.205.34
Apr 25, 2024 22:25:14.955744982 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:14.959099054 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:14.959132910 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:14.960892916 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.072041988 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.072057009 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.262948990 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.430871010 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.430957079 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.489115953 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.489161015 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.489568949 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.489630938 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.490489960 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.490535021 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.490995884 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.491008997 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.824486971 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.824579954 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.825050116 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.825099945 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.825115919 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:15.825176954 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:15.872325897 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:17.075464010 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:19.575459957 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:21.583657980 CEST	80	49749	47.254.51.125	192.168.2.4
Apr 25, 2024 22:25:21.583731890 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:25:21.594628096 CEST	80	49747	47.254.51.125	192.168.2.4
Apr 25, 2024 22:25:21.594698906 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:25:24.576322079 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:25.173651934 CEST	49770	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:25.367503881 CEST	80	49770	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:25.369069099 CEST	49770	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:25.369321108 CEST	49770	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:25.563090086 CEST	80	49770	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:25.572705030 CEST	80	49770	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:25.669228077 CEST	49770	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:34.184832096 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:43.774549007 CEST	49769	443	192.168.2.4	173.222.162.32
Apr 25, 2024 22:25:43.774615049 CEST	443	49769	173.222.162.32	192.168.2.4
Apr 25, 2024 22:25:57.094711065 CEST	49770	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.351115942 CEST	49772	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.546742916 CEST	80	49772	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:57.546935081 CEST	49772	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.547039986 CEST	49772	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.547338963 CEST	49773	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.735855103 CEST	80	49773	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:57.738264084 CEST	49773	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.738380909 CEST	49773	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.742501974 CEST	80	49772	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:57.744267941 CEST	49772	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.926924944 CEST	80	49773	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:57.937685013 CEST	80	49773	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:57.937721014 CEST	80	49773	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:57.937732935 CEST	80	49773	47.88.25.126	192.168.2.4
Apr 25, 2024 22:25:57.937789917 CEST	49773	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:57.937911987 CEST	49773	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:25:58.126302958 CEST	80	49773	47.88.25.126	192.168.2.4
Apr 25, 2024 22:26:00.060004950 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:00.060022116 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:00.387953997 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:00.434812069 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:01.044188023 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:01.174335957 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:02.345191956 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:02.638780117 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:02.957753897 CEST	49777	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:26:02.960230112 CEST	49778	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:26:03.149951935 CEST	80	49778	47.88.25.126	192.168.2.4
Apr 25, 2024 22:26:03.150067091 CEST	49778	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:26:03.150357008 CEST	49778	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:26:03.150407076 CEST	80	49777	47.88.25.126	192.168.2.4
Apr 25, 2024 22:26:03.150520086 CEST	49777	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:26:03.338699102 CEST	80	49778	47.88.25.126	192.168.2.4
Apr 25, 2024 22:26:03.358092070 CEST	80	49778	47.88.25.126	192.168.2.4
Apr 25, 2024 22:26:03.396507025 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.396588087 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.396682024 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.396912098 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.396946907 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.402734041 CEST	49778	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:26:03.638370991 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.643381119 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.643409014 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.643939018 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.644040108 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.644942045 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.645057917 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.645076036 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.647227049 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.647355080 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.647392988 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.688141108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.702018023 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.702032089 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.748483896 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.854429007 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.856614113 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.856700897 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.856724024 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.860526085 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.860682964 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.860697985 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.868427038 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.868490934 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.868505001 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.875946045 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.876007080 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.876019955 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.883733988 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.883795023 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.883806944 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.891422033 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.891485929 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.891513109 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.898999929 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.899070978 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.899084091 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.906734943 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.906805992 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.906817913 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.952167034 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.952191114 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.964651108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.964715958 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.964730978 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.968215942 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.968286037 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.968314886 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.975826979 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.975893021 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.975914955 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.983584881 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.983648062 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.983661890 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.991178989 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.991256952 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.991316080 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.998903036 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:03.998965025 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:03.998982906 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.006781101 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.006839991 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.006851912 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.014252901 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.014333963 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.014348030 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.022010088 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.022072077 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.022084951 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.029952049 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.030082941 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.030095100 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.037384987 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.037446022 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.037462950 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.044504881 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.044585943 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.044598103 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.051109076 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.051203012 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.051229954 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.057753086 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.057821035 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.057836056 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.064430952 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.064500093 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.064512968 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.071017981 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.071146965 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.071158886 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.078170061 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.078247070 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.078262091 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.084305048 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.084389925 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.084404945 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.090879917 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.090931892 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.090945005 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.095130920 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.095202923 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.095216036 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.101232052 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.101303101 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.101317883 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.101347923 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.101418018 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.105238914 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.109201908 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.109260082 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.109272957 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.112896919 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.112968922 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.112982035 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.116878986 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.116955042 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.116960049 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.117000103 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.117067099 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.120764017 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.124676943 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.124758005 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.124771118 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.124788046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.124862909 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.128494024 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.132287979 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.132383108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.132441998 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.132456064 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.132605076 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.136253119 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.141257048 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.141401052 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.141464949 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.141479969 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.141653061 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.143699884 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.147659063 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.147712946 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.147741079 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.149525881 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.149586916 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.149600029 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.153362989 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.153419018 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.153431892 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.157084942 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.157140970 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.157152891 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.160948992 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.161012888 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.161025047 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.164729118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.164784908 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.164797068 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.168487072 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.168553114 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.168565035 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.172311068 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.172394037 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.172406912 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.176084042 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.176155090 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.176167011 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.179631948 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.179688931 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.179699898 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.183285952 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.183379889 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.183397055 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.186937094 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.187036991 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.187048912 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.190161943 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.190217018 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.190232038 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.195266008 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.195327044 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.195338964 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.198664904 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.198745966 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.198787928 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.198816061 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.198884010 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.202102900 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.205440998 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.205493927 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.205504894 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.208647013 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.208714008 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.208724976 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.211095095 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.211150885 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.211162090 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.213606119 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.213668108 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.213680029 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.216056108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.216150999 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.216178894 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.216192007 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.216428041 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.218936920 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.222409010 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.222480059 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.222542048 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.222554922 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.222811937 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.223565102 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.225871086 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.225927114 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.225939035 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.229125023 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.229180098 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.229192019 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.231290102 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.231373072 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.231380939 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.231425047 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.231486082 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.233549118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.235707998 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.235769033 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.235793114 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.235831976 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.235934019 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.237871885 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.239981890 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.240066051 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.240066051 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.240087032 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.240154982 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.242055893 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.244139910 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.244195938 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.244209051 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.246166945 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.246251106 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.246306896 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.246319056 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.246726990 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.248222113 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.250190020 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.250247002 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.250258923 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.252351999 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.252412081 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.252425909 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.254287004 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.254348040 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.254362106 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.255112886 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.255168915 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.255182028 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.257031918 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.257086039 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.257100105 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.259047985 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.259104013 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.259116888 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.260855913 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.261044979 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.261059046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.262809992 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.262867928 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.262881041 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.264589071 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.264647007 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.264668941 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.266331911 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.266388893 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.266402006 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.268147945 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.268205881 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.268219948 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.269829988 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.269881964 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.269910097 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.271574020 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.271631002 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.271646023 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.273304939 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.273365974 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.273380041 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.274925947 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.274986029 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.274998903 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.277604103 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.277749062 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.277806044 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.277822971 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.277918100 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.279095888 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.280649900 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.280706882 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.280720949 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.282228947 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.282290936 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.282304049 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.283823013 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.283900976 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.283967018 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.283998966 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.285512924 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.285540104 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.285552979 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.285700083 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.287070036 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.288595915 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.288661957 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.288675070 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.288702965 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.288754940 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.290241957 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.291812897 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.291884899 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.291893005 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.291914940 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.291974068 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.293262959 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.294833899 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.294914007 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.294919014 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.294940948 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.294991016 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.296324015 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.297205925 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.297270060 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.297283888 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.298738956 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.300189972 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.300270081 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.300271988 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.300295115 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.300364017 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.301614046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.301681995 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.301697969 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.303210974 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.303668022 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.303680897 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.304626942 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.304696083 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.304708958 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.306008101 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.306082964 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.306096077 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.307522058 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.307589054 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.307601929 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.308890104 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.308959007 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.308971882 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.310342073 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.310401917 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.310415030 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.311767101 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.311835051 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.311849117 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.313168049 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.313430071 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.313466072 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.315268993 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.315326929 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.315339088 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.316690922 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.316741943 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.316755056 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.318016052 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.318077087 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.318089008 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.319572926 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.319628000 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.319641113 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.320756912 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.320818901 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.320832968 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.322202921 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.322283983 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.322338104 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.322351933 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.322429895 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.323514938 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.324856043 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.324914932 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.324928999 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.326129913 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.326191902 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.326205969 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.327514887 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.327570915 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.327584028 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.328722954 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.328773975 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.328788042 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.329999924 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.330051899 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.330065012 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.331279039 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.331336975 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.331350088 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.332026005 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.332192898 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.332206011 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.333328962 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.333384991 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.333398104 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.334497929 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.334553957 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.334568024 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.335815907 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.335875988 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.335889101 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.337018013 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.337078094 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.337090969 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.338282108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.338406086 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.338418961 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.339509010 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.339566946 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.339581966 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.340615988 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.340760946 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.340774059 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.341851950 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.341923952 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.341938019 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.342972994 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.343029022 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.343056917 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.344163895 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.344222069 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.344234943 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.345303059 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.345417023 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.345428944 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.346946955 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.346995115 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.347008944 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.348093987 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.348273993 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.348330975 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.348345995 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.348407030 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.349272013 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.350372076 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.350431919 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.350444078 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.351484060 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.351558924 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.351572037 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.352737904 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.352817059 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.352817059 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.352840900 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.353318930 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.353668928 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.354777098 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.354854107 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.354902029 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.354916096 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.354998112 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.355945110 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.356950045 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.357006073 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.357019901 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.358287096 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.358367920 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.358370066 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.358407021 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.358468056 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.359064102 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.360183954 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.360244036 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.360256910 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.360743046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.360801935 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.360815048 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.361989021 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.362116098 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.362128973 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.362843037 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.362898111 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.362910986 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.363886118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.363951921 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.363965034 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.364926100 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.365042925 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.365070105 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.365941048 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.366048098 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.366061926 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.367006063 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.367068052 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.367080927 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.368032932 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.368129015 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.368140936 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.369127989 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.369180918 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.369194031 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.370023012 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.370081902 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.370095015 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.371015072 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.371072054 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.371085882 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.372052908 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.372140884 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.372154951 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.372997046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.373075962 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.373089075 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.373924971 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.374103069 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.374115944 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.374942064 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.375117064 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.375130892 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.375978947 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.376089096 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.376116991 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.376847029 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.376900911 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.376916885 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.377747059 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.377819061 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.377831936 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.378823042 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.378878117 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.378891945 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.379662991 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.379719019 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.379730940 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.380707026 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.380763054 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.380775928 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.381617069 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.381987095 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.381999969 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.382551908 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.382711887 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.382725000 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.383474112 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.383527994 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.383542061 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.384387970 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.384458065 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.384474039 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.385317087 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.385479927 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.385492086 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.386157990 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.386210918 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.386224031 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.387123108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.387181044 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.387193918 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.387949944 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.388006926 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.388020039 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.388850927 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.388907909 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.388921022 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.389736891 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.389815092 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.389827967 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.390624046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.390853882 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.390866995 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.391544104 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.391602039 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.391616106 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.392326117 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.392384052 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.392396927 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.393160105 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.393233061 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.393245935 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.394088984 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.394145012 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.394159079 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.394999027 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.395055056 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.395068884 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.395728111 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.395781994 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.395797014 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.397327900 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.397399902 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.397413969 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.398092985 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.398150921 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.398164034 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.398956060 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.399013042 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.399025917 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.399739027 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.399796009 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.399810076 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.400502920 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.400573015 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.400582075 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.400604010 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.400655985 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.401375055 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.402100086 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.402148962 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.402162075 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.402931929 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.403004885 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.403019905 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.403697968 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.403773069 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.403774023 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.403794050 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.403840065 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.404459000 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.405241013 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.405318975 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.405349016 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.405364037 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.405603886 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.406004906 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.406805038 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.406883001 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.406887054 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.406908989 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.406956911 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.406984091 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.407596111 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.407658100 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.407670975 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.408351898 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.408418894 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.408432961 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.409215927 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.409281015 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.409295082 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.409888983 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.409953117 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.409965992 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.410702944 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.410764933 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.410778046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.411446095 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.411503077 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.411515951 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.412164927 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.412225008 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.412239075 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.412849903 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.412909031 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.412921906 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.413589954 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.413646936 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.413660049 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.414397955 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.414462090 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.414474964 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.415110111 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.415214062 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.415227890 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.415796995 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.415857077 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.415869951 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.416517019 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.416574955 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.416589022 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.417257071 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.417452097 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.417467117 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.418004036 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.418073893 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.418087959 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.418654919 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.418715954 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.418730021 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.419384956 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.419562101 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.419574976 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.420092106 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.420147896 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.420161963 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.420838118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.420905113 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.420918941 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.421566963 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.421636105 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.421648979 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.422231913 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.422348976 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.422363043 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.422872066 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.422924995 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.422938108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.423572063 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.423799038 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.423811913 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.424257040 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.424319029 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.424333096 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.424885035 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.424945116 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.424959898 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.425565958 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.425632954 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.425647020 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.426235914 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.426299095 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.426312923 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.426917076 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.426979065 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.426991940 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.427572012 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.427642107 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.427654982 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.428257942 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.428314924 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.428328991 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.428934097 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.428982019 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.428994894 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.429786921 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.429869890 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.429898977 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.429913998 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.429970980 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.429984093 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.430932045 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.430994987 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.431008101 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.431783915 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.431843042 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.431855917 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.431936026 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.431992054 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.432004929 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.432867050 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.432926893 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.432940960 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.433613062 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.433674097 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.433686972 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.433777094 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.433859110 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.433872938 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.434639931 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.434720993 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.434735060 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.435538054 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.435620070 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.435672998 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.435688019 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.435823917 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.435836077 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.436506033 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.436562061 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.436575890 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.437124968 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.437186956 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.437201023 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.438020945 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.438103914 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.438139915 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.438154936 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.438222885 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.438235998 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.439012051 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.439085960 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.439090014 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.439111948 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.439157009 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.439882040 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.440022945 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.440078974 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.440093040 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.440788031 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.440840006 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.440853119 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.441595078 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.441651106 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.441664934 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.441750050 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.441823006 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.441836119 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.442570925 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.442650080 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.442681074 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.442693949 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.442740917 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.443408966 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.443557024 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.443613052 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.443627119 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.444382906 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.444462061 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.444519043 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.444534063 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.444644928 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.445302963 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.445444107 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.445501089 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.445516109 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.446167946 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.446239948 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.446254015 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.446966887 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.447047949 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.447057009 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.447072983 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.447161913 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.447175026 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.447952032 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.448012114 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.448045015 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.448775053 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.448843002 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.448858023 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.448935032 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.449026108 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.449038029 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.449642897 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.449697018 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.449708939 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.450500011 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.450582027 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.450608015 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.450622082 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.450673103 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.450685978 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.451585054 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.451643944 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.451657057 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.452240944 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.452327967 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.452366114 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.452394009 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.452874899 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.452888966 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.453135014 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.453214884 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.453227997 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.453243971 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.453295946 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.453957081 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.454097033 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.454153061 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.454166889 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.454849958 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.454921007 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.454935074 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.455748081 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.455810070 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.455821991 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.455964088 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.456021070 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.456032991 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.456782103 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.456873894 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.456928015 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.456943035 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.457011938 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.457194090 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.457336903 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.457393885 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.457406998 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.458431959 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.458466053 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.458518028 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.458534002 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.458597898 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.458848953 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.458910942 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.459048033 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.459063053 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.459727049 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.459759951 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.459789038 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.459804058 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.459860086 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.460542917 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.460633993 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.460731983 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.460745096 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.461328983 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.461366892 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.461385965 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.461400986 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.461452961 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.462204933 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.462270975 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.462349892 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.462363005 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.463042974 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.463080883 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.463093996 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.463109016 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.463293076 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.463783026 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.463875055 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.463926077 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.463941097 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.464698076 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.464734077 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.464778900 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.464792013 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.464848995 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.465377092 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.465657949 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.465719938 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.465733051 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.466335058 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.466368914 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.466420889 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.466434002 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.466496944 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.466917038 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.466963053 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.467168093 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.467180967 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.467778921 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.467808962 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.467828035 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.467843056 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.467891932 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.468509912 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.468563080 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.468667984 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.468681097 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.469234943 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.469319105 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.469331980 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.470063925 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.470093012 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.470141888 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.470156908 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.470314026 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.470741987 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.470793962 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.470843077 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.470855951 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.471642971 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.471673965 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.471720934 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.471735001 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.471791029 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.472296953 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.472373009 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.472559929 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.472573042 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.473093987 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.473134995 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.473145008 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.473159075 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.473249912 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.473762035 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.473809958 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.473856926 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.473869085 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.474631071 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.474675894 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.474684954 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.474698067 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.474756956 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.475317001 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.475378036 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.475450993 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.475462914 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.476130962 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.476187944 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.476193905 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.476207972 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.476258039 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.476841927 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.476902962 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.476958036 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.476980925 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.477596045 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.477633953 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.477648020 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.477659941 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.477822065 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.478257895 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.478353977 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.478414059 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.478426933 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.479031086 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.479070902 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.479083061 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.479096889 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.479175091 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.479718924 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.479803085 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.479855061 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.479866982 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.480516911 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.480555058 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.480571032 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.480586052 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.480655909 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.480669022 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.481498003 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.481580019 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.481585026 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.481600046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.481654882 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.481667995 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.482455969 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.482511044 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.482522011 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.482534885 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.482594013 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.482605934 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.483511925 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.483576059 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.483628035 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.483627081 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.483639002 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.483681917 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.484251976 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.484317064 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.484332085 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.484380960 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.484441042 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.484453917 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.485377073 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.485501051 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.485513926 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.485558033 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.485637903 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.485650063 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.486284018 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.486323118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.486355066 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.486356020 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.486367941 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.486418962 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.487170935 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.487235069 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.487267017 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.487283945 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.487304926 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.487327099 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.488183975 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.488226891 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.488260031 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.488280058 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.488301992 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.488326073 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.488972902 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.489021063 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.489033937 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.489079952 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.489147902 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.489164114 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.489890099 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.489919901 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.489948034 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.489960909 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.490010977 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.490024090 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.491415977 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.491453886 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.491468906 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.491482019 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.491643906 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.491694927 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.491708040 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.491767883 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.491985083 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.492290974 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.492341995 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.492355108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.492818117 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.492855072 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.492903948 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.492908955 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.492921114 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.492964029 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.492976904 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.493077040 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.493735075 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.493788004 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.493839979 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.493846893 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.493855953 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.493896961 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.494621992 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.494713068 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.494748116 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.494795084 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.494810104 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.495012045 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.495520115 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.495600939 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.495686054 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.495697975 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.495713949 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.495764971 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.496400118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.496606112 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.496642113 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.496659040 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.496673107 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.496923923 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.497399092 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.497477055 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.497530937 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.497543097 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.498102903 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.498158932 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.498172045 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.498286009 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.498318911 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.498337984 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.498353004 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.498403072 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.498954058 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.499098063 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.499144077 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.499156952 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.499820948 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.499860048 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.499862909 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.499876022 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.499941111 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.499942064 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.499954939 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.500005960 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.500808954 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.500865936 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.500909090 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.500922918 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.501564026 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.501610041 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.501621008 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.501635075 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.501735926 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.501748085 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.502336025 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.502388000 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.502399921 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.502505064 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.502557039 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.502569914 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504220009 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504256964 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504270077 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.504285097 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504333019 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.504345894 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504421949 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504448891 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504466057 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.504478931 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504517078 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.504528999 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504853010 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504890919 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504897118 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.504911900 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.504966021 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.504978895 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.505697012 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.505749941 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.505762100 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.505893946 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.505953074 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.505968094 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.506525993 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.506582975 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.506614923 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.506632090 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.506654024 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.506676912 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.507360935 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.507389069 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.507417917 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.507431984 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.507509947 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.507523060 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.508110046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.508142948 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.508164883 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.508179903 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.508230925 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.508245945 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.508965969 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.508995056 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.509020090 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.509026051 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.509037018 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.509083986 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.509721041 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.509773970 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.509788990 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.509906054 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.509987116 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.509999990 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.510656118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.510689974 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.510726929 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.510730982 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.510746002 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.510780096 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.511451006 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.511498928 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.511507988 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.511521101 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.511564970 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.511576891 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.512250900 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.512285948 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.512295961 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.512309074 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.512350082 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.512749910 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.512805939 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.512875080 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.512880087 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.512893915 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.512936115 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.513564110 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.513652086 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.513711929 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.513725042 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.514329910 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.514358997 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.514389038 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.514389992 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.514405012 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.514457941 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.514477968 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.514527082 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.515144110 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.515197039 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.515240908 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.515254021 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.515928030 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.515964031 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.515974998 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.515989065 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.516071081 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.516077042 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.516091108 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.516149044 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.516730070 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.516839981 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.516891956 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.516904116 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.516951084 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.517035961 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.517049074 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.517801046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.517831087 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.517858982 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.517863035 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.517875910 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.517923117 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.518695116 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.518799067 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.518810034 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.518855095 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.518879890 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.518925905 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.518939972 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.518990040 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.519613981 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.519745111 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.519772053 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.519798040 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.519800901 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.519814968 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.519865036 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.520641088 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.520699024 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.520703077 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.520714045 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.520775080 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.520787954 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.521615028 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.521658897 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.521692038 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.521692991 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.521707058 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.521749973 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.521755934 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.521765947 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.521797895 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.522669077 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.522696972 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.522725105 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.522738934 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.522810936 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.525005102 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.525015116 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.525044918 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.525067091 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.525088072 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.525113106 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.525134087 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.527849913 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.527867079 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.527925014 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.527937889 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.527966022 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.527987003 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.529472113 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.529485941 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.529553890 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.529568911 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.529686928 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.532027960 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.532044888 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.532095909 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.532128096 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.532186985 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.533869982 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.533889055 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.533929110 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.533941984 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.533967972 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.533987999 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.536479950 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.536495924 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.536556005 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.536569118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.536637068 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.538921118 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.538938046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.538980007 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.538991928 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.539035082 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.539058924 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.540735960 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.540754080 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.540817976 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.540832043 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.540915012 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.542583942 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.542608976 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.542648077 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.542660952 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.542690039 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.542711973 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.545023918 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.545047045 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.545079947 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.545092106 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.545120001 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.545161963 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.546977043 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.546998024 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.547040939 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.547053099 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.547095060 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.547095060 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.549047947 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.549065113 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.549127102 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.549140930 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.549196005 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.550998926 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.551014900 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.551075935 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.551095963 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.551265955 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.552800894 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.552818060 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.552870035 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.552884102 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.552912951 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.552952051 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.554775953 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.554796934 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.554838896 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.554851055 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.554877996 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.555042982 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.556835890 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.556860924 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.556900024 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.556912899 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.556941032 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.556961060 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.558659077 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.558676004 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.558728933 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.558742046 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.558828115 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.560487986 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.560512066 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.560569048 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.560587883 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.560616970 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.561320066 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.562165022 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.562191963 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.562243938 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.562294006 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.562326908 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.562355042 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.564292908 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.564316988 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.564388037 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.564404964 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.564512014 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.566478014 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.566534042 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.566554070 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.566569090 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.566606045 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.566606998 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.568145037 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.568236113 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.568245888 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.568278074 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.568311930 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.568335056 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.569947004 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.570017099 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.570034027 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.570056915 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.570094109 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.570113897 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.571654081 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.571701050 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.571729898 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.571742058 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.571769953 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.571788073 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.573760033 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.573776960 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.573833942 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.573848009 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.573879957 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.573908091 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.575073957 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.575088978 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.575136900 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.575174093 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.575197935 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.575216055 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.576855898 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.576869965 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.576915979 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.576936007 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.576961994 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.576997995 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.578056097 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.578069925 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.578125000 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.578144073 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.578171015 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.578187943 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.579888105 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.579901934 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.579946995 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.579968929 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.579992056 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.580028057 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.581659079 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.581672907 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.581726074 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.581743956 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.581796885 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.583292007 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.583308935 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.583389044 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.583404064 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.583769083 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.584547043 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.584594011 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.584616899 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.584630966 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.584657907 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.584661007 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.584712982 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.584884882 CEST	49779	443	192.168.2.4	173.194.219.132
Apr 25, 2024 22:26:04.584929943 CEST	443	49779	173.194.219.132	192.168.2.4
Apr 25, 2024 22:26:04.949083090 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:05.570219994 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:05.698405027 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:05.698431969 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:05.698515892 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:05.699135065 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:05.699146986 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.126264095 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.129776955 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.129791021 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.131910086 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.131989002 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.134192944 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.134282112 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.134351969 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.177582026 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.177588940 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.223690033 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.606113911 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606151104 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606163025 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606194019 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.606204033 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606211901 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606220007 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606225014 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.606237888 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.606260061 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.606266022 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606316090 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.606321096 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606357098 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.606398106 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.614139080 CEST	49809	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.614149094 CEST	443	49809	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.766592979 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.766633987 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.767184019 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.767400980 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:06.767425060 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:06.880551100 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:06.880564928 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:06.880619049 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:06.880762100 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:06.880775928 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:07.051563025 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:07.051584005 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:07.051659107 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:07.051891088 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:07.051913023 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:07.093244076 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.093255997 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.093427896 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.093655109 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.093662977 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.187839985 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.188105106 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.188112974 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.189215899 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.189543009 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.189671040 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.189676046 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.189713001 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.230503082 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.289880037 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:07.290472984 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:07.290502071 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:07.292222977 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:07.292290926 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:07.295401096 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:07.295490980 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:07.341242075 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:07.341249943 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:07.389513016 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:07.564755917 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:07.564785957 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:07.564971924 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:07.565210104 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:07.565236092 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:07.623887062 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:07.623918056 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:07.623995066 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:07.624942064 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:07.624968052 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:07.768415928 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.768467903 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.768487930 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.768522978 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.768528938 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.768544912 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.768579960 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.768594027 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.768599033 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.768657923 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.768657923 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.776442051 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:07.779417038 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:07.779422998 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:07.781173944 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:07.781236887 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:07.784218073 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.785146952 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:07.785229921 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:07.785342932 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.785353899 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.785456896 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:07.785464048 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:07.787414074 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.787487030 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.791868925 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.791964054 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.791994095 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.832138062 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.832283020 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:07.867130995 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.867187023 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.867345095 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.867345095 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.867362022 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.870244026 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.893290997 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.893306017 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.952009916 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.952060938 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.952203989 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.952203989 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.952217102 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:07.954236031 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:07.981281042 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.981890917 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.982237101 CEST	49843	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:07.982253075 CEST	443	49843	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:07.991585016 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:07.991878033 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:07.991904974 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:07.992280960 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:07.992350101 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:07.992986917 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:07.993047953 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:07.993839025 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:07.993911028 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:07.993968010 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:08.007752895 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:08.007781029 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:08.007857084 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:08.007864952 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:08.007896900 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:08.008364916 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:08.008372068 CEST	443	49837	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:08.008395910 CEST	49837	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:08.036139965 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.039567947 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.039613962 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.039644003 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.039653063 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.039669037 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.039688110 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.041392088 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:08.041408062 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.092705011 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.092775106 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.092910051 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.092910051 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.092925072 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.092947006 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:08.092984915 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.154038906 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.154056072 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.154131889 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.154140949 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.154191017 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.201621056 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.201646090 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.201719999 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.201733112 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.201773882 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.202740908 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.202814102 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:08.202893972 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.203114033 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.203145981 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:08.247982979 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.248001099 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.248070955 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.248081923 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.248126984 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.275902033 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.275917053 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.275984049 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.275991917 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.276034117 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.306540012 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.306555033 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.306602955 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.306611061 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.306651115 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.331352949 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.331367016 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.331444025 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.331451893 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.331489086 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.355880976 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.355921030 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.355983973 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:08.356008053 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.358223915 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.358244896 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.358283997 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.358290911 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.358309984 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.358325958 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.360277891 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.360352039 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:08.360368967 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.365459919 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.365521908 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:08.365580082 CEST	49854	443	192.168.2.4	142.250.105.138
Apr 25, 2024 22:26:08.365606070 CEST	443	49854	142.250.105.138	192.168.2.4
Apr 25, 2024 22:26:08.380251884 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.380274057 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.380347013 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.380369902 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.380383968 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.380404949 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.401478052 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.401499033 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.401556969 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.401578903 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.401766062 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.401766062 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.425556898 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.425578117 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.425755024 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.425770044 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.425811052 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.444356918 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.444376945 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.444415092 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.444426060 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.444453001 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.444474936 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.465198040 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.465224981 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.465281010 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.465292931 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.465317965 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.465338945 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.481631994 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.481652021 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.481700897 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.481712103 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.481735945 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.481755972 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.499600887 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.499619961 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.499769926 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.499769926 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.499784946 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.500288010 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.514174938 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.514194965 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.514269114 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.514300108 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.514348984 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.527841091 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.527862072 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.527920008 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.527929068 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.528075933 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.528075933 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.543051004 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.543068886 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.543246984 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.543277979 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.543329954 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.555203915 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.555222988 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.555273056 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.555282116 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.555334091 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.568837881 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.568861961 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.569015980 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.569024086 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.569070101 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.579972029 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.579992056 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.580071926 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.580084085 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.580099106 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.581808090 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.592406988 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.592427015 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.592500925 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.592509985 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.592556000 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.594124079 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.594187975 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.594194889 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.594208956 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.594244003 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.594382048 CEST	49832	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:08.594389915 CEST	443	49832	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:08.725099087 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:08.734219074 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:08.734242916 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:08.735280991 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:08.735348940 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:08.736176014 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:08.736249924 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:08.736382961 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:08.736396074 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:08.780848980 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:08.788064003 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:08.788386106 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.788429022 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:08.791990042 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:08.792074919 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.792361021 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.792479992 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.792493105 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:08.792542934 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:08.984724045 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:08.984812021 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.985400915 CEST	49866	443	192.168.2.4	47.254.50.103
Apr 25, 2024 22:26:08.985414982 CEST	443	49866	47.254.50.103	192.168.2.4
Apr 25, 2024 22:26:09.080341101 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.080409050 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.080490112 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.081418037 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.081445932 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.243315935 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.243366003 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.243434906 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.244354963 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.244381905 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.244452000 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.244559050 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.244585037 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.244689941 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.244704962 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.265724897 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.265738964 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.265788078 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.266057014 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.266069889 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.278485060 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.278506041 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.278558016 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.278781891 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.278794050 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.308479071 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.308520079 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.308593035 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.309972048 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.309999943 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.349507093 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.349719048 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.349730015 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.351154089 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.351459026 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.357166052 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.357328892 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.357507944 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:09.357542992 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:09.357614040 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:09.358062029 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:09.358088970 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:09.358146906 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.358163118 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.370182991 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370239973 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370259047 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370299101 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370306015 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.370352030 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370378971 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370408058 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.370408058 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.370409012 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.370443106 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.370614052 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370661020 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370682955 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.370697021 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.370724916 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.481723070 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.481842995 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.495084047 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.495110989 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.495239973 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.495265961 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.498869896 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.498966932 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.499219894 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.499304056 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.510910988 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.511328936 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.511670113 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.511697054 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.511874914 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.512069941 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.512510061 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.512537003 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.520215988 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.520380020 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.520392895 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.522216082 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.522273064 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.523596048 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.523679972 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.523753881 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.523758888 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.530092955 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.530711889 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.530725002 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.532191038 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.532255888 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.533030033 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.533128977 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.533211946 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.533217907 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.538247108 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.564193010 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.564281940 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.570988894 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.571016073 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.593893051 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.593904018 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.596219063 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.605829000 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.605885029 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.605927944 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.605962038 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.605989933 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.606009960 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.606059074 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.626477003 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.626528978 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.626559973 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.626574993 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.626604080 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.626625061 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.654987097 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.655009985 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.658824921 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.658874035 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.658885956 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.659845114 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.660039902 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.660196066 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.660214901 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.686337948 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.686364889 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.686402082 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.686431885 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.686444998 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.686583996 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.686595917 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.686646938 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.700645924 CEST	49852	443	192.168.2.4	47.243.241.30
Apr 25, 2024 22:26:09.700673103 CEST	443	49852	47.243.241.30	192.168.2.4
Apr 25, 2024 22:26:09.709748983 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.709805012 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.709825993 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.709842920 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.709870100 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.709883928 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.709909916 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.709917068 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.709947109 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.709953070 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.709981918 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.710001945 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.721189976 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.721239090 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.721281052 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.721297026 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.721324921 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.721344948 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.728177071 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.728224039 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.728261948 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.728276968 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.728311062 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.728331089 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.734915018 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.735006094 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.735023022 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.735155106 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.735209942 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.765875101 CEST	49882	443	192.168.2.4	18.165.98.11
Apr 25, 2024 22:26:09.765904903 CEST	443	49882	18.165.98.11	192.168.2.4
Apr 25, 2024 22:26:09.774621010 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:09.774668932 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:09.775031090 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.775095940 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:09.775294065 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:09.775324106 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:09.775616884 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.775660992 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.779680967 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.805129051 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.805274010 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.805304050 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.805327892 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.805480957 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.819829941 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:09.819852114 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:09.819931984 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:09.820118904 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:09.820128918 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:09.823858023 CEST	49887	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:09.823889017 CEST	443	49887	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:09.826668978 CEST	49889	443	192.168.2.4	108.138.85.117
Apr 25, 2024 22:26:09.826677084 CEST	443	49889	108.138.85.117	192.168.2.4
Apr 25, 2024 22:26:09.844058990 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.844269991 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.844448090 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.844516039 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.844542980 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.844702959 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.847685099 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.851650000 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.852236986 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.852253914 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.854768991 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.854911089 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.854970932 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.854980946 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.855120897 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.855173111 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.855179071 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.855309963 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.855415106 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.855458975 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.855463982 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.855623960 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:09.855665922 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:09.859405994 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.860301018 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.860321999 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.867038965 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.868448973 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.868463039 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.874675989 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.874805927 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.874821901 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.953973055 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.954046965 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.954240084 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.954262972 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.954319000 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.957703114 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.965409040 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.965491056 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.965684891 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.965702057 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.965847015 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.973149061 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.980837107 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.980926991 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.980992079 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.981009960 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.981163979 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.988559008 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.996196032 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:09.996279001 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:09.996294022 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:10.003859997 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:10.004329920 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:10.004344940 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:10.004498005 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.011018991 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:10.012231112 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:10.012244940 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:10.018203020 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:10.018405914 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:10.018476963 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:10.019382000 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.034889936 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.034915924 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.034934998 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.034976959 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.034997940 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.035068035 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.035068035 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.035068035 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.035121918 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.035166025 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.035212040 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.035212040 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.053251982 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.053304911 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.053349972 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.053365946 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.053394079 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.058664083 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.129739046 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.129813910 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.129836082 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.129859924 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.132232904 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.132783890 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.132848978 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.132863045 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.132958889 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.136657953 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.176485062 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.180360079 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.194111109 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.194159031 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.194242954 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.194509983 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.194538116 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.194684982 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.194708109 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.194722891 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.194772959 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.194952011 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.194957972 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.195182085 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.195195913 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.195553064 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.195604086 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.195883036 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:10.195910931 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.195940971 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:10.196038008 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:10.196118116 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.196130991 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.196250916 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.196264982 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.196368933 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.196384907 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.196392059 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.196412086 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.196439028 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.196505070 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.196536064 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.196623087 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:10.196652889 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:10.197578907 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.197683096 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.197771072 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.197798014 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.198946953 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.198985100 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.199029922 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.199120998 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:10.202893972 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.203082085 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.203087091 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.208848953 CEST	49891	443	192.168.2.4	35.186.249.72
Apr 25, 2024 22:26:10.208873987 CEST	443	49891	35.186.249.72	192.168.2.4
Apr 25, 2024 22:26:10.241061926 CEST	49890	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:10.241074085 CEST	443	49890	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:10.243057966 CEST	49886	443	192.168.2.4	3.163.101.90
Apr 25, 2024 22:26:10.243088961 CEST	443	49886	3.163.101.90	192.168.2.4
Apr 25, 2024 22:26:10.248123884 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.279393911 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.280698061 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.280711889 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.317269087 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.317456961 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.317528009 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.317538977 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.317591906 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.317598104 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.332119942 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.332182884 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.332206011 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.332257032 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.332290888 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.332328081 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.332501888 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.332501888 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.332539082 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.332571983 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.332629919 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.336002111 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.339894056 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.340415955 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.340431929 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.342053890 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:10.344584942 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:10.344628096 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:10.344832897 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.345488071 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:10.345570087 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:10.346491098 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:10.346493006 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.346507072 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.346548080 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:10.346685886 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:10.346702099 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:10.352554083 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.352647066 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.352660894 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.352945089 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.352989912 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.353048086 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.353388071 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.353415012 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.360274076 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.360301018 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.360369921 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.360384941 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.360455990 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.368025064 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.426737070 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.426763058 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.426825047 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.426847935 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.426851034 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.426873922 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.426889896 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.426902056 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.426908970 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.426929951 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.426948071 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.437809944 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.442373991 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.443604946 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.443614960 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.443646908 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.443686962 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.445455074 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.445527077 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.446166039 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.446218014 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.446234941 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.446362972 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.446459055 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.446532011 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.446537971 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.453043938 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.453442097 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.453455925 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.453807116 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.453875065 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.453890085 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.454952955 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.455013037 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.456665993 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.456746101 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.456988096 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.456994057 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.461586952 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.461679935 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.461695910 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.469000101 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.469033957 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.469049931 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.469053984 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.469074965 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.469098091 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.469099045 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.469116926 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.469141960 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.469146013 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.469158888 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.469161034 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.469208956 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.469379902 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.469425917 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.469439983 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.471383095 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:10.477022886 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.477088928 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.477102995 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.484755993 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.485027075 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.485040903 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.492542982 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.492826939 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.492840052 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.499305964 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.501123905 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.501137972 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.506253958 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.508584976 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.508599043 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.513073921 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.513127089 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.513190031 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.513205051 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.513222933 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:10.513257027 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.513283014 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:10.520082951 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.520136118 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.520165920 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.520181894 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.520205975 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.520211935 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.520236015 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.520240068 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.520275116 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.559071064 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.559117079 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.559144974 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.559149981 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.559180021 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.559199095 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.563905001 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.563963890 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.571963072 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.575581074 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:10.583374977 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.584213018 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.593805075 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.593868971 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.593878984 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.593899012 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.593940020 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.594697952 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.623447895 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.623502016 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.623533010 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.623538971 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.623564005 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.648441076 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.648598909 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:10.650356054 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.650412083 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.650434971 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:10.650434971 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.650458097 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.650470018 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.669127941 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.669168949 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.669194937 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.669203043 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.669233084 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.669244051 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.671425104 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.671485901 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.675283909 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:10.675303936 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:10.675357103 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:10.675393105 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:10.675452948 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:10.683625937 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.683701038 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.683701038 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.683738947 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.683765888 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.698995113 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.699157953 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:10.699218988 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:10.700051069 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.700093985 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.700122118 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.700144053 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.700166941 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.713176012 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.713218927 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.713269949 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.713275909 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.713294983 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.725934029 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.725995064 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.726003885 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.726022959 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.726052046 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.726444960 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.730118036 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.730179071 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.730185986 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.730222940 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.740219116 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.740297079 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.740298986 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.740331888 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.740359068 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.740371943 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.745701075 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.750051022 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.750101089 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.750124931 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.750133038 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.750159979 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.750171900 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.750178099 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.750190020 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:10.750231028 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:10.775410891 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.775413990 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.775423050 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:10.806396961 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:10.952204943 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:10.952313900 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.232345104 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.232420921 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.232458115 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.232511044 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.233908892 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.233942986 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.234029055 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:11.234060049 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:11.234141111 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.234174013 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:11.234215021 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.234330893 CEST	49892	443	192.168.2.4	104.248.96.70
Apr 25, 2024 22:26:11.234364033 CEST	443	49892	104.248.96.70	192.168.2.4
Apr 25, 2024 22:26:11.235208035 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.235219955 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.235285997 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.235655069 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:11.235671043 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:11.235707045 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:11.236468077 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.236510038 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.236548901 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.236639023 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.236694098 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.237042904 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:11.237147093 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:11.238034010 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.238060951 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.238085985 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.238101006 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.238159895 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.238251925 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:11.238281965 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:11.238394976 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.238415956 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.239074945 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.239264011 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.240030050 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.240255117 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.240552902 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.240628004 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.240654945 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.240679979 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.240695953 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.240741968 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.240752935 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.240787029 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.249264956 CEST	49893	443	192.168.2.4	34.102.147.248
Apr 25, 2024 22:26:11.249298096 CEST	443	49893	34.102.147.248	192.168.2.4
Apr 25, 2024 22:26:11.267465115 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:11.267492056 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:11.267549992 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:11.267841101 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:11.267848969 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:11.271802902 CEST	49897	443	192.168.2.4	18.165.98.69
Apr 25, 2024 22:26:11.271817923 CEST	443	49897	18.165.98.69	192.168.2.4
Apr 25, 2024 22:26:11.273104906 CEST	49896	443	192.168.2.4	18.244.202.7
Apr 25, 2024 22:26:11.273118973 CEST	443	49896	18.244.202.7	192.168.2.4
Apr 25, 2024 22:26:11.276402950 CEST	49894	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:11.276407957 CEST	443	49894	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:11.282406092 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.282423019 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:11.282423973 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.284157991 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.298377991 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.298386097 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.363034964 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:11.363143921 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.363149881 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:11.363204002 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:11.363225937 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.363296986 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.365464926 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.365667105 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.365719080 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.366472006 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.366571903 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.366626024 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.367502928 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.367567062 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.506413937 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:11.611887932 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:11.611964941 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:11.612047911 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:11.612648964 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:11.612684011 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:11.679919958 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:11.709471941 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:11.709480047 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:11.709844112 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:11.710119963 CEST	49901	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.710141897 CEST	443	49901	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.710450888 CEST	49895	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.710458040 CEST	443	49895	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.710771084 CEST	49903	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.710791111 CEST	443	49903	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.711020947 CEST	49898	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:11.711077929 CEST	443	49898	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:11.711446047 CEST	49899	443	192.168.2.4	52.72.78.243
Apr 25, 2024 22:26:11.711452961 CEST	443	49899	52.72.78.243	192.168.2.4
Apr 25, 2024 22:26:11.712865114 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:11.713016987 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:11.793380022 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:11.954423904 CEST	49909	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:11.954452038 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:11.954524994 CEST	49909	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:11.960238934 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:11.960268974 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:11.960325956 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:11.961298943 CEST	49909	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:11.961313009 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:11.961453915 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:11.963072062 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:11.963087082 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:11.978231907 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:11.978254080 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:11.978326082 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:11.978491068 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:11.978509903 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:11.979841948 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:11.979850054 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:11.979902983 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:11.980057955 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:11.980071068 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.008114100 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.020391941 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.021068096 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.021127939 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.022592068 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.022669077 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.023906946 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.024041891 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.024050951 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.068114996 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.093790054 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.093873024 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.093955994 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.094129086 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.094163895 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.111927032 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.111939907 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.111998081 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.112195015 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.112207890 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.113555908 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.113641024 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.113708973 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.113884926 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.113924026 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.121117115 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.121150017 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.121196985 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.121601105 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.121613979 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.145109892 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.145164967 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.145241022 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.145325899 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.145349026 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.145411968 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.145497084 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.145512104 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.145565987 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.145687103 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.145711899 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.145808935 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.145840883 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.145925999 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.145940065 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.158720970 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.158740997 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.158818007 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.158966064 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.158991098 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.168023109 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.168112040 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.168328047 CEST	49908	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.168354034 CEST	443	49908	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.194864988 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.200002909 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.205038071 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:12.205059052 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.205168962 CEST	49909	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.205176115 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.206651926 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.206727982 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:12.206773043 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.207600117 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.208456993 CEST	49909	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.208643913 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.209398031 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:12.209501982 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.209599018 CEST	49909	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.209654093 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:12.209661961 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.212014914 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.212141991 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.212158918 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.212481976 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.212490082 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.213017941 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.213176012 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.213422060 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.213505983 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.213526011 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.213993073 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.214140892 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.214276075 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.243449926 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.243470907 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.243477106 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.243499041 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.243511915 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.243519068 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.243532896 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.243540049 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.243571043 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.243593931 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.252161980 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.256136894 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.260114908 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.283691883 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:12.284353971 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.336410046 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.336622000 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.336663008 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.338335037 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.338419914 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.338953018 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.338982105 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.339046001 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.339225054 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.339248896 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.339328051 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.339425087 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.339438915 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.343019962 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.343210936 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.343275070 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.345153093 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.345226049 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.345475912 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.345561981 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.345566034 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.362936020 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.363086939 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.363107920 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.363993883 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.364054918 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.364310026 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.364373922 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.364444017 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.364461899 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.373169899 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.373361111 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.373368025 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.376879930 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.376938105 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.377211094 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.377304077 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.377309084 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.377370119 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.380158901 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.392116070 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.395520926 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.395538092 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.401962042 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.402138948 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.402183056 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.405924082 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.406004906 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.406267881 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.406356096 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.406368017 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.406446934 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.414757967 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.414813042 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.414863110 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:12.414871931 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.414961100 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.415011883 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:12.415301085 CEST	49910	443	192.168.2.4	216.137.45.128
Apr 25, 2024 22:26:12.415309906 CEST	443	49910	216.137.45.128	192.168.2.4
Apr 25, 2024 22:26:12.454721928 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.454771042 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.454823017 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.454855919 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.454871893 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.454895020 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.454911947 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.454933882 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.454972982 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.474740982 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.474757910 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.474805117 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.506757021 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.506764889 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.506793976 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.506800890 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.506802082 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.529627085 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.530019045 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.531856060 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.531896114 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.532027006 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.532085896 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.535514116 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.535533905 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.535546064 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.535577059 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.535583019 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.535626888 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.535628080 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.535630941 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.535692930 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.536158085 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.536331892 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.536360025 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.536542892 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.536869049 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.536891937 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.536933899 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.536952019 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.542830944 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.543066978 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.543091059 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.546657085 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.546751976 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.547034979 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.547146082 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.547164917 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.547218084 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.549282074 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.549463034 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.549511909 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.550079107 CEST	49911	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.550093889 CEST	443	49911	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.562141895 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.562220097 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.563016891 CEST	49915	443	192.168.2.4	18.244.202.78
Apr 25, 2024 22:26:12.563054085 CEST	443	49915	18.244.202.78	192.168.2.4
Apr 25, 2024 22:26:12.568461895 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.568665981 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.568751097 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.569211006 CEST	49913	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:12.569237947 CEST	443	49913	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:12.571242094 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.571301937 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.571419001 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.571530104 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.571567059 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.571574926 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.571619987 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.571660995 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.571674109 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.571697950 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.571742058 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.571748018 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.578953981 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.579014063 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.579020977 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.586617947 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.586658955 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.586666107 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.586702108 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.586740017 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.586746931 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.594705105 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.594754934 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.594763041 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.594785929 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.594826937 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.594834089 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.601950884 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.602000952 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.602006912 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.607584000 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.607798100 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.607842922 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.609577894 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.609644890 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.609694958 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.610207081 CEST	49914	443	192.168.2.4	18.165.98.71
Apr 25, 2024 22:26:12.610220909 CEST	443	49914	18.165.98.71	192.168.2.4
Apr 25, 2024 22:26:12.611392021 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.611465931 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.611902952 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.612044096 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.612065077 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.612082005 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.618434906 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.618449926 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.618484020 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.618489027 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.618513107 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.618542910 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.620822906 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.620877028 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.622127056 CEST	49916	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.622133970 CEST	443	49916	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.636754036 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.636900902 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.636946917 CEST	49909	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.637861013 CEST	49909	443	192.168.2.4	172.67.22.39
Apr 25, 2024 22:26:12.637871981 CEST	443	49909	172.67.22.39	192.168.2.4
Apr 25, 2024 22:26:12.653055906 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.653120041 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.654572964 CEST	49921	443	192.168.2.4	3.218.217.33
Apr 25, 2024 22:26:12.654592037 CEST	443	49921	3.218.217.33	192.168.2.4
Apr 25, 2024 22:26:12.664088011 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.664160967 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.664758921 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:12.664805889 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:12.664868116 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:12.664882898 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.664932013 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.665456057 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:12.665488958 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:12.665632010 CEST	49919	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.665658951 CEST	443	49919	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.667459965 CEST	49920	443	192.168.2.4	52.0.201.85
Apr 25, 2024 22:26:12.667478085 CEST	443	49920	52.0.201.85	192.168.2.4
Apr 25, 2024 22:26:12.669540882 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.669564962 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.669619083 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.669722080 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.669742107 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.669780016 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.669960976 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.669974089 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.670116901 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.670128107 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.670633078 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.670650005 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.670717001 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.670722008 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.670761108 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.674346924 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.674402952 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.675671101 CEST	49922	443	192.168.2.4	34.199.45.162
Apr 25, 2024 22:26:12.675704956 CEST	443	49922	34.199.45.162	192.168.2.4
Apr 25, 2024 22:26:12.680947065 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.680989981 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.680999041 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.681047916 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.681085110 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.681092024 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.683365107 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:12.683396101 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:12.683459044 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:12.684144974 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:12.684170961 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:12.684926987 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.684971094 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.684978008 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.685012102 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.685050964 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.685058117 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.692374945 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.692423105 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.692431927 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.697757006 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.697783947 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.700023890 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.700089931 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.700115919 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.700145960 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.700184107 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.707690954 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.707740068 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.707772017 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.707833052 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.716245890 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.716300011 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.716331005 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.723068953 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.723114014 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.723121881 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.723169088 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.723208904 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.723216057 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.731333017 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.731380939 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.731388092 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.732538939 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.732557058 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.732616901 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.732616901 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.732623100 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.732652903 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.737725019 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.737775087 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.737782001 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.737827063 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.737870932 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.737878084 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.744843960 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.744900942 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.744908094 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.744936943 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.744971991 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.744978905 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.752650023 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.752707005 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.752713919 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.759414911 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.759462118 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.759468079 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.762851954 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.762913942 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.762922049 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.762943983 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.762979031 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.762984991 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.769850016 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.769897938 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.769905090 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.769933939 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.769972086 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.769984007 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.781444073 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.781459093 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.781502008 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.781506062 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.781524897 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.781543016 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.790532112 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.790580034 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.790590048 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.795186043 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.795234919 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.795241117 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.795301914 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.795340061 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.795345068 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.799566984 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.799623966 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.799629927 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.799654007 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.799690962 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.799698114 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.804291964 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.804338932 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.804348946 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.804569006 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.804621935 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.804675102 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.804929972 CEST	49912	443	192.168.2.4	31.13.65.7
Apr 25, 2024 22:26:12.804941893 CEST	443	49912	31.13.65.7	192.168.2.4
Apr 25, 2024 22:26:12.819863081 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.819912910 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.819925070 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.819930077 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.819957018 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.819969893 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.820007086 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.820275068 CEST	49904	443	192.168.2.4	89.187.167.3
Apr 25, 2024 22:26:12.820285082 CEST	443	49904	89.187.167.3	192.168.2.4
Apr 25, 2024 22:26:12.895653963 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.895838976 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.895915031 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.896423101 CEST	49925	443	192.168.2.4	3.131.76.57
Apr 25, 2024 22:26:12.896441936 CEST	443	49925	3.131.76.57	192.168.2.4
Apr 25, 2024 22:26:12.903247118 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.903403997 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.903500080 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.903520107 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.903594971 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.903609991 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.905052900 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.905124903 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.905437946 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.905514956 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.905597925 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.905603886 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.906090021 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.906158924 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.906467915 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.906579971 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.906584978 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.906694889 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:12.927583933 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:12.927809000 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:12.927830935 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:12.929049015 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:12.929104090 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:12.929155111 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:12.929183006 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:12.929183960 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:12.929238081 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:12.929399967 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:12.929414034 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:12.929507017 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:12.929537058 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:12.929563046 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:12.929567099 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:12.930433035 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:12.930568933 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:12.930568933 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:12.950489998 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:12.950508118 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:12.950567961 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:12.950719118 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:12.950727940 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:12.976120949 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:12.978754997 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.978807926 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:12.978816986 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:12.994765043 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:12.994771957 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:13.105170012 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:13.151928902 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.152134895 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.152151108 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.152465105 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.152731895 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.152791977 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.153036118 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.153095007 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.153712034 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.153786898 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.156452894 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.156514883 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.156522989 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.156590939 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.156629086 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.156636000 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.156759024 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.156778097 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.166763067 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.166850090 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.167886972 CEST	49930	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.167924881 CEST	443	49930	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.168648958 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.168669939 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.168729067 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.168878078 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.168888092 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.247138977 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:13.247370958 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:13.247435093 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:13.248199940 CEST	49928	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:13.248213053 CEST	443	49928	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:13.281217098 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.285722017 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:13.285840034 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:13.285898924 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:13.286617041 CEST	49929	443	192.168.2.4	104.22.48.169
Apr 25, 2024 22:26:13.286629915 CEST	443	49929	104.22.48.169	192.168.2.4
Apr 25, 2024 22:26:13.297175884 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.305454016 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.305675030 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.305695057 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.307137966 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.307199955 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.308058023 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.308155060 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.308192015 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.356125116 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.356457949 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.356681108 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.356692076 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.360204935 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.360297918 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.360558987 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.360661983 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.360666990 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.360722065 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.372078896 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.372111082 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.372200966 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.372672081 CEST	49932	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.372684002 CEST	443	49932	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.402014971 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.402451038 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.402458906 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.402925968 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.403177977 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.403254032 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.403278112 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.405359030 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.405365944 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.444150925 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.444972992 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.445031881 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.445102930 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.445101023 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.445143938 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.445197105 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.445210934 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.445234060 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.445281982 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.445847034 CEST	49931	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.445869923 CEST	443	49931	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.482382059 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.482388020 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.482418060 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.490400076 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.490444899 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.490519047 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.490695000 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.490724087 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.495066881 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.495085001 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.495136023 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.495292902 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.495331049 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.495398998 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.495490074 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.495502949 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.495620966 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.495660067 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.518374920 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.518485069 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.519021988 CEST	49927	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.519038916 CEST	443	49927	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.551394939 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.551424980 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.551501036 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.551661968 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.551707983 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.551767111 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.551848888 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.551894903 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.551975012 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.551995993 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.563065052 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.635920048 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.635941029 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.635992050 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.636172056 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:13.636183977 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:13.648724079 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.648927927 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.648978949 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.649759054 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.649765968 CEST	443	49935	35.244.154.8	192.168.2.4
Apr 25, 2024 22:26:13.649774075 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.649815083 CEST	49935	443	192.168.2.4	35.244.154.8
Apr 25, 2024 22:26:13.713990927 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.714258909 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.714284897 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.715260983 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.715329885 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.716209888 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.716276884 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.716384888 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.716399908 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.717864990 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.718031883 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.718044996 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.718900919 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.718955994 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.719219923 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.719276905 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.719321012 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.725696087 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.725887060 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.725904942 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.729434967 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.729511976 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.729780912 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.729883909 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.729895115 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.729950905 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.760162115 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.762430906 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:13.762449980 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:13.762634993 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:13.762932062 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:13.762943983 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:13.766324043 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.766374111 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.766426086 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.766441107 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.766515970 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.766562939 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.767111063 CEST	49933	443	192.168.2.4	89.187.167.4
Apr 25, 2024 22:26:13.767118931 CEST	443	49933	89.187.167.4	192.168.2.4
Apr 25, 2024 22:26:13.771667957 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.771682978 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.783346891 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.783586979 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.783648968 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.785089970 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.785203934 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.786042929 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.786135912 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.786237001 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.786258936 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.806528091 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.806529999 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.806554079 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.807514906 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.807720900 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.807795048 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.809250116 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.809318066 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.809587955 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.809674025 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.809688091 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.821732998 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.852152109 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.904328108 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.904407024 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.904485941 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.904690027 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.904721975 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.916234016 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.916243076 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.916317940 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.916560888 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.916572094 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.938143969 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.938201904 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.938580990 CEST	49939	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:13.938592911 CEST	443	49939	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:13.941930056 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.941998959 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.942050934 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.942780018 CEST	49938	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:13.942800045 CEST	443	49938	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:13.992198944 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:13.992423058 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:13.992434025 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:13.995961905 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:13.996022940 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:13.996114969 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:13.996172905 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.999098063 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:13.999116898 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.000403881 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.000569105 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.001081944 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.001091957 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.012581110 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:14.012718916 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:14.012784958 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:14.012830019 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:14.012943029 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:14.013001919 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:14.013017893 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:14.013134003 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:14.013185978 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:14.014482021 CEST	49940	443	192.168.2.4	31.13.65.36
Apr 25, 2024 22:26:14.014529943 CEST	443	49940	31.13.65.36	192.168.2.4
Apr 25, 2024 22:26:14.017946005 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.017991066 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.018064022 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.018505096 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.018534899 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.042228937 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.042303085 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.042351961 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.042359114 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.042382956 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.042424917 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.042438030 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.042488098 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.042527914 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.042537928 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.047003984 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.049758911 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.049791098 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.049830914 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.049844980 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.057492971 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.057585955 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.057605982 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.059521914 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.059561014 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.059632063 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.060425043 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.060441017 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.065479994 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.065546036 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.065560102 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.068614960 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:14.072210073 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.072218895 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:14.073156118 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:14.073218107 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.073592901 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.073642969 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:14.074032068 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.074038982 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:14.093312979 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.093470097 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.093614101 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.094218969 CEST	49942	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.094259977 CEST	443	49942	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.106705904 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.106720924 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.122159958 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.136461973 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.136728048 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.136751890 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.138094902 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.139091015 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.139230967 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.139242887 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.139318943 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.146629095 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.146814108 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.146821022 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.147928953 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.148408890 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.148520947 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.148525000 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.148578882 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.152173042 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.152268887 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.152304888 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.155994892 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.156088114 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.156095982 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.163708925 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.163775921 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.163789988 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.171466112 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.171528101 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.171541929 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.179172993 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.179241896 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.179584026 CEST	49941	443	192.168.2.4	173.194.219.154
Apr 25, 2024 22:26:14.179610014 CEST	443	49941	173.194.219.154	192.168.2.4
Apr 25, 2024 22:26:14.184705973 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.200689077 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.234252930 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.234349966 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.234450102 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.235307932 CEST	49944	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.235320091 CEST	443	49944	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.237181902 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.237199068 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.237273932 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.237746954 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.237754107 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.242249966 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.242434025 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.242453098 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.243331909 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.243407011 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.244168043 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.244236946 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.244333982 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.244349957 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.285407066 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.285604954 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.285614014 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.287028074 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.287095070 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.287354946 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.287432909 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.287458897 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.293793917 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.332112074 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.341063023 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.341078043 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.349980116 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.350055933 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.350131035 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.350430012 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.350460052 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.360430956 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.360640049 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.360702038 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.360990047 CEST	49945	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.361011982 CEST	443	49945	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.367013931 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.367038012 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.367105961 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.367259979 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.367275000 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.371599913 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.371762037 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.371819019 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.372051954 CEST	49947	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:14.372057915 CEST	443	49947	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:14.376754999 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.376777887 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.376841068 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.376979113 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.376991987 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.387964964 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.460958958 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.461170912 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.461184025 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.462203979 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.462264061 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.462560892 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.462609053 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.462683916 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.462691069 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.472141981 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.472201109 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.472263098 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.472323895 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.472414970 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.472461939 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.473071098 CEST	49949	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.473092079 CEST	443	49949	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.476181030 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:14.476198912 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:14.476257086 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:14.476429939 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:14.476439953 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:14.477478027 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.477520943 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.477593899 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.477601051 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.477682114 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.477739096 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.477905035 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.477921963 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.477968931 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478080988 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478131056 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.478187084 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478189945 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478197098 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.478247881 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478379011 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478423119 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.478507996 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478538990 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.478620052 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478631973 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.478739977 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478773117 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.478849888 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.478863955 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.500262976 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:14.500319004 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:14.500360966 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.500742912 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.500751019 CEST	443	49943	34.252.42.217	192.168.2.4
Apr 25, 2024 22:26:14.500760078 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.500790119 CEST	49943	443	192.168.2.4	34.252.42.217
Apr 25, 2024 22:26:14.511670113 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.511759043 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.511811972 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.512518883 CEST	49950	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.512533903 CEST	443	49950	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.512547016 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.580823898 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.583451986 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.583488941 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.587066889 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.587177038 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.587589025 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.587724924 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.587774038 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.597453117 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.600630045 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.600645065 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.601747036 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.601999998 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.602098942 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.602103949 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.602170944 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.609695911 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.609909058 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.609924078 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.611311913 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.611577988 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.611690998 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.611696005 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.611754894 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.635298014 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.635337114 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.650646925 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.665985107 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.681195021 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.687799931 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.687828064 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.687880993 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.687887907 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.688005924 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.688055038 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.691770077 CEST	49951	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:14.691778898 CEST	443	49951	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:14.696347952 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.696369886 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.696525097 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.696765900 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.696777105 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.706561089 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.706753969 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.706778049 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.708350897 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.708406925 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.708734035 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.708849907 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.708853960 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.708868980 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.709110022 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.709253073 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.709264040 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.710894108 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.710959911 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.711318970 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.711399078 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.711463928 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.711469889 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.715271950 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.715457916 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.715502977 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.715694904 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.715884924 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.715908051 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.715941906 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.716085911 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.716104031 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.717204094 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.717271090 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.717550039 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.717571020 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.717577934 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.717642069 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.717643023 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.717674971 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.717678070 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.717884064 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.717962027 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.718102932 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.718189001 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.718226910 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.718235016 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.718264103 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.718272924 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.759047031 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.759048939 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.760144949 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.762061119 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.762058973 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.762075901 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.762083054 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.762118101 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.806333065 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.807130098 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.822330952 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.822494030 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.822557926 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.823335886 CEST	49954	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.823353052 CEST	443	49954	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.829068899 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.829268932 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.831204891 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.831449986 CEST	49952	443	192.168.2.4	34.98.67.3
Apr 25, 2024 22:26:14.831479073 CEST	443	49952	34.98.67.3	192.168.2.4
Apr 25, 2024 22:26:14.833755016 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.833925009 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.834002018 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.834600925 CEST	49955	443	192.168.2.4	172.217.215.156
Apr 25, 2024 22:26:14.834609032 CEST	443	49955	172.217.215.156	192.168.2.4
Apr 25, 2024 22:26:14.918982983 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.925339937 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.925352097 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.926214933 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.926278114 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.926578999 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.926642895 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.926759005 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.944020987 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.944257975 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.944344044 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.944720984 CEST	49960	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.944780111 CEST	443	49960	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.946028948 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.946302891 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.946377993 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.947187901 CEST	49959	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.947197914 CEST	443	49959	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.968143940 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:14.977323055 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:14.977330923 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.023143053 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.045053959 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.045249939 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.048409939 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.048559904 CEST	49958	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.048590899 CEST	443	49958	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.059693098 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.059765100 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.059798002 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.059828997 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.059840918 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.059880018 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.060137987 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.060189962 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.060282946 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.060408115 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.060441971 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.060523987 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.060539961 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.060673952 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.060707092 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.062906027 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.063262939 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.063333035 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.063725948 CEST	49961	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.063733101 CEST	443	49961	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.065992117 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.066020012 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.066082954 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.066241980 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.066256046 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.138881922 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.139111042 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.139122009 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.140206099 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.140279055 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.141161919 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.141211033 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.141339064 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.147392035 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.147592068 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.147655964 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.150715113 CEST	49962	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.150722027 CEST	443	49962	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.151279926 CEST	49967	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:15.151298046 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.152245998 CEST	49967	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:15.152409077 CEST	49967	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:15.152421951 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.184150934 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.184158087 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.230725050 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.292093992 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.292375088 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.292387009 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.293519974 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.293814898 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.294275999 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.294308901 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.294635057 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.294702053 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.296051979 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.296140909 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.298593044 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.303788900 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.303952932 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.303994894 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.304013968 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.304569006 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.304718018 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.304749966 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.304872036 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.305099010 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.305130005 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.305147886 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.305160999 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.305466890 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.305526018 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.306000948 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.306082010 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.306257010 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.306262970 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.308466911 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.308533907 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.308912992 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.309004068 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.309050083 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.352145910 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.359666109 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.359683037 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.359688997 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.360004902 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.360024929 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.363970995 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.364063025 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.364113092 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.364578962 CEST	49956	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.364594936 CEST	443	49956	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.382705927 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.385426044 CEST	49967	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:15.385437012 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.385735035 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.386015892 CEST	49967	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:15.386073112 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.386132956 CEST	49967	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:15.394809008 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.395298004 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.395385027 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.395546913 CEST	49957	443	192.168.2.4	172.217.215.103
Apr 25, 2024 22:26:15.395580053 CEST	443	49957	172.217.215.103	192.168.2.4
Apr 25, 2024 22:26:15.403356075 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.406672955 CEST	49968	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.406698942 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.406774998 CEST	49968	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.406949043 CEST	49968	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.406965971 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.427340984 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.427421093 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.427512884 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.428179979 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.428234100 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.432112932 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.483761072 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.483793020 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.483848095 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.484045029 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.484057903 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.521651030 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.522353888 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.522619963 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.522826910 CEST	49964	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.522840977 CEST	443	49964	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.524084091 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.524291992 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.525454998 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.525537968 CEST	49965	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.525578022 CEST	443	49965	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.538707018 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.538737059 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.538808107 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.538985014 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.539021969 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.612648964 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.613387108 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.613501072 CEST	49967	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:15.620299101 CEST	49967	443	192.168.2.4	74.125.138.157
Apr 25, 2024 22:26:15.620318890 CEST	443	49967	74.125.138.157	192.168.2.4
Apr 25, 2024 22:26:15.632371902 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.632623911 CEST	49968	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.632644892 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.633152962 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.633424044 CEST	49968	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.633501053 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.633568048 CEST	49968	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.639925957 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.640185118 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.640256882 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.640947104 CEST	49963	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.640976906 CEST	443	49963	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.659502983 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.669188023 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.669225931 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.669601917 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.669984102 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.670053959 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.670299053 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.680119038 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.716113091 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.772876024 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.773178101 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.773225069 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.774043083 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.774209023 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.775048971 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.775115013 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.776268959 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.776360035 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.776484013 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.776501894 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.823446989 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.885238886 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.885452032 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.885529995 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.885618925 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.885618925 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.885662079 CEST	443	49969	172.217.215.154	192.168.2.4
Apr 25, 2024 22:26:15.885724068 CEST	49969	443	192.168.2.4	172.217.215.154
Apr 25, 2024 22:26:15.915807962 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.916043997 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.916122913 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.916532993 CEST	49966	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.916549921 CEST	443	49966	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.925280094 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.925496101 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.925514936 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.929145098 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.929212093 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.929516077 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.929687023 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.929730892 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.974095106 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:15.974123001 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:15.977545977 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.977901936 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.977962017 CEST	49968	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.978168964 CEST	49968	443	192.168.2.4	142.250.105.99
Apr 25, 2024 22:26:15.978184938 CEST	443	49968	142.250.105.99	192.168.2.4
Apr 25, 2024 22:26:15.995136976 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.995414019 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:15.995676994 CEST	443	49972	216.239.36.181	192.168.2.4
Apr 25, 2024 22:26:15.995748043 CEST	49972	443	192.168.2.4	216.239.36.181
Apr 25, 2024 22:26:16.020493031 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:16.403898954 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:16.404059887 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:16.404283047 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:16.404767990 CEST	49971	443	192.168.2.4	87.230.98.78
Apr 25, 2024 22:26:16.404784918 CEST	443	49971	87.230.98.78	192.168.2.4
Apr 25, 2024 22:26:17.277738094 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:17.277915955 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:17.280255079 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:18.832164049 CEST	49840	443	192.168.2.4	108.177.122.147
Apr 25, 2024 22:26:18.832191944 CEST	443	49840	108.177.122.147	192.168.2.4
Apr 25, 2024 22:26:20.605134964 CEST	49747	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:23.168168068 CEST	49749	80	192.168.2.4	47.254.51.125
Apr 25, 2024 22:26:48.152651072 CEST	49777	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:26:48.345037937 CEST	80	49777	47.88.25.126	192.168.2.4
Apr 25, 2024 22:26:48.371397018 CEST	49778	80	192.168.2.4	47.88.25.126
Apr 25, 2024 22:26:48.559874058 CEST	80	49778	47.88.25.126	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 22:23:49.631347895 CEST	51844	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:23:49.742855072 CEST	53	51844	1.1.1.1	192.168.2.4
Apr 25, 2024 22:24:10.074181080 CEST	60241	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:24:10.105724096 CEST	60267	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:24:10.340847015 CEST	53	60241	1.1.1.1	192.168.2.4
Apr 25, 2024 22:24:13.973155975 CEST	138	138	192.168.2.4	192.168.2.255
Apr 25, 2024 22:25:25.057447910 CEST	62885	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:25:25.168291092 CEST	53	62885	1.1.1.1	192.168.2.4
Apr 25, 2024 22:25:25.576735020 CEST	50922	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:02.642422915 CEST	55944	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:02.642838955 CEST	58449	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:02.753768921 CEST	53	52743	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:02.756504059 CEST	53	62049	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:02.881825924 CEST	53	58449	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:02.957019091 CEST	53	55944	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:03.284619093 CEST	65437	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:03.284774065 CEST	65524	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:03.360810995 CEST	54097	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:03.360977888 CEST	53682	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:03.394881964 CEST	53	65437	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:03.396065950 CEST	53	65524	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:04.122088909 CEST	55441	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:04.122236013 CEST	49735	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:04.239125013 CEST	53	56999	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:04.758615017 CEST	53	55560	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:05.015300989 CEST	52526	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:05.015629053 CEST	65480	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:05.571645021 CEST	65370	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:05.573679924 CEST	64465	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:05.573679924 CEST	55414	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:05.573935032 CEST	61132	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:05.684181929 CEST	53	55414	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:05.685520887 CEST	53	61132	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:06.766088009 CEST	62893	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:06.766248941 CEST	60740	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:06.845401049 CEST	63130	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:06.845540047 CEST	51904	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:06.876786947 CEST	53	60740	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:06.877428055 CEST	53	62893	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:06.916521072 CEST	54495	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:06.916690111 CEST	52662	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:06.957442999 CEST	53	59004	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.015203953 CEST	53	63130	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.026669025 CEST	53	54495	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.027291059 CEST	53	52662	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.116498947 CEST	53	51904	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.120611906 CEST	56662	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.120809078 CEST	60761	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.292011976 CEST	50573	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.292428970 CEST	64881	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.404373884 CEST	53	64881	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.511646986 CEST	55255	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.511864901 CEST	49896	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.535428047 CEST	64641	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.535603046 CEST	55536	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.562221050 CEST	53	50573	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.622350931 CEST	53	61056	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.622473001 CEST	53	55255	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.622752905 CEST	53	49896	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:07.987626076 CEST	60671	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:07.987751007 CEST	62577	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:08.165759087 CEST	53	60671	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:08.203003883 CEST	53	62577	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:08.967540979 CEST	55586	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:08.967672110 CEST	63248	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.079195023 CEST	53	55586	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.079927921 CEST	53	63248	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.130919933 CEST	52016	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.131047964 CEST	53427	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.152765036 CEST	62543	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.152889013 CEST	63161	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.163909912 CEST	59487	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.164022923 CEST	55291	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.196130037 CEST	52109	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.196265936 CEST	61584	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.242029905 CEST	53	53427	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.242111921 CEST	49331	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.242324114 CEST	60446	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.242862940 CEST	53	52016	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.262809992 CEST	53	63161	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.265300035 CEST	53	62543	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.275557995 CEST	53	59487	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.278151035 CEST	53	55291	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.306201935 CEST	53	61584	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.308144093 CEST	53	52109	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.352834940 CEST	53	60446	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.354773998 CEST	53	49331	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.661458969 CEST	49457	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.661604881 CEST	62642	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.699450016 CEST	61466	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.699574947 CEST	49777	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.765381098 CEST	54675	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.765520096 CEST	62883	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.771439075 CEST	53	49457	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.771589994 CEST	53	62642	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.776673079 CEST	50322	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.776803970 CEST	65463	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.810096979 CEST	53	61466	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.810209990 CEST	53	49777	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.822963953 CEST	61189	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.823095083 CEST	55266	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.823499918 CEST	63564	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.823606968 CEST	55346	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.868392944 CEST	58340	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.868614912 CEST	65274	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:09.887870073 CEST	53	50322	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.892498970 CEST	53	54675	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.897387981 CEST	53	62883	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.905771971 CEST	53	65463	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.932935953 CEST	53	55266	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.933532953 CEST	53	55346	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.933614016 CEST	53	63564	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.934160948 CEST	53	61189	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.993268967 CEST	53	65274	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:09.998990059 CEST	53	58340	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:10.204140902 CEST	51356	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:10.204246998 CEST	63620	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:10.240529060 CEST	65190	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:10.240658998 CEST	62547	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:10.328032017 CEST	53	63620	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:10.331654072 CEST	53	51356	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:10.351375103 CEST	53	62547	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:10.352329969 CEST	53	65190	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:11.288563013 CEST	62124	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:11.288702965 CEST	60833	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:11.399072886 CEST	53	60833	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:11.399561882 CEST	53	62124	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:11.712120056 CEST	58496	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:11.712397099 CEST	50136	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:11.822860003 CEST	53	50136	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:11.823124886 CEST	53	58496	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:11.978981972 CEST	56864	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:11.979099035 CEST	52201	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.000163078 CEST	63074	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.000298977 CEST	60491	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.000973940 CEST	61291	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.001085997 CEST	57192	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.008198977 CEST	52243	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.008348942 CEST	61383	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.009761095 CEST	52979	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.009916067 CEST	58679	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.011235952 CEST	53305	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.012193918 CEST	51927	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.014878988 CEST	59651	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.015021086 CEST	49418	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.016223907 CEST	61709	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.016422987 CEST	51582	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.089284897 CEST	53	56864	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.090590954 CEST	53	52201	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.110196114 CEST	53	63074	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.111612082 CEST	53	60491	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.112073898 CEST	53	57192	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.113159895 CEST	53	61291	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.120424986 CEST	53	52979	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.120872974 CEST	53	58679	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.122800112 CEST	53	51927	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.126282930 CEST	53	49418	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.127840042 CEST	53	61709	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.128052950 CEST	53	60577	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.138077974 CEST	53	61383	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.142213106 CEST	53	59651	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.142879963 CEST	53	51582	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.143333912 CEST	53	52243	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.158369064 CEST	53	53305	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.228262901 CEST	53483	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.228404999 CEST	50763	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.338164091 CEST	53	53483	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.338347912 CEST	53	50763	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.553510904 CEST	60446	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.553642035 CEST	58265	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.555424929 CEST	54264	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.555572987 CEST	59029	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.571608067 CEST	54493	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.571723938 CEST	61642	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.664298058 CEST	53	60446	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.664364100 CEST	53	58265	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.666203976 CEST	53	54264	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.667680979 CEST	53	59029	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.682347059 CEST	53	61642	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.682365894 CEST	53	54493	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.818068981 CEST	60581	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.818356037 CEST	49175	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.837208986 CEST	54530	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.837588072 CEST	60909	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:12.928023100 CEST	53	60581	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.928565979 CEST	53	49175	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.948278904 CEST	53	54530	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:12.949660063 CEST	53	60909	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.379765987 CEST	65431	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.379899979 CEST	54539	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.383430004 CEST	64472	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.383577108 CEST	54102	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.438811064 CEST	52266	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.438941956 CEST	63681	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.489870071 CEST	53	65431	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.489892006 CEST	53	54539	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.493607998 CEST	53	54102	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.494703054 CEST	53	64472	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.524343967 CEST	53309	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.524470091 CEST	57411	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.548676968 CEST	53	52266	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.550973892 CEST	53	63681	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.635091066 CEST	53	57411	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.635375023 CEST	53	53309	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.650409937 CEST	58708	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.650528908 CEST	53330	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.761028051 CEST	53	58708	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.762017012 CEST	53	53330	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:13.907321930 CEST	52342	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.907445908 CEST	64577	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.945977926 CEST	49175	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:13.946129084 CEST	54609	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:14.017312050 CEST	53	52342	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.017421007 CEST	53	64577	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.055913925 CEST	53	49175	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.056159973 CEST	53	54609	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.238101006 CEST	61799	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:14.238212109 CEST	64809	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:14.349447966 CEST	53	61799	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.349467039 CEST	53	64809	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.363564968 CEST	50675	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:14.363678932 CEST	65157	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:14.365566015 CEST	51829	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:14.365696907 CEST	62539	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:14.475727081 CEST	53	50675	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.475770950 CEST	53	65157	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.476823092 CEST	53	51829	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.477135897 CEST	53	62539	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:14.948599100 CEST	57860	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:14.948996067 CEST	60570	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:15.058545113 CEST	53	57860	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:15.058842897 CEST	53	60570	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:15.370456934 CEST	51338	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:15.370624065 CEST	57073	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:15.426544905 CEST	50937	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:15.426723957 CEST	53709	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:15.482042074 CEST	53	57073	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:15.482500076 CEST	53	51338	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:15.537863970 CEST	53	50937	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:15.538331032 CEST	53	53709	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:19.984086037 CEST	61734	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:22.076792955 CEST	53	62918	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:35.340434074 CEST	62740	53	192.168.2.4	1.1.1.1
Apr 25, 2024 22:26:39.109060049 CEST	53	55595	1.1.1.1	192.168.2.4
Apr 25, 2024 22:26:52.364967108 CEST	63078	53	192.168.2.4	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 25, 2024 22:26:07.116595984 CEST	192.168.2.4	1.1.1.1	c234	(Port unreachable)	Destination Unreachable
Apr 25, 2024 22:26:08.203064919 CEST	192.168.2.4	1.1.1.1	c234	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 22:23:49.631347895 CEST	192.168.2.4	1.1.1.1	0xe207	Standard query (0)	platform.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:24:10.074181080 CEST	192.168.2.4	1.1.1.1	0x9653	Standard query (0)	dlinst.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:24:10.105724096 CEST	192.168.2.4	1.1.1.1	0x2c80	Standard query (0)	download.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:25:25.057447910 CEST	192.168.2.4	1.1.1.1	0x386d	Standard query (0)	cbs.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:25:25.576735020 CEST	192.168.2.4	1.1.1.1	0x8f66	Standard query (0)	www.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:02.642422915 CEST	192.168.2.4	1.1.1.1	0x5693	Standard query (0)	cbs.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:02.642838955 CEST	192.168.2.4	1.1.1.1	0x96d6	Standard query (0)	cbs.wondershare.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:03.284619093 CEST	192.168.2.4	1.1.1.1	0x2d43	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:03.284774065 CEST	192.168.2.4	1.1.1.1	0x579b	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:03.360810995 CEST	192.168.2.4	1.1.1.1	0xd306	Standard query (0)	www.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:03.360977888 CEST	192.168.2.4	1.1.1.1	0xfe76	Standard query (0)	www.wondershare.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:04.122088909 CEST	192.168.2.4	1.1.1.1	0x57df	Standard query (0)	images.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:04.122236013 CEST	192.168.2.4	1.1.1.1	0x40ca	Standard query (0)	images.wondershare.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:05.015300989 CEST	192.168.2.4	1.1.1.1	0x3ba	Standard query (0)	images.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:05.015629053 CEST	192.168.2.4	1.1.1.1	0x476b	Standard query (0)	images.wondershare.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:05.571645021 CEST	192.168.2.4	1.1.1.1	0x2742	Standard query (0)	script.crazyegg.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:05.573679924 CEST	192.168.2.4	1.1.1.1	0x51ce	Standard query (0)	script.crazyegg.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:05.573679924 CEST	192.168.2.4	1.1.1.1	0x52b0	Standard query (0)	cdn.consentmanager.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:05.573935032 CEST	192.168.2.4	1.1.1.1	0x8b40	Standard query (0)	cdn.consentmanager.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:06.766088009 CEST	192.168.2.4	1.1.1.1	0xef47	Standard query (0)	delivery.consentmanager.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:06.766248941 CEST	192.168.2.4	1.1.1.1	0x522d	Standard query (0)	delivery.consentmanager.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:06.845401049 CEST	192.168.2.4	1.1.1.1	0xf393	Standard query (0)	common-info.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:06.845540047 CEST	192.168.2.4	1.1.1.1	0x9d07	Standard query (0)	common-info.wondershare.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:06.916521072 CEST	192.168.2.4	1.1.1.1	0x547	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:06.916690111 CEST	192.168.2.4	1.1.1.1	0xac1e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:07.120611906 CEST	192.168.2.4	1.1.1.1	0x5ca3	Standard query (0)	script.crazyegg.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.120809078 CEST	192.168.2.4	1.1.1.1	0x414c	Standard query (0)	script.crazyegg.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:07.292011976 CEST	192.168.2.4	1.1.1.1	0x78cf	Standard query (0)	app.partnerboost.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.292428970 CEST	192.168.2.4	1.1.1.1	0x7e52	Standard query (0)	app.partnerboost.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:07.511646986 CEST	192.168.2.4	1.1.1.1	0x8899	Standard query (0)	chrome.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.511864901 CEST	192.168.2.4	1.1.1.1	0x62ae	Standard query (0)	chrome.google.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:07.535428047 CEST	192.168.2.4	1.1.1.1	0x8d8	Standard query (0)	www.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.535603046 CEST	192.168.2.4	1.1.1.1	0x310f	Standard query (0)	www.wondershare.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:07.987626076 CEST	192.168.2.4	1.1.1.1	0x938b	Standard query (0)	common-info.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.987751007 CEST	192.168.2.4	1.1.1.1	0x5ceb	Standard query (0)	common-info.wondershare.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:08.967540979 CEST	192.168.2.4	1.1.1.1	0x8f00	Standard query (0)	analytics.webgains.io	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:08.967672110 CEST	192.168.2.4	1.1.1.1	0x831	Standard query (0)	analytics.webgains.io	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.130919933 CEST	192.168.2.4	1.1.1.1	0xbed6	Standard query (0)	www.dwin1.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.131047964 CEST	192.168.2.4	1.1.1.1	0xcdab	Standard query (0)	www.dwin1.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.152765036 CEST	192.168.2.4	1.1.1.1	0x1b3a	Standard query (0)	cdn.avmws.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.152889013 CEST	192.168.2.4	1.1.1.1	0xafbe	Standard query (0)	cdn.avmws.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.163909912 CEST	192.168.2.4	1.1.1.1	0xfd0e	Standard query (0)	www.linkconnector.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.164022923 CEST	192.168.2.4	1.1.1.1	0x2a9c	Standard query (0)	www.linkconnector.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.196130037 CEST	192.168.2.4	1.1.1.1	0xd83b	Standard query (0)	utt.impactcdn.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.196265936 CEST	192.168.2.4	1.1.1.1	0xe7d6	Standard query (0)	utt.impactcdn.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.242111921 CEST	192.168.2.4	1.1.1.1	0x575f	Standard query (0)	trk.indoleads.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.242324114 CEST	192.168.2.4	1.1.1.1	0x3b9f	Standard query (0)	trk.indoleads.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.661458969 CEST	192.168.2.4	1.1.1.1	0x227	Standard query (0)	tag.rmp.rakuten.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.661604881 CEST	192.168.2.4	1.1.1.1	0xde04	Standard query (0)	tag.rmp.rakuten.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.699450016 CEST	192.168.2.4	1.1.1.1	0x3e7f	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.699574947 CEST	192.168.2.4	1.1.1.1	0x111a	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.765381098 CEST	192.168.2.4	1.1.1.1	0xfcf	Standard query (0)	z.asbmit.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.765520096 CEST	192.168.2.4	1.1.1.1	0x1399	Standard query (0)	z.asbmit.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.776673079 CEST	192.168.2.4	1.1.1.1	0xb877	Standard query (0)	ad.admitad.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.776803970 CEST	192.168.2.4	1.1.1.1	0xc937	Standard query (0)	ad.admitad.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.822963953 CEST	192.168.2.4	1.1.1.1	0xc841	Standard query (0)	pagestates-tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.823095083 CEST	192.168.2.4	1.1.1.1	0x1952	Standard query (0)	pagestates-tracking.crazyegg.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.823499918 CEST	192.168.2.4	1.1.1.1	0xdc62	Standard query (0)	assets-tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.823606968 CEST	192.168.2.4	1.1.1.1	0xfc4f	Standard query (0)	assets-tracking.crazyegg.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:09.868392944 CEST	192.168.2.4	1.1.1.1	0xcc4	Standard query (0)	lenkmio.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.868614912 CEST	192.168.2.4	1.1.1.1	0x6785	Standard query (0)	lenkmio.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:10.204140902 CEST	192.168.2.4	1.1.1.1	0x392e	Standard query (0)	pafutos.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:10.204246998 CEST	192.168.2.4	1.1.1.1	0x365c	Standard query (0)	pafutos.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:10.240529060 CEST	192.168.2.4	1.1.1.1	0xcb9b	Standard query (0)	tjzuh.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:10.240658998 CEST	192.168.2.4	1.1.1.1	0xf21d	Standard query (0)	tjzuh.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:11.288563013 CEST	192.168.2.4	1.1.1.1	0x21be	Standard query (0)	tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.288702965 CEST	192.168.2.4	1.1.1.1	0x5883	Standard query (0)	tracking.crazyegg.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:11.712120056 CEST	192.168.2.4	1.1.1.1	0x49b2	Standard query (0)	lantern.roeyecdn.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.712397099 CEST	192.168.2.4	1.1.1.1	0x7d07	Standard query (0)	lantern.roeyecdn.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:11.978981972 CEST	192.168.2.4	1.1.1.1	0x60ce	Standard query (0)	ut.rd.linksynergy.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.979099035 CEST	192.168.2.4	1.1.1.1	0x3c81	Standard query (0)	ut.rd.linksynergy.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.000163078 CEST	192.168.2.4	1.1.1.1	0xd9bd	Standard query (0)	pagestates-tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.000298977 CEST	192.168.2.4	1.1.1.1	0xf557	Standard query (0)	pagestates-tracking.crazyegg.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.000973940 CEST	192.168.2.4	1.1.1.1	0xe5e	Standard query (0)	assets-tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.001085997 CEST	192.168.2.4	1.1.1.1	0xd701	Standard query (0)	assets-tracking.crazyegg.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.008198977 CEST	192.168.2.4	1.1.1.1	0xe6a4	Standard query (0)	pafutos.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.008348942 CEST	192.168.2.4	1.1.1.1	0xfcc9	Standard query (0)	pafutos.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.009761095 CEST	192.168.2.4	1.1.1.1	0x4e8e	Standard query (0)	lenkmio.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.009916067 CEST	192.168.2.4	1.1.1.1	0x8865	Standard query (0)	lenkmio.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.011235952 CEST	192.168.2.4	1.1.1.1	0x4233	Standard query (0)	tjzuh.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.012193918 CEST	192.168.2.4	1.1.1.1	0x10e2	Standard query (0)	tjzuh.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.014878988 CEST	192.168.2.4	1.1.1.1	0xcbe1	Standard query (0)	z.asbmit.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.015021086 CEST	192.168.2.4	1.1.1.1	0x5128	Standard query (0)	z.asbmit.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.016223907 CEST	192.168.2.4	1.1.1.1	0x4f01	Standard query (0)	ad.admitad.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.016422987 CEST	192.168.2.4	1.1.1.1	0x71c2	Standard query (0)	ad.admitad.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.228262901 CEST	192.168.2.4	1.1.1.1	0xe57b	Standard query (0)	tracking.crazyegg.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.228404999 CEST	192.168.2.4	1.1.1.1	0x6f5f	Standard query (0)	tracking.crazyegg.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.553510904 CEST	192.168.2.4	1.1.1.1	0xc9c	Standard query (0)	lantern.roeye.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.553642035 CEST	192.168.2.4	1.1.1.1	0xdf6b	Standard query (0)	lantern.roeye.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.555424929 CEST	192.168.2.4	1.1.1.1	0x9974	Standard query (0)	www.linkconnector.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.555572987 CEST	192.168.2.4	1.1.1.1	0x84e3	Standard query (0)	www.linkconnector.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.571608067 CEST	192.168.2.4	1.1.1.1	0x94c5	Standard query (0)	idsync.rlcdn.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.571723938 CEST	192.168.2.4	1.1.1.1	0xe425	Standard query (0)	idsync.rlcdn.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.818068981 CEST	192.168.2.4	1.1.1.1	0xc18b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.818356037 CEST	192.168.2.4	1.1.1.1	0x4b68	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:12.837208986 CEST	192.168.2.4	1.1.1.1	0x54c3	Standard query (0)	cdn.consentmanager.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.837588072 CEST	192.168.2.4	1.1.1.1	0x62d3	Standard query (0)	cdn.consentmanager.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:13.379765987 CEST	192.168.2.4	1.1.1.1	0xbf03	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.379899979 CEST	192.168.2.4	1.1.1.1	0x1048	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:13.383430004 CEST	192.168.2.4	1.1.1.1	0x14ba	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.383577108 CEST	192.168.2.4	1.1.1.1	0x2a94	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:13.438811064 CEST	192.168.2.4	1.1.1.1	0x2d13	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.438941956 CEST	192.168.2.4	1.1.1.1	0xd1b3	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:13.524343967 CEST	192.168.2.4	1.1.1.1	0xa179	Standard query (0)	lantern.roeye.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.524470091 CEST	192.168.2.4	1.1.1.1	0x741c	Standard query (0)	lantern.roeye.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:13.650409937 CEST	192.168.2.4	1.1.1.1	0x456c	Standard query (0)	tags.rd.linksynergy.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.650528908 CEST	192.168.2.4	1.1.1.1	0x514a	Standard query (0)	tags.rd.linksynergy.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:13.907321930 CEST	192.168.2.4	1.1.1.1	0x7c16	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.907445908 CEST	192.168.2.4	1.1.1.1	0x7c6c	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:13.945977926 CEST	192.168.2.4	1.1.1.1	0x1e43	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.946129084 CEST	192.168.2.4	1.1.1.1	0xfe04	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:14.238101006 CEST	192.168.2.4	1.1.1.1	0x5111	Standard query (0)	tags.rd.linksynergy.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.238212109 CEST	192.168.2.4	1.1.1.1	0x904d	Standard query (0)	tags.rd.linksynergy.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:14.363564968 CEST	192.168.2.4	1.1.1.1	0x8ae3	Standard query (0)	b.delivery.consentmanager.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.363678932 CEST	192.168.2.4	1.1.1.1	0x3645	Standard query (0)	b.delivery.consentmanager.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:14.365566015 CEST	192.168.2.4	1.1.1.1	0xd07d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.365696907 CEST	192.168.2.4	1.1.1.1	0x3d7e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:14.948599100 CEST	192.168.2.4	1.1.1.1	0xa790	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.948996067 CEST	192.168.2.4	1.1.1.1	0x6a3c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:15.370456934 CEST	192.168.2.4	1.1.1.1	0xe4da	Standard query (0)	b.delivery.consentmanager.net	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.370624065 CEST	192.168.2.4	1.1.1.1	0x6bc2	Standard query (0)	b.delivery.consentmanager.net	65	IN (0x0001)	false
Apr 25, 2024 22:26:15.426544905 CEST	192.168.2.4	1.1.1.1	0xa32f	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.426723957 CEST	192.168.2.4	1.1.1.1	0xcd4	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Apr 25, 2024 22:26:19.984086037 CEST	192.168.2.4	1.1.1.1	0x50f9	Standard query (0)	www.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:35.340434074 CEST	192.168.2.4	1.1.1.1	0xbfb3	Standard query (0)	www.wondershare.com	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:52.364967108 CEST	192.168.2.4	1.1.1.1	0x41b1	Standard query (0)	www.wondershare.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 22:23:49.742855072 CEST	1.1.1.1	192.168.2.4	0xe207	No error (0)	platform.wondershare.com	gtm-cn-4590x3tmp01.gtm-a2b4.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:23:49.742855072 CEST	1.1.1.1	192.168.2.4	0xe207	No error (0)	gtm-cn-4590x3tmp01.gtm-a2b4.com		47.88.25.126	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:23:50.496942997 CEST	1.1.1.1	192.168.2.4	0x5f82	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:23:50.496942997 CEST	1.1.1.1	192.168.2.4	0x5f82	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:24:10.218858004 CEST	1.1.1.1	192.168.2.4	0x2c80	No error (0)	download.wondershare.com	wondershare.cn.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:24:10.340847015 CEST	1.1.1.1	192.168.2.4	0x9653	No error (0)	dlinst.wondershare.com	gtm-cn-4590x3tmp05.gtm-a2b4.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:24:10.340847015 CEST	1.1.1.1	192.168.2.4	0x9653	No error (0)	gtm-cn-4590x3tmp05.gtm-a2b4.com		47.254.51.125	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:25:09.311341047 CEST	1.1.1.1	192.168.2.4	0x4b78	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:25:09.311341047 CEST	1.1.1.1	192.168.2.4	0x4b78	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:25:25.168291092 CEST	1.1.1.1	192.168.2.4	0x386d	No error (0)	cbs.wondershare.com	gtm-cn-wwo31enga0c.gtm-a2b4.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:25:25.168291092 CEST	1.1.1.1	192.168.2.4	0x386d	No error (0)	gtm-cn-wwo31enga0c.gtm-a2b4.com		47.88.25.126	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:25:25.858886003 CEST	1.1.1.1	192.168.2.4	0x8f66	No error (0)	www.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:02.881825924 CEST	1.1.1.1	192.168.2.4	0x96d6	No error (0)	cbs.wondershare.com	gtm-cn-wwo31enga0c.gtm-a2b4.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:02.957019091 CEST	1.1.1.1	192.168.2.4	0x5693	No error (0)	cbs.wondershare.com	gtm-cn-wwo31enga0c.gtm-a2b4.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:02.957019091 CEST	1.1.1.1	192.168.2.4	0x5693	No error (0)	gtm-cn-wwo31enga0c.gtm-a2b4.com		47.88.25.126	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:03.394881964 CEST	1.1.1.1	192.168.2.4	0x2d43	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:03.394881964 CEST	1.1.1.1	192.168.2.4	0x2d43	No error (0)	googlehosted.l.googleusercontent.com		173.194.219.132	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:03.396065950 CEST	1.1.1.1	192.168.2.4	0x579b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:03.472598076 CEST	1.1.1.1	192.168.2.4	0xfe76	No error (0)	www.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:03.474766016 CEST	1.1.1.1	192.168.2.4	0xd306	No error (0)	www.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:04.233333111 CEST	1.1.1.1	192.168.2.4	0x40ca	No error (0)	images.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:04.233519077 CEST	1.1.1.1	192.168.2.4	0x57df	No error (0)	images.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:05.126846075 CEST	1.1.1.1	192.168.2.4	0x476b	No error (0)	images.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:05.405786037 CEST	1.1.1.1	192.168.2.4	0x3ba	No error (0)	images.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:05.682168961 CEST	1.1.1.1	192.168.2.4	0x2742	No error (0)	script.crazyegg.com	script.crazyegg.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:05.684181929 CEST	1.1.1.1	192.168.2.4	0x52b0	No error (0)	cdn.consentmanager.net	1376624012.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:05.684181929 CEST	1.1.1.1	192.168.2.4	0x52b0	No error (0)	1376624012.rsc.cdn77.org		89.187.167.3	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:05.684181929 CEST	1.1.1.1	192.168.2.4	0x52b0	No error (0)	1376624012.rsc.cdn77.org		195.181.164.17	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:05.684523106 CEST	1.1.1.1	192.168.2.4	0x51ce	No error (0)	script.crazyegg.com	script.crazyegg.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:05.685520887 CEST	1.1.1.1	192.168.2.4	0x8b40	No error (0)	cdn.consentmanager.net	1376624012.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:06.877428055 CEST	1.1.1.1	192.168.2.4	0xef47	No error (0)	delivery.consentmanager.net		87.230.98.78	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.015203953 CEST	1.1.1.1	192.168.2.4	0xf393	No error (0)	common-info.wondershare.com		47.254.50.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.026669025 CEST	1.1.1.1	192.168.2.4	0x547	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.026669025 CEST	1.1.1.1	192.168.2.4	0x547	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.026669025 CEST	1.1.1.1	192.168.2.4	0x547	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.026669025 CEST	1.1.1.1	192.168.2.4	0x547	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.026669025 CEST	1.1.1.1	192.168.2.4	0x547	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.026669025 CEST	1.1.1.1	192.168.2.4	0x547	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.027291059 CEST	1.1.1.1	192.168.2.4	0xac1e	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 22:26:07.232611895 CEST	1.1.1.1	192.168.2.4	0x414c	No error (0)	script.crazyegg.com	script.crazyegg.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:07.232630968 CEST	1.1.1.1	192.168.2.4	0x5ca3	No error (0)	script.crazyegg.com	script.crazyegg.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:07.562221050 CEST	1.1.1.1	192.168.2.4	0x78cf	No error (0)	app.partnerboost.com		47.243.241.30	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.622473001 CEST	1.1.1.1	192.168.2.4	0x8899	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:07.622473001 CEST	1.1.1.1	192.168.2.4	0x8899	No error (0)	www3.l.google.com		142.250.105.138	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.622473001 CEST	1.1.1.1	192.168.2.4	0x8899	No error (0)	www3.l.google.com		142.250.105.102	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.622473001 CEST	1.1.1.1	192.168.2.4	0x8899	No error (0)	www3.l.google.com		142.250.105.113	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.622473001 CEST	1.1.1.1	192.168.2.4	0x8899	No error (0)	www3.l.google.com		142.250.105.139	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.622473001 CEST	1.1.1.1	192.168.2.4	0x8899	No error (0)	www3.l.google.com		142.250.105.101	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.622473001 CEST	1.1.1.1	192.168.2.4	0x8899	No error (0)	www3.l.google.com		142.250.105.100	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:07.622752905 CEST	1.1.1.1	192.168.2.4	0x62ae	No error (0)	chrome.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:07.647644997 CEST	1.1.1.1	192.168.2.4	0x8d8	No error (0)	www.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:07.888536930 CEST	1.1.1.1	192.168.2.4	0x310f	No error (0)	www.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:08.165759087 CEST	1.1.1.1	192.168.2.4	0x938b	No error (0)	common-info.wondershare.com		47.254.50.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.079195023 CEST	1.1.1.1	192.168.2.4	0x8f00	No error (0)	analytics.webgains.io	d210mxruddtl0f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:09.079195023 CEST	1.1.1.1	192.168.2.4	0x8f00	No error (0)	d210mxruddtl0f.cloudfront.net		18.165.98.11	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.079195023 CEST	1.1.1.1	192.168.2.4	0x8f00	No error (0)	d210mxruddtl0f.cloudfront.net		18.165.98.3	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.079195023 CEST	1.1.1.1	192.168.2.4	0x8f00	No error (0)	d210mxruddtl0f.cloudfront.net		18.165.98.39	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.079195023 CEST	1.1.1.1	192.168.2.4	0x8f00	No error (0)	d210mxruddtl0f.cloudfront.net		18.165.98.98	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.079927921 CEST	1.1.1.1	192.168.2.4	0x831	No error (0)	analytics.webgains.io	d210mxruddtl0f.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:09.242029905 CEST	1.1.1.1	192.168.2.4	0xcdab	No error (0)	www.dwin1.com	d2pbcviywxotf2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:09.242862940 CEST	1.1.1.1	192.168.2.4	0xbed6	No error (0)	www.dwin1.com	d2pbcviywxotf2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:09.242862940 CEST	1.1.1.1	192.168.2.4	0xbed6	No error (0)	d2pbcviywxotf2.cloudfront.net		3.163.101.90	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.242862940 CEST	1.1.1.1	192.168.2.4	0xbed6	No error (0)	d2pbcviywxotf2.cloudfront.net		3.163.101.119	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.242862940 CEST	1.1.1.1	192.168.2.4	0xbed6	No error (0)	d2pbcviywxotf2.cloudfront.net		3.163.101.23	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.242862940 CEST	1.1.1.1	192.168.2.4	0xbed6	No error (0)	d2pbcviywxotf2.cloudfront.net		3.163.101.28	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.265300035 CEST	1.1.1.1	192.168.2.4	0x1b3a	No error (0)	cdn.avmws.com		108.138.85.117	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.265300035 CEST	1.1.1.1	192.168.2.4	0x1b3a	No error (0)	cdn.avmws.com		108.138.85.64	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.265300035 CEST	1.1.1.1	192.168.2.4	0x1b3a	No error (0)	cdn.avmws.com		108.138.85.52	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.265300035 CEST	1.1.1.1	192.168.2.4	0x1b3a	No error (0)	cdn.avmws.com		108.138.85.102	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.275557995 CEST	1.1.1.1	192.168.2.4	0xfd0e	No error (0)	www.linkconnector.com		172.67.22.39	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.275557995 CEST	1.1.1.1	192.168.2.4	0xfd0e	No error (0)	www.linkconnector.com		104.22.48.169	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.275557995 CEST	1.1.1.1	192.168.2.4	0xfd0e	No error (0)	www.linkconnector.com		104.22.49.169	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.278151035 CEST	1.1.1.1	192.168.2.4	0x2a9c	No error (0)	www.linkconnector.com			65	IN (0x0001)	false
Apr 25, 2024 22:26:09.308144093 CEST	1.1.1.1	192.168.2.4	0xd83b	No error (0)	utt.impactcdn.com		35.186.249.72	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.354773998 CEST	1.1.1.1	192.168.2.4	0x575f	No error (0)	trk.indoleads.com		104.248.96.70	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.771439075 CEST	1.1.1.1	192.168.2.4	0x227	No error (0)	tag.rmp.rakuten.com		34.102.147.248	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.810096979 CEST	1.1.1.1	192.168.2.4	0x3e7f	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:09.810096979 CEST	1.1.1.1	192.168.2.4	0x3e7f	No error (0)	scontent.xx.fbcdn.net		31.13.65.7	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.810209990 CEST	1.1.1.1	192.168.2.4	0x111a	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:09.887870073 CEST	1.1.1.1	192.168.2.4	0xb877	No error (0)	ad.admitad.com		52.72.78.243	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.887870073 CEST	1.1.1.1	192.168.2.4	0xb877	No error (0)	ad.admitad.com		52.0.201.85	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.892498970 CEST	1.1.1.1	192.168.2.4	0xfcf	No error (0)	z.asbmit.com		3.218.217.33	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.892498970 CEST	1.1.1.1	192.168.2.4	0xfcf	No error (0)	z.asbmit.com		34.199.45.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.933614016 CEST	1.1.1.1	192.168.2.4	0xdc62	No error (0)	assets-tracking.crazyegg.com		18.244.202.7	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.933614016 CEST	1.1.1.1	192.168.2.4	0xdc62	No error (0)	assets-tracking.crazyegg.com		18.244.202.100	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.933614016 CEST	1.1.1.1	192.168.2.4	0xdc62	No error (0)	assets-tracking.crazyegg.com		18.244.202.34	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.933614016 CEST	1.1.1.1	192.168.2.4	0xdc62	No error (0)	assets-tracking.crazyegg.com		18.244.202.78	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.934160948 CEST	1.1.1.1	192.168.2.4	0xc841	No error (0)	pagestates-tracking.crazyegg.com		18.165.98.69	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.934160948 CEST	1.1.1.1	192.168.2.4	0xc841	No error (0)	pagestates-tracking.crazyegg.com		18.165.98.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.934160948 CEST	1.1.1.1	192.168.2.4	0xc841	No error (0)	pagestates-tracking.crazyegg.com		18.165.98.98	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.934160948 CEST	1.1.1.1	192.168.2.4	0xc841	No error (0)	pagestates-tracking.crazyegg.com		18.165.98.71	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.998990059 CEST	1.1.1.1	192.168.2.4	0xcc4	No error (0)	lenkmio.com		3.218.217.33	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:09.998990059 CEST	1.1.1.1	192.168.2.4	0xcc4	No error (0)	lenkmio.com		34.199.45.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:10.331654072 CEST	1.1.1.1	192.168.2.4	0x392e	No error (0)	pafutos.com		3.218.217.33	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:10.331654072 CEST	1.1.1.1	192.168.2.4	0x392e	No error (0)	pafutos.com		34.199.45.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:10.352329969 CEST	1.1.1.1	192.168.2.4	0xcb9b	No error (0)	tjzuh.com		3.218.217.33	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:10.352329969 CEST	1.1.1.1	192.168.2.4	0xcb9b	No error (0)	tjzuh.com		34.199.45.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.399561882 CEST	1.1.1.1	192.168.2.4	0x21be	No error (0)	tracking.crazyegg.com		3.131.76.57	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.399561882 CEST	1.1.1.1	192.168.2.4	0x21be	No error (0)	tracking.crazyegg.com		3.142.188.39	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.399561882 CEST	1.1.1.1	192.168.2.4	0x21be	No error (0)	tracking.crazyegg.com		3.21.38.152	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.823124886 CEST	1.1.1.1	192.168.2.4	0x49b2	No error (0)	lantern.roeyecdn.com		216.137.45.128	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.823124886 CEST	1.1.1.1	192.168.2.4	0x49b2	No error (0)	lantern.roeyecdn.com		216.137.45.74	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.823124886 CEST	1.1.1.1	192.168.2.4	0x49b2	No error (0)	lantern.roeyecdn.com		216.137.45.36	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:11.823124886 CEST	1.1.1.1	192.168.2.4	0x49b2	No error (0)	lantern.roeyecdn.com		216.137.45.70	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.089284897 CEST	1.1.1.1	192.168.2.4	0x60ce	No error (0)	ut.rd.linksynergy.com	ut.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:12.089284897 CEST	1.1.1.1	192.168.2.4	0x60ce	No error (0)	ut.linksynergy.com		34.98.67.3	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.090590954 CEST	1.1.1.1	192.168.2.4	0x3c81	No error (0)	ut.rd.linksynergy.com	ut.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:12.110196114 CEST	1.1.1.1	192.168.2.4	0xd9bd	No error (0)	pagestates-tracking.crazyegg.com		18.165.98.71	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.110196114 CEST	1.1.1.1	192.168.2.4	0xd9bd	No error (0)	pagestates-tracking.crazyegg.com		18.165.98.69	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.110196114 CEST	1.1.1.1	192.168.2.4	0xd9bd	No error (0)	pagestates-tracking.crazyegg.com		18.165.98.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.110196114 CEST	1.1.1.1	192.168.2.4	0xd9bd	No error (0)	pagestates-tracking.crazyegg.com		18.165.98.98	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.113159895 CEST	1.1.1.1	192.168.2.4	0xe5e	No error (0)	assets-tracking.crazyegg.com		18.244.202.78	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.113159895 CEST	1.1.1.1	192.168.2.4	0xe5e	No error (0)	assets-tracking.crazyegg.com		18.244.202.34	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.113159895 CEST	1.1.1.1	192.168.2.4	0xe5e	No error (0)	assets-tracking.crazyegg.com		18.244.202.7	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.113159895 CEST	1.1.1.1	192.168.2.4	0xe5e	No error (0)	assets-tracking.crazyegg.com		18.244.202.100	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.120424986 CEST	1.1.1.1	192.168.2.4	0x4e8e	No error (0)	lenkmio.com		3.218.217.33	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.120424986 CEST	1.1.1.1	192.168.2.4	0x4e8e	No error (0)	lenkmio.com		34.199.45.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.127840042 CEST	1.1.1.1	192.168.2.4	0x4f01	No error (0)	ad.admitad.com		52.0.201.85	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.127840042 CEST	1.1.1.1	192.168.2.4	0x4f01	No error (0)	ad.admitad.com		52.72.78.243	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.142213106 CEST	1.1.1.1	192.168.2.4	0xcbe1	No error (0)	z.asbmit.com		3.218.217.33	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.142213106 CEST	1.1.1.1	192.168.2.4	0xcbe1	No error (0)	z.asbmit.com		34.199.45.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.143333912 CEST	1.1.1.1	192.168.2.4	0xe6a4	No error (0)	pafutos.com		34.199.45.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.143333912 CEST	1.1.1.1	192.168.2.4	0xe6a4	No error (0)	pafutos.com		3.218.217.33	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.158369064 CEST	1.1.1.1	192.168.2.4	0x4233	No error (0)	tjzuh.com		34.199.45.162	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.158369064 CEST	1.1.1.1	192.168.2.4	0x4233	No error (0)	tjzuh.com		3.218.217.33	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.338164091 CEST	1.1.1.1	192.168.2.4	0xe57b	No error (0)	tracking.crazyegg.com		3.131.76.57	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.338164091 CEST	1.1.1.1	192.168.2.4	0xe57b	No error (0)	tracking.crazyegg.com		3.142.188.39	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.338164091 CEST	1.1.1.1	192.168.2.4	0xe57b	No error (0)	tracking.crazyegg.com		3.21.38.152	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.664298058 CEST	1.1.1.1	192.168.2.4	0xc9c	No error (0)	lantern.roeye.com		34.252.42.217	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.664298058 CEST	1.1.1.1	192.168.2.4	0xc9c	No error (0)	lantern.roeye.com		18.203.166.209	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.664298058 CEST	1.1.1.1	192.168.2.4	0xc9c	No error (0)	lantern.roeye.com		54.75.66.251	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.666203976 CEST	1.1.1.1	192.168.2.4	0x9974	No error (0)	www.linkconnector.com		104.22.48.169	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.666203976 CEST	1.1.1.1	192.168.2.4	0x9974	No error (0)	www.linkconnector.com		104.22.49.169	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.666203976 CEST	1.1.1.1	192.168.2.4	0x9974	No error (0)	www.linkconnector.com		172.67.22.39	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.667680979 CEST	1.1.1.1	192.168.2.4	0x84e3	No error (0)	www.linkconnector.com			65	IN (0x0001)	false
Apr 25, 2024 22:26:12.682365894 CEST	1.1.1.1	192.168.2.4	0x94c5	No error (0)	idsync.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.928023100 CEST	1.1.1.1	192.168.2.4	0xc18b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:12.928023100 CEST	1.1.1.1	192.168.2.4	0xc18b	No error (0)	star-mini.c10r.facebook.com		31.13.65.36	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.928565979 CEST	1.1.1.1	192.168.2.4	0x4b68	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:12.948278904 CEST	1.1.1.1	192.168.2.4	0x54c3	No error (0)	cdn.consentmanager.net	1376624012.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:12.948278904 CEST	1.1.1.1	192.168.2.4	0x54c3	No error (0)	1376624012.rsc.cdn77.org		89.187.167.4	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.948278904 CEST	1.1.1.1	192.168.2.4	0x54c3	No error (0)	1376624012.rsc.cdn77.org		195.181.164.20	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:12.949660063 CEST	1.1.1.1	192.168.2.4	0x62d3	No error (0)	cdn.consentmanager.net	1376624012.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:13.489870071 CEST	1.1.1.1	192.168.2.4	0xbf03	No error (0)	stats.g.doubleclick.net		172.217.215.154	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.489870071 CEST	1.1.1.1	192.168.2.4	0xbf03	No error (0)	stats.g.doubleclick.net		172.217.215.156	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.489870071 CEST	1.1.1.1	192.168.2.4	0xbf03	No error (0)	stats.g.doubleclick.net		172.217.215.155	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.489870071 CEST	1.1.1.1	192.168.2.4	0xbf03	No error (0)	stats.g.doubleclick.net		172.217.215.157	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.493607998 CEST	1.1.1.1	192.168.2.4	0x2a94	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:13.494703054 CEST	1.1.1.1	192.168.2.4	0x14ba	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:13.494703054 CEST	1.1.1.1	192.168.2.4	0x14ba	No error (0)	star-mini.c10r.facebook.com		31.13.65.36	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.548676968 CEST	1.1.1.1	192.168.2.4	0x2d13	No error (0)	td.doubleclick.net		173.194.219.154	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.548676968 CEST	1.1.1.1	192.168.2.4	0x2d13	No error (0)	td.doubleclick.net		173.194.219.157	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.548676968 CEST	1.1.1.1	192.168.2.4	0x2d13	No error (0)	td.doubleclick.net		173.194.219.156	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.548676968 CEST	1.1.1.1	192.168.2.4	0x2d13	No error (0)	td.doubleclick.net		173.194.219.155	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.635375023 CEST	1.1.1.1	192.168.2.4	0xa179	No error (0)	lantern.roeye.com		34.252.42.217	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.635375023 CEST	1.1.1.1	192.168.2.4	0xa179	No error (0)	lantern.roeye.com		54.75.66.251	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.635375023 CEST	1.1.1.1	192.168.2.4	0xa179	No error (0)	lantern.roeye.com		18.203.166.209	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.761028051 CEST	1.1.1.1	192.168.2.4	0x456c	No error (0)	tags.rd.linksynergy.com	tags-cluster.rd.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:13.761028051 CEST	1.1.1.1	192.168.2.4	0x456c	No error (0)	tags-cluster.rd.linksynergy.com	ut.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:13.761028051 CEST	1.1.1.1	192.168.2.4	0x456c	No error (0)	ut.linksynergy.com		34.98.67.3	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:13.762017012 CEST	1.1.1.1	192.168.2.4	0x514a	No error (0)	tags.rd.linksynergy.com	tags-cluster.rd.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:13.762017012 CEST	1.1.1.1	192.168.2.4	0x514a	No error (0)	tags-cluster.rd.linksynergy.com	ut.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:14.017312050 CEST	1.1.1.1	192.168.2.4	0x7c16	No error (0)	googleads.g.doubleclick.net		74.125.138.157	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.017312050 CEST	1.1.1.1	192.168.2.4	0x7c16	No error (0)	googleads.g.doubleclick.net		74.125.138.155	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.017312050 CEST	1.1.1.1	192.168.2.4	0x7c16	No error (0)	googleads.g.doubleclick.net		74.125.138.154	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.017312050 CEST	1.1.1.1	192.168.2.4	0x7c16	No error (0)	googleads.g.doubleclick.net		74.125.138.156	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.017421007 CEST	1.1.1.1	192.168.2.4	0x7c6c	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Apr 25, 2024 22:26:14.055913925 CEST	1.1.1.1	192.168.2.4	0x1e43	No error (0)	stats.g.doubleclick.net		172.217.215.156	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.055913925 CEST	1.1.1.1	192.168.2.4	0x1e43	No error (0)	stats.g.doubleclick.net		172.217.215.157	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.055913925 CEST	1.1.1.1	192.168.2.4	0x1e43	No error (0)	stats.g.doubleclick.net		172.217.215.154	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.055913925 CEST	1.1.1.1	192.168.2.4	0x1e43	No error (0)	stats.g.doubleclick.net		172.217.215.155	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.349447966 CEST	1.1.1.1	192.168.2.4	0x5111	No error (0)	tags.rd.linksynergy.com	tags-cluster.rd.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:14.349447966 CEST	1.1.1.1	192.168.2.4	0x5111	No error (0)	tags-cluster.rd.linksynergy.com	ut.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:14.349447966 CEST	1.1.1.1	192.168.2.4	0x5111	No error (0)	ut.linksynergy.com		34.98.67.3	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.349467039 CEST	1.1.1.1	192.168.2.4	0x904d	No error (0)	tags.rd.linksynergy.com	tags-cluster.rd.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:14.349467039 CEST	1.1.1.1	192.168.2.4	0x904d	No error (0)	tags-cluster.rd.linksynergy.com	ut.linksynergy.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:14.475727081 CEST	1.1.1.1	192.168.2.4	0x8ae3	No error (0)	b.delivery.consentmanager.net		87.230.98.78	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.476823092 CEST	1.1.1.1	192.168.2.4	0xd07d	No error (0)	www.google.com		172.217.215.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.476823092 CEST	1.1.1.1	192.168.2.4	0xd07d	No error (0)	www.google.com		172.217.215.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.476823092 CEST	1.1.1.1	192.168.2.4	0xd07d	No error (0)	www.google.com		172.217.215.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.476823092 CEST	1.1.1.1	192.168.2.4	0xd07d	No error (0)	www.google.com		172.217.215.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.476823092 CEST	1.1.1.1	192.168.2.4	0xd07d	No error (0)	www.google.com		172.217.215.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.476823092 CEST	1.1.1.1	192.168.2.4	0xd07d	No error (0)	www.google.com		172.217.215.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:14.477135897 CEST	1.1.1.1	192.168.2.4	0x3d7e	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 22:26:15.058545113 CEST	1.1.1.1	192.168.2.4	0xa790	No error (0)	www.google.com		142.250.105.99	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.058545113 CEST	1.1.1.1	192.168.2.4	0xa790	No error (0)	www.google.com		142.250.105.103	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.058545113 CEST	1.1.1.1	192.168.2.4	0xa790	No error (0)	www.google.com		142.250.105.105	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.058545113 CEST	1.1.1.1	192.168.2.4	0xa790	No error (0)	www.google.com		142.250.105.104	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.058545113 CEST	1.1.1.1	192.168.2.4	0xa790	No error (0)	www.google.com		142.250.105.106	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.058545113 CEST	1.1.1.1	192.168.2.4	0xa790	No error (0)	www.google.com		142.250.105.147	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.058842897 CEST	1.1.1.1	192.168.2.4	0x6a3c	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 25, 2024 22:26:15.482500076 CEST	1.1.1.1	192.168.2.4	0xe4da	No error (0)	b.delivery.consentmanager.net		87.230.98.78	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.537863970 CEST	1.1.1.1	192.168.2.4	0xa32f	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:15.537863970 CEST	1.1.1.1	192.168.2.4	0xa32f	No error (0)	analytics-alv.google.com		216.239.36.181	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.537863970 CEST	1.1.1.1	192.168.2.4	0xa32f	No error (0)	analytics-alv.google.com		216.239.34.181	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.537863970 CEST	1.1.1.1	192.168.2.4	0xa32f	No error (0)	analytics-alv.google.com		216.239.32.181	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.537863970 CEST	1.1.1.1	192.168.2.4	0xa32f	No error (0)	analytics-alv.google.com		216.239.38.181	A (IP address)	IN (0x0001)	false
Apr 25, 2024 22:26:15.538331032 CEST	1.1.1.1	192.168.2.4	0xcd4	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:20.098268986 CEST	1.1.1.1	192.168.2.4	0x50f9	No error (0)	www.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:35.565040112 CEST	1.1.1.1	192.168.2.4	0xbfb3	No error (0)	www.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 22:26:52.549771070 CEST	1.1.1.1	192.168.2.4	0x41b1	No error (0)	www.wondershare.com	wondershare.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

fs.microsoft.com

https:

www.bing.com

cdn.consentmanager.net

delivery.consentmanager.net

common-info.wondershare.com

app.partnerboost.com

analytics.webgains.io

www.dwin1.com

www.linkconnector.com

cdn.avmws.com

utt.impactcdn.com

tag.rmp.rakuten.com

connect.facebook.net

trk.indoleads.com

assets-tracking.crazyegg.com

pagestates-tracking.crazyegg.com

ad.admitad.com

z.asbmit.com

lenkmio.com

tjzuh.com

pafutos.com

tracking.crazyegg.com

lantern.roeyecdn.com

ut.rd.linksynergy.com

idsync.rlcdn.com

www.facebook.com

lantern.roeye.com

stats.g.doubleclick.net

td.doubleclick.net

tags.rd.linksynergy.com

googleads.g.doubleclick.net

www.google.com

b.delivery.consentmanager.net

analytics.google.com

clients2.googleusercontent.com

chrome.google.com

platform.wondershare.com

dlinst.wondershare.com

cbs.wondershare.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	47.88.25.126	80	6880	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:23:50.119824886 CEST	322	OUT	GET /rest/v2/downloader/runtime/?client_sign={7C9F717C-EEB4-48a5-94F1-C9F36AA59499}&product_id=384 HTTP/1.1 Accept: / Referer: http://platform.wondershare.com/rest/v2/downloader/runtime User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) Host: platform.wondershare.com Connection: Close Data Raw: 00 Data Ascii:
Apr 25, 2024 22:23:50.323630095 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:23:50 GMT Content-Type: text/xml; Charset=UTF-8;charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=92d7d013d39c6879958b9aca6fb8d453; path=/ Expires: Thu, 25 Apr 2024 20:23:49 GMT Cache-Control: no-cache Pragma: no-cache Data Raw: 36 38 63 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 77 73 72 70 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 3e 3c 64 6f 77 6e 6c 6f 61 64 65 72 3e 3c 72 75 6e 74 69 6d 65 20 72 65 63 6f 6d 6d 65 6e 64 5f 69 6e 66 6f 3d 22 22 3e 3c 6e 61 6d 65 3e 3c 21 5b 43 44 41 54 41 5b 46 72 65 65 20 59 6f 75 54 75 62 65 20 44 6f 77 6e 6c 6f 61 64 65 72 5d 5d 3e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 73 69 6f 6e 3e 3c 21 5b 43 44 41 54 41 5b 37 2e 34 2e 37 5d 5d 3e 3c 2f 76 65 72 73 69 6f 6e 3e 3c 70 72 6f 63 65 73 73 5f 6e 61 6d 65 3e 3c 21 5b 43 44 41 54 41 5b 46 72 65 65 59 6f 75 54 75 62 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 5d 5d 3e 3c 2f 70 72 6f 63 65 73 73 5f 6e 61 6d 65 3e 3c 69 6e 73 74 61 6c 6c 5f 75 72 6c 3e 3c 21 5b 43 44 41 54 41 5b 68 74 74 70 3a 2f 2f 63 62 73 2e 77 6f 6e 64 65 72 73 68 61 72 65 2e 63 6f 6d 2f 67 6f 2e 70 68 70 3f 6d 3d 69 63 26 62 61 63 6b 5f 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 77 6f 6e 64 65 72 73 68 61 72 65 2e 63 6f 6d 25 32 46 67 75 69 64 65 25 32 46 66 72 65 65 2d 79 6f 75 74 75 62 65 2d 64 6f 77 6e 6c 6f 61 64 65 72 2e 68 74 6d 6c 25 33 46 61 63 74 25 33 44 69 6e 73 74 61 6c 6c 5d 5d 3e 3c 2f 69 6e 73 74 61 6c 6c 5f 75 72 6c 3e 3c 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 3e 3c 21 5b 43 44 41 54 41 5b 68 74 74 70 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 77 6f 6e 64 65 72 73 68 61 72 65 2e 63 6f 6d 2f 63 62 73 5f 64 6f 77 6e 2f 66 72 65 65 2d 79 6f 75 74 75 62 65 2d 64 6f 77 6e 6c 6f 61 64 65 72 5f 66 75 6c 6c 33 38 34 2e 65 78 65 5d 5d 3e 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 3e 3c 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 5f 77 69 74 68 5f 66 72 61 6d 65 77 6f 72 6b 3e 3c 21 5b 43 44 41 54 41 5b 68 74 74 70 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 77 6f 6e 64 65 72 73 68 61 72 65 2e 63 6f 6d 2f 63 62 73 5f 64 6f 77 6e 2f 66 72 65 65 2d 79 6f 75 74 75 62 65 2d 64 6f 77 6e 6c 6f 61 64 65 72 5f 66 75 6c 6c 33 38 34 2e 65 78 65 5d 5d 3e 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 5f 77 69 74 68 5f 66 72 61 6d 65 77 6f 72 6b 3e 3c 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 5f 6e 65 74 3e 3c 21 5b 43 44 41 54 41 5b 68 74 74 70 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 77 6f 6e 64 65 72 73 68 61 72 65 2e 63 6f 6d 2f 63 62 73 5f 64 6f 77 6e 2f 66 72 65 65 2d 79 6f 75 74 75 62 65 2d 64 6f 77 6e 6c 6f 61 64 65 72 5f 66 75 6c 6c 33 38 34 2e 65 78 65 5d 5d 3e 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 5f 6e 65 74 3e 3c 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 5f 6e 65 74 5f 77 69 74 68 5f 66 72 61 6d 65 77 6f 72 6b 3e 3c 21 5b 43 44 41 54 41 5b 68 74 74 70 3a 2f 2f 64 6f 77 6e 6c 6f 61 64 2e 77 6f 6e 64 65 72 73 68 61 72 65 2e 63 6f 6d 2f 63 62 73 5f 64 6f 77 6e 2f 66 72 65 65 2d 79 6f 75 74 75 62 65 2d 64 6f 77 6e 6c 6f 61 64 65 72 5f 66 75 6c 6c 33 38 34 2e 65 78 65 5d 5d 3e 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 5f 6e 65 74 5f 77 69 74 68 5f 66 72 61 6d 65 77 6f 72 6b 3e 3c 64 6f Data Ascii: 68c<?xml version="1.0" encoding="utf-8"?><wsrp version="1.0" status="ok"><downloader><runtime recommend_info=""><name><![CDATA[Free YouTube Downloader...</name><version><![CDATA[7.4.7...</version><process_name><![CDATA[FreeYouTubeDownloader.exe...</process_name><install_url><![CDATA[http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall...</install_url><download_url><![CDATA[http://download.wondershare.com/cbs_down/free-youtube-downloader_full384.exe...</download_url><download_url_with_framework><![CDATA[http://download.wondershare.com/cbs_down/free-youtube-downloader_full384.exe...</download_url_with_framework><download_url_net><![CDATA[http://download.wondershare.com/cbs_down/free-youtube-downloader_full384.exe...</download_url_net><download_url_net_with_framework><![CDATA[http://download.wondershare.com/cbs_down/free-youtube-downloader_full384.exe...</download_url_net_with_framework><do
Apr 25, 2024 22:23:50.323672056 CEST	697	IN	Data Raw: 77 6e 6c 6f 61 64 5f 75 72 6c 5f 78 36 34 3e 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 5f 78 36 34 3e 3c 62 61 6e 6e 65 72 5f 75 72 6c 3e 3c 21 5b 43 44 41 54 41 5b 68 74 74 70 3a 2f 2f 64 6c 69 6e 73 74 2e 77 6f 6e 64 65 72 73 68 61 72 65 2e 63 Data Ascii: wnload_url_x64></download_url_x64><banner_url><![CDATA[http://dlinst.wondershare.com/player/ytd384.html...</banner_url><oiap_url><![CDATA[http://pop.wondershare.com/license.html...</oiap_url><hard_bound></hard_bound><soft_bound></soft_bound><m
Apr 25, 2024 22:23:50.323720932 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	47.88.25.126	80	6880	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:23:50.132111073 CEST	644	OUT	POST /rest/v2/downloader/track?client_sign={7C9F717C-EEB4-48a5-94F1-C9F36AA59499} HTTP/1.1 Accept: / Referer: http://platform.wondershare.com/rest/v2/downloader User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) Host: platform.wondershare.com Content-Type: text/xml Content-Length: 302 Connection: Close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 74 72 61 63 6b 20 63 6c 69 65 6e 74 5f 73 69 67 6e 3d 22 7b 37 43 39 46 37 31 37 43 2d 45 45 42 34 2d 34 38 61 35 2d 39 34 46 31 2d 43 39 46 33 36 41 41 35 39 34 39 39 7d 22 20 70 72 6f 64 75 63 74 5f 69 64 3d 22 33 38 34 22 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 72 74 2f 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 65 6e 64 2f 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 74 75 73 3e 75 6e 6b 6e 6f 77 6e 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 74 75 73 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 73 74 61 72 74 2f 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 65 6e 64 2f 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 73 74 61 74 75 73 3e 75 6e 6b 6e 6f 77 6e 3c 2f 69 6e 73 74 61 6c 6c 5f 73 74 61 74 75 73 3e 0d 0a 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 74 72 61 63 6b 3e 0d 0a 00 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><download_track client_sign="{7C9F717C-EEB4-48a5-94F1-C9F36AA59499}" product_id="384"><download_start/><download_end/><download_status>unknown</download_status><install_start/><install_end/><install_status>unknown</install_status></download_track>
Apr 25, 2024 22:23:50.334050894 CEST	427	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:23:50 GMT Content-Type: text/xml; Charset=UTF-8;charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bddadf757fd361ce1f71447796c3d377; path=/ Expires: Thu, 25 Apr 2024 20:23:49 GMT Cache-Control: no-cache Pragma: no-cache Data Raw: 37 36 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 77 73 72 70 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 3e 3c 54 72 61 63 6b 53 74 61 74 75 73 3e 3c 21 5b 43 44 41 54 41 5b 4f 4b 5d 5d 3e 3c 2f 54 72 61 63 6b 53 74 61 74 75 73 3e 3c 2f 77 73 72 70 3e 0d 0a Data Ascii: 76<?xml version="1.0" encoding="utf-8"?><wsrp version="1.0" status="ok"><TrackStatus><![CDATA[OK...</TrackStatus></wsrp>
Apr 25, 2024 22:23:50.334086895 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49747	47.254.51.125	80	6880	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:24:10.539063931 CEST	323	OUT	GET /player/ytd384.html HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: dlinst.wondershare.com Connection: Keep-Alive
Apr 25, 2024 22:24:10.732640982 CEST	1160	IN	HTTP/1.1 200 OK Server: Tengine/2.2.3 Date: Thu, 25 Apr 2024 20:24:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Expires: Mon, 24 Jun 2024 20:24:10 GMT Cache-Control: max-age=5184000 Content-Encoding: gzip Data Raw: 33 38 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 55 6d 6f db 36 10 fe ec 01 fb 0f 17 b5 98 65 c4 92 25 b7 43 13 5b f2 50 38 c5 d0 01 c5 36 d4 1f 36 04 f9 40 4b 94 c5 84 22 55 f2 e4 c4 29 f2 df 77 a4 ec cc 5b 93 6e 18 26 1b 36 79 77 cf c3 7b e3 29 3b b9 f8 79 b9 fa fd 97 77 50 63 23 17 df 7e 33 c8 6a ce 4a b7 18 64 0d 47 06 45 cd 8c e5 98 07 1d 56 d1 59 00 93 23 5d 8d d8 46 fc 53 27 b6 79 b0 d4 0a b9 c2 68 b5 6b 79 00 45 bf cb 03 e4 77 38 71 dc f3 47 26 22 3a 0b 16 83 c1 d3 3c ad 61 9b 86 1d 31 28 1d 15 ac a8 79 f0 dc c1 4e 19 b9 e3 8d 96 4f e0 c6 d0 74 16 23 c3 b7 4c 8a 92 e1 b3 44 fc ae 15 86 db 23 8a 55 dd c1 4f 4c c1 f4 0d 4c 93 f4 7b 48 ce 67 49 42 5f f8 f1 c3 ea 34 39 4b 12 17 06 fc ed f1 e4 28 50 f2 c5 db d2 66 93 7e e9 a5 27 51 04 6f 11 c9 2b d0 9d 81 e5 c7 8f 10 45 4e 05 30 c8 a4 50 37 60 b8 cc 03 8b 3b c9 6d cd 39 06 50 1b 5e ed 25 13 6d d6 02 a3 34 7e 15 27 71 61 ed 3e 8e 7f c6 55 84 f2 ab 94 80 e9 11 d4 16 46 b4 08 48 25 db 57 ea 9a 6d 59 2f 0d c0 9a e2 c0 70 fd a9 e3 66 47 47 bf a6 4f 23 54 7c 4d 14 d9 a4 b7 fc 4f 5c b1 0f e6 4b 2e ea 0a 97 a6 4b 51 c1 fb 77 57 44 ed 73 9a 79 e8 31 f9 3e 88 c7 ac c7 28 1a 6e e0 33 94 c2 b6 92 ed 66 a0 b4 e2 70 22 9a 56 1b 64 0a e7 f0 70 64 5e 8a 6d 5c b0 16 85 56 84 59 b3 e2 66 63 74 a7 ca 19 1a a6 6c cb 0c 77 88 4a 48 e4 66 d6 1a bd 11 e5 ec e2 b7 f7 0d db f0 95 b3 a8 b4 69 e2 0f a2 30 da ea 0a e3 8d 61 a5 20 48 68 91 19 5c 6a a9 8d 45 93 bf 38 3f 4f fc 33 e6 aa fc 52 3a 9a df 6b dd cc 20 7d f4 8d d2 e0 02 5d b8 24 5c 12 46 54 57 be 41 be 9e 5d 57 80 2d 33 d0 19 69 21 87 cb e1 70 ec bf 57 73 52 5c ff ea d2 1d 96 ba e8 1a f2 70 14 1b ba df bb b0 ea 54 e1 a2 0f 5f 8e e0 b3 ef c0 97 e1 f0 45 c5 19 76 86 97 c3 51 5f 9f d0 a9 06 c1 ba 93 92 23 dd 8c 19 a0 e9 f8 d8 0b 99 12 0d 73 14 4e 1c d4 da 88 7b ba 37 4c 46 6d 67 eb c0 53 3e 8c e6 7b ea 40 34 9b 98 fa d0 8a 7b 1e 8c 62 4e 57 e0 4f 17 46 fe 14 00 a1 4a 7e 47 01 90 27 47 e6 e4 8b 57 84 58 0b eb 09 9d 69 15 ba 68 2f bd e6 0a f2 1c 86 c3 9e c6 1f e7 4d 63 56 96 4b c9 ac 0d 69 16 d4 4c 95 c1 01 fd f0 75 ef 0a 29 8a 9b ff d3 bd 93 bf fa 77 4b 62 7d 1b eb 96 ab 63 b3 d3 e0 3b 6a ad 52 37 79 00 a7 a0 f8 2d 5c d0 b4 0a 47 f1 86 e3 8a ba 3b 1c 8d 61 48 e2 1e 3e a4 4d cd c5 a6 c6 fc cd 34 19 13 69 89 75 9e 26 c9 74 0c a8 db 9c 44 92 57 e8 fe 51 6b b9 66 26 df 71 4b c3 90 ab ee 71 43 0d a4 a5 d3 d9 5c e9 31 0d 3f 71 cf d6 92 bb 8d d4 85 af ee de 10 a9 31 ac 5b 0f 9f 4a a2 ff 3d 9e 07 d9 e4 f0 1a c9 d6 ba dc f9 05 dd 39 28 5c 3d f2 c0 4d 58 26 14 37 fb 41 e4 54 a2 cc 83 43 ff f5 e2 41 46 79 3e 40 0e e5 e9 47 c9 0e cb 57 67 af 27 49 1a b7 6a f3 03 e6 6e 3c a7 e7 69 7a 78 3f fd 0b e8 f4 09 28 3c f7 78 2f 27 e4 66 1f 5c bf c8 26 fb d8 32 ff 86 5b fc 01 36 f0 c8 51 4d 07 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 380Umo6e%C[P866@K"U)w[n&6yw{);ywPc#~3jJdGEVY#]FS'yhkyEw8qG&":<a1(yNOt#LD#UOLL{HgIB_49K(Pf~'Qo+EN0P7`;m9P^%m4~'qa>UFH%WmY/pfGGO#T\|MO\K.KQwWDsy1>(n3fp"Vdpd^m\VYfctlwJHfi0a Hh\jE8?O3R:k }]$\FTWA]W-3i!pWsR\pT_EvQ_#sN{7LFmgS>{@4{bNWOFJ~G'GWXih/McVKiLu)wKb}c;jR7y-\G;aH>M4iu&tDWQkf&qKqC\1?q1[J=9(\=MX&7ATCAFy>@GWg'Ijn<izx?(<x/'f\&2[6QM0
Apr 25, 2024 22:24:10.813590050 CEST	392	OUT	GET /player/style/orbit-1.3.0.css HTTP/1.1 Accept: / Referer: http://dlinst.wondershare.com/player/ytd384.html Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: dlinst.wondershare.com Connection: Keep-Alive
Apr 25, 2024 22:24:11.007163048 CEST	1141	IN	HTTP/1.1 200 OK Server: Tengine/2.2.3 Date: Thu, 25 Apr 2024 20:24:10 GMT Content-Type: text/css Last-Modified: Fri, 27 Apr 2018 01:58:12 GMT Transfer-Encoding: chunked Connection: keep-alive ETag: W/"5ae283b4-953" Expires: Mon, 24 Jun 2024 20:24:10 GMT Cache-Control: max-age=5184000 Content-Encoding: gzip Data Raw: 33 32 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 55 db 8e 9b 30 10 7d ef 57 50 45 d5 b6 52 40 06 36 61 17 5e 2a 55 6a df fb 07 06 db 60 c5 d8 c8 98 5c 16 e5 df 6b 73 33 2c 6c 77 a5 36 3c c4 30 9e f1 9c 39 67 c6 88 9e 3d 21 53 aa dc 8b 84 55 85 65 7b a1 48 15 b1 5f 5d 93 02 d3 bc 50 dd b2 12 35 55 54 f0 58 62 06 15 3d e3 3b 1a 1d 3f e8 90 88 33 96 84 89 4b 5c 50 84 30 b7 01 1c 5a e6 ed b4 1f a6 b5 60 8d c2 89 12 55 0c 12 86 89 d2 7f 88 d6 15 83 b7 98 0b 3e 3b da 81 9d 6f 2a 24 c2 b2 b7 0d 06 bd e5 bd 90 43 da 00 7c 99 f2 d6 eb 2e b8 a2 e5 54 88 47 60 81 75 eb 57 38 92 ed 63 7c b3 55 0e 61 8d 57 05 33 aa 6e b1 77 4c b2 46 d6 42 c6 95 a0 5c 61 99 bc b8 94 23 7c 35 a7 fb f7 ba 82 dc 93 42 41 25 64 3b 82 4e 99 c8 4e c9 1b e9 fc 15 a5 1b 98 2d e3 09 61 1f be 84 f5 69 33 76 f0 d1 d8 3d 2e 30 05 0e 56 e4 ce 71 78 a5 b6 b6 7d d5 6d 06 fd d7 19 a8 f9 86 0a 36 35 fe 0f f8 6d 8a 8f 13 03 c0 52 1c 17 26 6f c7 1e b9 b7 4b 0f 66 46 b6 ed e8 e6 0f d2 72 33 58 99 f3 da 85 24 97 3d e4 bc da 9a c2 ec 94 4b d1 70 14 ef 00 00 c9 ec 5d e6 29 fc 0a f6 e6 f1 8e df e6 62 00 49 26 98 d6 c9 8e 10 92 54 10 21 ca f3 38 aa ae 4e a7 27 22 b8 72 6b fa 82 63 3f dc ac c2 c8 51 2a 94 12 e5 a4 f7 e7 8e 64 85 af ca 85 8c e6 3c ce b0 51 61 57 93 9a 51 dd 47 2e 87 e7 76 d5 6f d6 d6 95 6b 20 2e 7a 9a 75 3d 98 22 1b 0c 5c ab ef 59 ff 36 93 5b c0 34 7c 1d 74 17 96 50 e6 94 bb e6 d5 3d 98 58 cb 46 d9 4a c3 eb 50 b6 03 d6 cd 1d 46 07 a3 f8 06 5a d2 86 31 ac ea 4d 06 07 9b c3 68 ab f5 0c 55 6c 5c c7 d4 ba 30 87 55 66 23 51 1a ed 26 fe 61 d2 84 b3 5a 05 eb 41 b2 ce c0 2b 60 ed aa a2 29 d3 b9 82 4c b6 76 78 d9 98 91 4e 6c 23 c6 20 e3 21 c5 20 08 66 ea 73 27 66 5c 4d a4 f3 ba 40 d6 7d 33 13 eb 0d 1c a3 33 33 84 3b f6 34 38 47 13 4d 91 63 d4 7e ff de 69 95 c0 0c b7 c3 aa a4 ec 16 3f fc 28 1a 7e fa a9 a3 ff c6 79 c3 a0 7c e8 45 7d e9 e1 70 21 4b c8 9c cf b4 ac 84 54 90 ab 41 f2 ea c6 f0 da 78 df 11 0c 55 23 31 6a a7 d2 2c e6 fa 6a 6c 5b 09 5a 5f 73 9b ec ed 9b b9 44 16 1a b1 26 2f d3 c9 68 8e 9d c2 7f 07 d4 de 79 f8 85 85 96 0f d4 cb 1a 4b 4a 66 bd db 4d b0 91 1a 12 1c 01 79 a7 06 9d bc 94 84 bc 26 da 16 37 66 da 64 b0 c6 bd a1 2e 20 d2 08 7d 33 24 0c 9f ce 8e 3c 11 80 fc fd 27 43 49 b0 fc a4 e5 e8 84 fd 27 1f 1e a2 e8 71 3d 15 e6 2d e9 3f eb 5c 37 2b 10 fe 4b 05 82 59 05 22 72 4c c3 e8 6d 8c 1f 28 cd 62 a6 8d b3 c0 4a b6 1d 14 11 1e 8f 53 5f 1e 00 78 fb 1e b1 37 93 1b 84 60 7e 99 ba fe 3d 15 e8 d6 8e ba 72 af 63 1f ff 01 40 5f 4c db 53 09 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 328U0}WPER@6a^Uj`\ks3,lw6<09g=!SUe{H_]P5UTXb=;?3K\P0Z`U>;o$C\|.TG`uW8c\|UaW3nwLFB\a#\|5BA%d;NN-ai3v=.0Vqx}m65mR&oKfFr3X$=Kp])bI&T!8N'"rkc?Q*d<QaWQG.vok .zu="\Y6[4\|tP=XFJPFZ1MhUl\0Uf#Q&aZA+`)LvxNl# ! fs'f\M@}333;48GMc~i?(~y\|E}p!KTAxU#1j,jl[Z_sD&/hyKJfMy&7fd. }3$<'CI'q=-?\7+KY"rLm(bJS_x7`~=rc@_LS0
Apr 25, 2024 22:24:11.008987904 CEST	396	OUT	GET /player/style/jquery-1.4.4.min.js HTTP/1.1 Accept: / Referer: http://dlinst.wondershare.com/player/ytd384.html Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: dlinst.wondershare.com Connection: Keep-Alive
Apr 25, 2024 22:24:11.205442905 CEST	1289	IN	HTTP/1.1 200 OK Server: Tengine/2.2.3 Date: Thu, 25 Apr 2024 20:24:11 GMT Content-Type: application/x-javascript Last-Modified: Fri, 27 Apr 2018 01:58:12 GMT Transfer-Encoding: chunked Connection: keep-alive ETag: W/"5ae283b4-13105" Expires: Mon, 24 Jun 2024 20:24:11 GMT Cache-Control: max-age=5184000 Content-Encoding: gzip Data Raw: 36 38 63 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 9b da 48 b2 30 fa 7d 7e 45 a1 f1 c1 92 c9 02 ca dd 33 77 46 2a 99 b7 5c 5e bb bd 74 b7 dd db 50 b8 5f 09 09 50 21 10 25 a0 36 e0 fc f6 1b 4b 66 2a 25 44 b9 67 ce 7d ef bd 7e 1e 17 52 2a d7 c8 c8 d8 32 32 d2 1e ad e7 c3 55 92 cd ed 97 e2 b9 b3 51 6f 47 d3 c0 0e 44 28 22 67 93 8c ec c8 f7 fd e7 cd 66 d0 9e 67 51 fc f9 6e 11 c3 fb 89 b3 89 fc a0 3d 8e 57 67 ab 55 9e 84 eb 55 6c 5b 51 b0 0a 8e ad 56 e8 78 50 6a 05 19 b3 d1 11 16 b6 96 90 65 3e b6 9c cd 2a bf 83 72 94 b6 ca d7 b1 d5 c3 bf 2e bd 8f 82 74 09 09 f4 c3 29 f3 75 9a 5a 3d fc eb 36 86 ed 64 f9 21 f8 60 47 4e 6f 11 e4 cb f8 55 9a 05 2b 78 73 bf 0b da ab 78 89 8f bd 61 9b 3e 7d f7 e9 23 e6 73 a3 dd 30 58 0d 27 76 ec 6c 76 c3 36 f6 4d 8e 69 17 43 13 d0 b1 e7 bb 3c 5e ad f3 f9 51 b4 d3 03 ff d9 76 36 32 95 7a 52 7c 19 06 c5 27 ec 75 f1 25 d5 c0 8a fa dd 41 1b 07 ee 07 9e cc 3a 6c c7 d7 f1 7c d5 9e 04 f3 28 8d db c1 62 91 de d9 d4 0b 5d fe 7b 28 ef 6c ae 83 fc 08 d2 45 2c 46 62 22 52 31 15 99 b8 15 b9 38 13 e7 7e 7f e0 8d f0 cf c4 97 03 59 4d 92 a5 c0 3f 7a 4e 7a 16 b5 b3 b4 5c eb 8f 3f f8 f1 8f 3f 2c 73 26 26 04 65 d9 a8 e5 4c fc 09 77 6d 89 79 1a 76 d0 4e 93 eb f8 55 92 c7 08 7c ac 7b bb 6d 4c f0 3f 7d d8 6e 83 36 cc f2 2a 9b 23 26 ac 18 0b ac 61 9a 0c a7 96 43 68 02 f8 11 cc e2 e5 22 18 c6 ce 99 ff 53 3c 7e 79 bb b0 2d fb cb f6 e2 a2 ed 58 2d e3 73 7b b9 48 93 95 6d b5 2d a7 7d 99 25 73 db 82 2c 76 cf 6d 3f c1 ac 3d cb 69 59 36 3c 6d 1f 39 30 00 b3 5f d8 2b 0f 01 f5 9d cf bd 6a 2f a1 03 b1 dd 75 bc 51 96 db 53 bf eb 4d 4f bf 6b a7 f1 7c bc 9a 78 d3 56 cb d9 4c fc ef fa 53 80 5c 3b cb 93 31 02 aa 9d c7 8b 14 3a 61 ff 26 2c cb 81 41 f0 68 7a a3 f6 62 bd 9c d8 93 f6 32 4e e3 e1 2a cb 01 b7 a8 a3 90 75 7a 7c 2c 4e 60 c6 fc 21 8c 72 15 e4 80 f6 4e 7b 98 66 4b c4 bc 91 08 da c3 75 9e 03 28 3f f3 27 2f 83 8e 60 87 6e fd 91 ea 4c 76 7a eb 65 d8 a1 dc 1f f5 b3 c1 d7 fa 0b f0 cc 75 4f a0 93 45 b7 9a 4d bb 71 b6 dd 9e 31 da 4f 0c a0 c3 34 a4 7e de 86 7c 33 2f f6 71 dd 60 35 93 f6 22 57 ab d6 9a 65 eb 65 0c 1d 8d 73 6b bb dd ff 92 c6 c1 75 0c cb 54 4e b0 ce 00 d5 e1 c8 f3 38 0d 56 71 f4 b9 02 00 03 64 80 ff 3b c4 26 40 97 b8 e1 fb a9 73 ce 50 dd 60 a7 dc 54 f0 2a f8 18 5e ba 80 e2 80 7d a9 9b b7 e9 77 e7 ec 76 bb 02 6c e7 7b 60 1b f9 e7 08 36 24 47 cd e6 88 0b 3d 8b 9c 30 8f 83 a9 57 99 00 80 3a 01 21 a0 c5 02 6f ba 59 4a 80 74 9d 60 7e f4 ce 4a 59 11 61 de d0 5b 2e 97 2d 57 2b a0 8d f5 0c 17 0e ad ae 33 80 1e 91 0a 5c 21 c9 f2 87 3c 5b 04 e3 00 d7 d8 a7 55 b6 58 c4 91 ed 20 ad 94 5d 2e 95 70 42 fe f5 68 f5 24 cb b7 b3 59 1c 25 00 e2 da 4a 68 a8 3b 45 b3 c2 5d 41 40 7e 47 fa a3 88 93 1d c0 02 05 d8 5b 4f ac 5e d0 82 35 e6 02 9a b7 42 8d f6 ef 02 61 fd 6f 58 78 ea fd 3d bc 37 2d 83 1c cd 4c da 8f 74 f7 95 e2 11 a1 e3 68 aa 36 86 f2 90 4f f3 0f 20 5a aa 07 8d 46 d8 1e 06 69 8a 69 62 84 4b 2c da 39 1e 11 Data Ascii: 68c1iH0}~E3wF\^tP_P!%6Kf%Dg}~R22UQoGD("gfgQn=WgUUl[QVxPje>r.t)uZ=6d!`GNoU+xsxa>}#s0X'vlv6MiC<^Qv62zR\|'u%A:l\|(b]{(lE,Fb"R18~YM?zNz\??,s&&eLwmyvNU\|{mL?}n6#&aCh"S<~y-X-s{Hm-}%s,vm?=iY6<m90_+j/uQSMOk\|xVLS\;1:a&,Ahzb2Nuz\|,N`!rN{fKu(?'/`nLvzeuOEMq1O4~\|3/q`5"WeeskuTN8Vqd;&@sP`T*^}wvl{`6$G=0W:!oYJt`~JYa[.-W+3\!<[UX ].pBh$Y%Jh;E]A@~G[O^5BaoXx=7-Lth6O ZFiibK,9
Apr 25, 2024 22:24:11.205483913 CEST	1289	IN	Data Raw: 5d a8 31 d4 24 eb 81 ca 0a 22 0c a5 c3 4a 0d 92 9e 85 25 ce 82 54 01 b0 f4 a1 aa 4a fc 6b 47 93 f7 41 72 0f 73 64 a3 24 85 f5 01 34 3a 16 8d 48 b6 1a fa 66 ba b3 fb 13 3d 07 c8 cd cf f2 3c 00 b4 81 c9 79 e6 77 79 14 05 9c e7 01 4f 1b f6 3c 02 cc Data Ascii: ]1$"J%TJkGArsd$4:Hf=<ywyO<qJWE4,s&d=s~j1qqKx{#h%bd~;5d(D71Omv^CepkoyRwKB`q0Zdv0O0H_^) ]m{
Apr 25, 2024 22:24:11.205554962 CEST	1289	IN	Data Raw: 40 35 9b 4b bf bf 6a 0f 61 fd af 62 49 3f ec 7b ac 77 40 e0 6f 07 ab 55 ce 72 2e 40 5b e0 f2 90 96 05 28 f7 a6 be 1c 7e de dc c3 c4 85 6b 10 37 5e e5 c1 98 be f6 b1 bb 03 d1 7f 33 70 bc 4b df be 87 5a 87 93 38 08 d3 b8 77 df 1e c9 5c a8 6e cd 63 Data Ascii: @5KjabI?{w@oUr.@[(~k7^3pKZ8w\ncYlj->*~[j=Ab{4B@axoEDPI}R0V45/&4U4nYTT,as0FA{z$h_^!i2r&^X) {7X
Apr 25, 2024 22:24:11.205575943 CEST	1289	IN	Data Raw: 52 6a 40 31 5f dc 78 15 71 9e 83 30 6c 16 5d 4d f2 ec e6 e8 d2 03 26 ac b6 80 ab d0 54 c8 d0 28 d4 48 98 57 dd 8c a4 48 21 a9 df 52 a6 3f 97 93 ae f7 4a be 13 d6 ff 32 b6 4e 6e 84 35 30 5e df a2 e9 50 03 e6 65 1b 7b d1 6c f2 2f 6f 4d f7 cc 17 c4 Data Ascii: Rj@1_xq0l]M&T(HWH!R?J2Nn50^Pe{l/oM-GZCk[oItD<;12C*x Bb\|@@d+<P9P\rXTDs-lWBWmV%O8_=_b6ITM5&IeKL?
Apr 25, 2024 22:24:11.205638885 CEST	1289	IN	Data Raw: e8 90 35 1b 0a 4f fd b4 56 10 d7 39 b3 05 89 3a 8e c3 36 9f c6 08 94 27 e5 dc 88 4e a2 4e 69 8a 80 0c a0 af ca af 93 64 c5 ce 89 6e 64 48 e9 a6 1f c0 37 62 85 56 27 b7 71 a8 f3 2b 76 5b 50 22 c9 64 35 4b 3f c5 79 02 aa d0 7d ec 36 0e 16 c3 a9 29 Data Ascii: 5OV9:6'NNidndH7bV'q+v[P"d5K?y}6)J4,.S3?r3yZj;_0t=#%@w7$h?C kM>A'rW";tm@t@aQ3DjeByFis-aREXst]pW
Apr 25, 2024 22:24:11.205657959 CEST	1289	IN	Data Raw: b5 53 39 7f 62 1e 1f 09 50 08 c4 7e 4f 01 e3 8b f3 7b de 14 38 9a 8f 7f 7a e8 10 85 0f ae c5 bb 3d 44 27 36 7c 68 4f 6d e1 cb f3 54 b6 05 93 86 f3 cd 25 5a 56 c3 12 fd 29 f4 7e a0 1d d0 9f 03 f9 31 61 5c 05 24 74 08 80 6b 8c 3b c0 33 95 6a c8 5c Data Ascii: S9bP~O{8z=D'6\|hOmT%ZV)~1a\$tk;3j\uj5\|!U[&`f{Xr^7Qj:unRPFKr,+>vP_q$#rchxW&h=Ij;lS.d&E
Apr 25, 2024 22:24:11.205724001 CEST	1289	IN	Data Raw: 00 9a 35 dd fb 1e da 4f dd b0 34 d3 b6 7c 65 ba af 70 f4 13 09 24 aa 17 cf 77 ac 93 57 c8 db 03 f4 a7 ca b3 44 2e 2d 74 55 09 87 90 74 ea e4 7e 95 8d 11 7c 08 40 b9 04 7d 8e b6 e5 8a 95 01 a3 d6 68 37 b1 bc 65 e6 28 d4 c5 1c 08 b1 3f a4 93 39 79 Data Ascii: 5O4\|ep$wWD.-tUt~\|@}h7e(?9y!kp;oYsL80O9I>pqd`\|S};ph^[v;i)RQJ?>aMx8Uu{$KYr~BOd'g M {fWp9f3
Apr 25, 2024 22:24:11.205744982 CEST	1289	IN	Data Raw: 04 98 43 40 d8 43 a3 5c 9c 2b 74 c5 c5 5f 81 cd 6e b7 93 1c d9 f4 39 78 cb 0b 31 f4 75 1f 43 26 fc a4 ef cb ee de a8 e0 b1 fa 7d 8f 11 de 94 d7 55 d9 8d 41 7c a7 bd 3c ca ad df d4 79 3c 20 91 91 1c ab 86 b6 b0 56 c0 41 4b 81 a8 10 de c7 a8 ce 9b Data Ascii: C@C\+t_n9x1uC&}UA\|<y< VAKU]rfO6OSoXn:Dmm >]L$IU0z{du4 I3R*r_T1d(8{1AAQGe2\0ud4b:RaX#mXM%M}.H&
Apr 25, 2024 22:24:11.205792904 CEST	1289	IN	Data Raw: 52 9a 32 36 da 38 55 e6 48 66 f1 a7 55 30 5b f8 ea 78 30 26 9b 87 1e f8 0c a3 6c dc 0c ca 5b ee a9 79 f2 9f 6a de 97 e4 fd 21 b3 8c c0 df ef 31 0d 89 0d 87 15 08 d4 c8 11 d2 56 c8 b0 21 26 29 e5 5b 51 91 2f 6a 3a b5 2f 5e 7c bd 5b fb 0a 2e 6d c1 Data Ascii: R268UHfU0[x0&l[yj!1V!&)[Q/j:/^\|[.maq= a/yuOvuCqMPzR(z4y,rj%d'dZ.M[AuAlb\VznHfeT!_%Q%OUM^HTk`TOk`
Apr 25, 2024 22:24:11.205811024 CEST	1289	IN	Data Raw: 31 14 84 9d 12 6d 4e 07 22 ff 1a 6d 2e 08 32 d6 11 f9 76 64 9e 13 23 77 21 3b f5 a3 fe 14 b1 8b 85 58 0f 7d 82 7e e3 d8 8f 29 3a 01 f1 89 7d a0 d6 b7 7e 86 67 54 52 3f 2d ef 1b d3 fe 29 8e 81 a6 18 24 7e f6 0d 33 ef 93 6d dd 0a f3 12 d9 d6 ad a4 Data Ascii: 1mN"m.2vd#w!;X}~):}~gTR?-)$~3mlQi@UTFBie-9;[,1u{zV;Tm~PBGBvTy)rR"~EHV8J& q$H!2;PT2#_8bxD(S~ HO"k8
Apr 25, 2024 22:24:11.398998976 CEST	1289	IN	Data Raw: a9 94 32 c0 1a c8 a0 b7 56 b0 39 91 b7 76 bd 52 31 d2 5e 69 d2 42 36 e6 8b 0b 60 d8 58 c4 b7 d7 32 cc 7d 71 c2 ba 73 71 01 dc 0e 89 fc 0c 1a c5 e1 41 7b f6 9a 06 86 95 ce 94 93 d2 d8 1f eb 42 92 9a 41 4e 2a a9 48 fd 6e 06 2b 6a e6 27 87 e3 76 2b Data Ascii: 2V9vR1^iB6`X2}qsqA{BANHn+j'v+MLH9j#?t+?}\~@pHF1JMET(f(ACeubA/-{/p$ZT'5X~+T;f/i2=YXH Hkqz]_
Apr 25, 2024 22:24:11.400043964 CEST	395	OUT	GET /player/ytd384/02.png?t=20151911 HTTP/1.1 Accept: / Referer: http://dlinst.wondershare.com/player/ytd384.html Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: dlinst.wondershare.com Connection: Keep-Alive
Apr 25, 2024 22:24:11.593442917 CEST	316	IN	HTTP/1.1 200 OK Server: Tengine/2.2.3 Date: Thu, 25 Apr 2024 20:24:11 GMT Content-Type: image/png Content-Length: 110176 Last-Modified: Fri, 27 Apr 2018 01:58:13 GMT Connection: keep-alive ETag: "5ae283b5-1ae60" Expires: Mon, 24 Jun 2024 20:24:11 GMT Cache-Control: max-age=5184000 Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49748	47.88.25.126	80	6880	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:24:10.606586933 CEST	632	OUT	POST /rest/v2/downloader/track?client_sign={7C9F717C-EEB4-48a5-94F1-C9F36AA59499} HTTP/1.1 Accept: / Referer: http://platform.wondershare.com/rest/v2/downloader User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) Host: platform.wondershare.com Content-Type: text/xml Content-Length: 290 Connection: Close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 74 72 61 63 6b 20 63 6c 69 65 6e 74 5f 73 69 67 6e 3d 22 7b 37 43 39 46 37 31 37 43 2d 45 45 42 34 2d 34 38 61 35 2d 39 34 46 31 2d 43 39 46 33 36 41 41 35 39 34 39 39 7d 22 20 70 72 6f 64 75 63 74 5f 69 64 3d 22 33 38 34 22 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 72 74 3e 32 30 32 34 2d 30 34 2d 32 35 20 32 32 3a 32 34 3a 30 39 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 72 74 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 65 6e 64 2f 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 74 75 73 2f 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 73 74 61 72 74 2f 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 65 6e 64 2f 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 73 74 61 74 75 73 2f 3e 0d 0a 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 74 72 61 63 6b 3e 0d 0a 00 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><download_track client_sign="{7C9F717C-EEB4-48a5-94F1-C9F36AA59499}" product_id="384"><download_start>2024-04-25 22:24:09</download_start><download_end/><download_status/><install_start/><install_end/><install_status/></download_track>
Apr 25, 2024 22:24:10.807017088 CEST	427	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:24:10 GMT Content-Type: text/xml; Charset=UTF-8;charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=685f9df3040d1eeb71d2b94977d4e830; path=/ Expires: Thu, 25 Apr 2024 20:24:09 GMT Cache-Control: no-cache Pragma: no-cache Data Raw: 37 36 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 77 73 72 70 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 3e 3c 54 72 61 63 6b 53 74 61 74 75 73 3e 3c 21 5b 43 44 41 54 41 5b 4f 4b 5d 5d 3e 3c 2f 54 72 61 63 6b 53 74 61 74 75 73 3e 3c 2f 77 73 72 70 3e 0d 0a Data Ascii: 76<?xml version="1.0" encoding="utf-8"?><wsrp version="1.0" status="ok"><TrackStatus><![CDATA[OK...</TrackStatus></wsrp>
Apr 25, 2024 22:24:10.807038069 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49749	47.254.51.125	80	6880	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:24:11.006257057 CEST	395	OUT	GET /player/style/fit-style1.0.1.css HTTP/1.1 Accept: / Referer: http://dlinst.wondershare.com/player/ytd384.html Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: dlinst.wondershare.com Connection: Keep-Alive
Apr 25, 2024 22:24:11.197640896 CEST	310	IN	HTTP/1.1 200 OK Server: Tengine/2.2.3 Date: Thu, 25 Apr 2024 20:24:11 GMT Content-Type: text/css Content-Length: 356 Last-Modified: Fri, 27 Apr 2018 01:58:12 GMT Connection: keep-alive ETag: "5ae283b4-164" Expires: Mon, 24 Jun 2024 20:24:11 GMT Cache-Control: max-age=5184000 Accept-Ranges: bytes
Apr 25, 2024 22:24:11.197662115 CEST	356	IN	Data Raw: 68 74 6d 6c 2c 62 6f 64 79 2c 64 69 76 2c 69 6d 67 7b 62 6f 72 64 65 72 3a 30 70 78 3b 6d 61 72 67 69 6e 3a 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 70 78 7d 68 74 6d 6c 7b 77 69 64 74 68 3a 36 35 30 70 78 3b 68 65 69 67 68 74 3a 33 31 35 70 78 3b Data Ascii: html,body,div,img{border:0px;margin:0px;padding:0px}html{width:650px;height:315px;overflow:hidden}.container{position:absolute;width:650px;height:315px;padding:0px;left:0px;top:opx;overflow:hidden}.fitsize{width:650px;height:315px;border:0px;p
Apr 25, 2024 22:24:11.199506998 CEST	396	OUT	GET /player/style/jquery.orbit.min.js HTTP/1.1 Accept: / Referer: http://dlinst.wondershare.com/player/ytd384.html Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: dlinst.wondershare.com Connection: Keep-Alive
Apr 25, 2024 22:24:11.391519070 CEST	1289	IN	HTTP/1.1 200 OK Server: Tengine/2.2.3 Date: Thu, 25 Apr 2024 20:24:11 GMT Content-Type: application/x-javascript Last-Modified: Fri, 27 Apr 2018 01:58:12 GMT Transfer-Encoding: chunked Connection: keep-alive ETag: W/"5ae283b4-2659" Expires: Mon, 24 Jun 2024 20:24:11 GMT Cache-Control: max-age=5184000 Content-Encoding: gzip Data Raw: 39 63 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 bd 1a 6b 6f db 38 f2 af a4 44 91 15 61 59 b1 db c5 e2 20 47 09 72 e9 2d 5a 20 bb c1 6d bb b8 0f 87 fb 40 49 b4 ad 8b 4c e9 f4 70 9a 26 fe ef 37 7c c9 24 25 2b 4e ef d2 2f 8e 44 ce 0c 67 86 f3 56 bc 65 cb 92 26 2b 98 97 e0 c7 2d a9 4e 56 d1 63 4a 97 a4 cd 9b 3a 7c 24 2c db 10 be 1b a2 75 51 65 df 0a d6 90 7c 5a b6 f5 1a f9 dd de e7 92 d2 34 fc 65 36 f3 9b 6c 43 ab f0 cd cc 27 e9 96 b0 84 aa 9d bf bd f7 4b d2 d6 f4 96 7d 2c b6 1c 60 ee d7 0d a9 9a eb bc 48 ee 6e d9 6f 05 df 6b 9b 43 eb 57 cb 06 90 e6 40 25 cd 2a 2a 98 25 f9 ef 64 cb 0f 4a 48 c9 df 6b e3 f9 6a cf f3 92 a4 14 f5 d6 f7 fc c6 6d 9e 53 90 13 0e 96 8f 5f d6 ed 26 76 df 6f 8a 44 d1 03 a1 39 2f 9f f3 2c a5 d7 6b c2 56 34 4c 02 56 14 a5 9f 50 06 1b 7f d5 f4 66 3b 9f 00 a3 5b 2a 40 c3 99 cf 80 8e 42 ac e1 b5 a8 e2 ac f9 47 96 36 eb 90 01 8e 7c ff 48 b3 d5 ba 91 0b 5c 03 c0 a4 78 16 5a fd a3 65 2c 63 2b b9 92 d2 55 45 05 a1 fb 8a 94 25 ad 3e 7e f9 ed 26 fc e9 3c cd b6 27 49 4e ea 3a 42 82 e2 54 6d a3 93 b3 8b 9f 24 9d 3e a4 58 46 17 e7 75 49 98 5e db 90 fa ce 59 aa 8a 86 34 05 07 3c e3 cb dd 1f 13 46 dc b2 01 01 a7 c0 b9 4a ff 87 78 54 db a8 83 b7 6f b9 8f 56 73 2d 56 53 46 b6 2e 8b 5c 7f e8 e2 0f fe 67 88 bd 9c 2e 61 fb 06 7e 1d 0e e5 65 ab 93 da dc e6 4f 19 09 e7 af cd 01 38 63 59 13 76 5e 43 fc 58 fa 4d ea d3 68 e6 2f a3 66 9d d5 0b fe 13 24 79 96 dc 7d e1 da 8d 92 a0 ac 8a af 0f 9e b3 ee f3 77 2c a1 49 9a 4a f3 b1 81 bb 65 13 b6 a2 35 6d ae 58 fa 27 e3 76 62 23 d8 7b 26 56 dd 14 e5 75 1f a1 5b b6 61 c1 0f 05 8f c2 fb 84 2b de 50 b2 a5 2e ee 01 30 93 56 92 53 52 89 13 f6 fb 83 6a 39 00 66 49 ce ad 70 08 db d8 30 e1 0b 19 1e 00 96 7e 6d 28 4b bd c7 9d d8 0e 74 8c 83 eb 5b 64 4b 0f 42 45 0e a6 1b 45 91 89 16 08 df c0 fd a5 e8 cd 7c 04 4b 07 25 3c b8 3a 8e 6b 1b 3f 1e d9 e3 74 c4 f6 5b 9a d3 0d c4 9f 28 f1 88 12 fb ad 72 fc c8 02 08 f8 aa 54 97 11 37 70 50 92 0a 76 3d 8d 2b fc ab 76 50 93 75 96 a7 00 e6 a1 6c b3 f2 4f 88 7f 02 ae 83 b0 cd 41 10 67 a0 62 e9 37 01 03 8d 23 bf 73 14 fc b8 0c ea 75 b6 6c 3c 24 76 f0 6e 0c b9 ac e8 76 18 59 ec 8c 23 af 8a a6 30 90 85 8b 6a fc 78 1c 55 18 b4 7b 70 97 93 bc e7 90 8b b2 87 ab 9c 4b a0 a6 91 a9 e1 60 99 e5 e0 34 42 a3 a0 c9 19 98 42 1a e4 94 ad 9a f5 a5 80 cb 0b c8 5f a9 87 c3 54 1d 03 09 6c 45 2b 4a d2 07 eb 18 3a 89 e6 0b 6a a0 9f 9e 2e 3b e4 1d de f9 f2 39 34 50 6c 21 20 c8 5c f3 90 a7 04 41 38 b8 e7 b9 c9 43 f3 f2 2b bc ac 45 62 52 6f 2a 3e d0 e6 43 c6 71 b9 61 fe 5a 15 9b 1b 52 ad 68 dd 88 0c a7 2d a9 2d 53 f0 c9 5b 69 bd 9f 96 b7 2c 7f b8 65 d4 02 01 3a 6d f9 6b 56 39 98 96 b3 9d 9e 7a 7b 58 e1 e1 1e 96 4e 6c de 8c 83 a9 bd ed f4 74 8f 7b ad d6 dc 53 6c bf 32 31 3e 58 3b 2e 9e ca 0c 16 7f 32 58 0b 60 5f af 5e 89 52 40 ee 00 a3 3b 3f 69 2b ee 71 b2 38 30 6e a5 02 0a 15 3b b1 8c 84 fe 47 25 82 7d 3d 01 14 46 f5 6f 92 e4 a9 89 18 49 a9 23 4b 92 b5 e7 c0 c5 10 Data Ascii: 9c6ko8DaY Gr-Z m@ILp&7\|$%+N/DgVe&+-NVcJ:\|$,uQe\|Z4e6lC'K},`HnokCW@%*%dJHkjmS_&voD9/,kV4LVPf;[@BG6\|H\xZe,c+UE%>~&<'IN:BTm$>XFuI^Y4<FJxToVs-VSF.\g.a~eO8cYv^CXMh/f$y}w,IJe5mX'vb#{&Vu[a+P.0VSRj9fIp0~m(Kt[dKBEE\|K%<:k?t[(rT7pPv=+vPulOAgb7#sul<$vnvY#0jxU{pK`4BB_TlE+J:j.;94Pl! \A8C+EbRo*>CqaZRh--S[i,e:mkV9z{XNlt{Sl21>X;.2X`_^R@;?i+q80n;G%}=FoI#K
Apr 25, 2024 22:24:11.391563892 CEST	1289	IN	Data Raw: 41 38 10 f6 d3 28 56 26 80 fd 18 9e 95 05 88 50 99 5e 10 23 a2 48 20 4c 2c 63 f2 48 17 81 b4 29 a5 d8 27 c1 be ec 89 fa 34 38 ed d8 a4 ad 0f 1d 23 ae 60 e2 8e ba 2c a2 a2 01 32 0b 12 98 55 18 f8 8c 74 8d e4 ae e7 18 b2 fa 8a 78 19 d7 b2 51 88 39 Data Ascii: A8(V&P^#H L,cH)'48#`,2UtxQ9@r`/Az3A{DoUYqca=$)w8%'fZxeNBs8{<p<hM_.,Klb1 .,M)CXFD1 '^voI0pCP:YrHk]+>[
Apr 25, 2024 22:24:11.391599894 CEST	274	IN	Data Raw: 5b b3 8f dd 6e 91 04 4b 26 a9 44 66 91 67 7e 7b 72 3f 0e 99 5f cf 57 38 e0 ff 01 21 ab 4e c2 ab f3 1d f6 fe fd f7 96 56 0f 78 b1 47 4a a0 f0 57 cf 27 2b 68 83 52 59 46 52 f9 91 9a aa 0f 9a fc c3 64 90 0d 7f d5 4c 79 a3 91 3f 00 2e b4 5f 2d ef 18 Data Ascii: [nK&Dfg~{r?_W8!NVxGJW'+hRYFRdLy?._-jaTt[IFr.zD6.*i+RJ\|YN64hVgQu`YT.KUWo>t@r@d9G0Ruz{y"%
Apr 25, 2024 22:24:11.392597914 CEST	395	OUT	GET /player/ytd384/01.png?t=20151911 HTTP/1.1 Accept: / Referer: http://dlinst.wondershare.com/player/ytd384.html Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: dlinst.wondershare.com Connection: Keep-Alive
Apr 25, 2024 22:24:11.584120035 CEST	314	IN	HTTP/1.1 200 OK Server: Tengine/2.2.3 Date: Thu, 25 Apr 2024 20:24:11 GMT Content-Type: image/png Content-Length: 32132 Last-Modified: Fri, 27 Apr 2018 01:58:13 GMT Connection: keep-alive ETag: "5ae283b5-7d84" Expires: Mon, 24 Jun 2024 20:24:11 GMT Cache-Control: max-age=5184000 Accept-Ranges: bytes
Apr 25, 2024 22:24:11.584168911 CEST	1289	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 8a 00 00 01 3b 08 02 00 00 00 d5 68 37 96 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 86 69 54 58 74 58 4d 4c 3a Data Ascii: PNGIHDR;h7tEXtSoftwareAdobe ImageReadyqe<iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/2
Apr 25, 2024 22:24:11.584206104 CEST	1289	IN	Data Raw: 23 10 08 04 02 81 f4 8c 40 20 10 08 04 02 e9 19 81 40 20 10 08 04 d2 33 02 81 40 20 10 48 cf 08 04 02 81 40 20 90 9e 11 08 04 02 81 40 7a 46 20 10 08 04 02 81 f4 8c 40 20 10 08 04 d2 33 02 81 40 20 10 08 a4 67 04 02 81 40 20 90 9e 11 08 04 02 81 Data Ascii: #@ @ 3@ H@ @zF @ 3@ g@ @ =#@zF @ 3@ H@ @zF @ @ 96@B#vuYMv@zF N5A&g7L,(3@t]73Q
Apr 25, 2024 22:24:11.584245920 CEST	1289	IN	Data Raw: 4b a7 40 f1 8c f4 8c 40 20 10 dd f0 a0 e9 63 4c da a7 3c 63 6a 96 d8 f3 b8 d4 b1 d3 9c b5 25 36 c9 75 38 3f 4c 88 55 0a 9f 15 96 8d 06 02 03 aa 10 16 b4 d4 3c 8a 84 66 68 7b de 98 98 46 05 c6 d0 a4 83 76 c5 b9 67 a4 67 04 02 81 e8 9c 9d 75 f8 90 Data Ascii: K@@ cL<cj%6u8?LU<fh{FvgguNdLnum2Me3iC)d?YJ: +DEg`KK^*UZkrEnNt#%KyH4BU#s5#G;n+umM~'R&8,m]y
Apr 25, 2024 22:24:11.584300041 CEST	1289	IN	Data Raw: e2 74 af 21 b2 08 0b 7a 22 5c 89 36 4b 6e 2e 9b e6 7c 4a 9c 61 c5 cc 03 74 d7 f1 82 db 19 71 c6 39 71 0c 4d 84 9a 53 7b 49 58 2b d2 71 94 40 a9 da db bb f4 67 f7 e0 0b e6 05 1a b7 11 08 04 a2 35 f4 a9 49 3d 97 6f 87 7e 88 93 71 bb d2 51 81 aa 5d Data Ascii: t!z"\6Kn.\|Jatq9qMS{IX+q@g5I=o~qQ]qF&>3kk;m{P"m-HV-.+STEhGwJUQ[f"\|u&R5\|SPs\DEiJ<{1S7"2qiOK.JdLxQ4n#D4d5
Apr 25, 2024 22:24:11.584336996 CEST	1289	IN	Data Raw: 4e da 52 87 32 04 aa 67 04 02 81 e8 4a 34 53 5b 2b fb 05 b5 76 69 59 d7 da 2a ee a7 ed 70 d4 f2 f1 ea 92 7a 4e 05 a4 77 a4 32 dd ec b8 0a 75 8f 1a a8 4f e5 a9 30 cd 6c dd 2f 71 04 17 0b ca 0e 42 25 8d e0 bd 0a fa 85 a1 7a 46 20 10 88 99 62 67 07 Data Ascii: NR2gJ4S[+viYpzNw2uO0l/qB%zF bg@-n%(uOi%D X.$U,cJk+_@ f1>iuW^a&WDpu/n%[FiQxfy}xQ=#DWf .H eH)A$)TZa2^H
Apr 25, 2024 22:24:11.584374905 CEST	1289	IN	Data Raw: 67 e7 96 1e 4c de 99 66 c5 f6 6d a6 ce 35 ca 2d 55 23 09 17 49 5b d8 50 55 9a cf d3 4a 09 b8 94 c4 62 24 93 22 89 0c 89 25 49 34 aa 44 55 a2 69 06 d7 46 a2 8a 6a d0 2a 81 0d 1a 54 30 6d 54 8d ff 34 74 a5 51 a7 0d 9d d6 eb 4a 5d a1 d5 32 ad 96 94 Data Ascii: gLfm5-U#I[PUJb$"%I4DUiFj*T0mT4tQJ]2r)dTqC$)C;@ :W^]H32IXwNR.2C\>s7hK(HXB"fC@#jkJ8LsE}d>4[I8H1l-7U]
Apr 25, 2024 22:24:11.584414005 CEST	1289	IN	Data Raw: b8 89 12 18 fa 6b 8f 8d a0 11 52 2a 13 5f d5 1b 63 73 b7 df dd 3c c9 ad b8 0f ed ca 43 a3 b1 ed 73 8f ec 99 d9 8b 02 99 71 53 f9 3d 2f 4e bd eb 37 fb d9 f6 fd e7 0e ce 9d 71 c0 09 8b 13 ca 8b d3 ec e5 81 b1 dd 91 03 09 fe 13 d7 d3 a0 b0 c5 fd 88 Data Ascii: kR_cs<CsqS=/N7qCYcfmbWa=ZMX[W}O%qiVyJ"AI$-lZ.J+L-',8*f{v}WN)o/3\|neJigyjDJ!Qb3az>?Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49767	47.88.25.126	80	6880	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:24:48.378374100 CEST	683	OUT	POST /rest/v2/downloader/track?client_sign={7C9F717C-EEB4-48a5-94F1-C9F36AA59499} HTTP/1.1 Accept: / Referer: http://platform.wondershare.com/rest/v2/downloader User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) Host: platform.wondershare.com Content-Type: text/xml Content-Length: 341 Connection: Close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 74 72 61 63 6b 20 63 6c 69 65 6e 74 5f 73 69 67 6e 3d 22 7b 37 43 39 46 37 31 37 43 2d 45 45 42 34 2d 34 38 61 35 2d 39 34 46 31 2d 43 39 46 33 36 41 41 35 39 34 39 39 7d 22 20 70 72 6f 64 75 63 74 5f 69 64 3d 22 33 38 34 22 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 72 74 3e 32 30 32 34 2d 30 34 2d 32 35 20 32 32 3a 32 34 3a 30 39 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 72 74 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 65 6e 64 3e 32 30 32 34 2d 30 34 2d 32 35 20 32 32 3a 32 35 3a 30 35 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 65 6e 64 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 74 75 73 3e 31 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 74 75 73 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 73 74 61 72 74 2f 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 65 6e 64 2f 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 73 74 61 74 75 73 2f 3e 0d 0a 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 74 72 61 63 6b 3e 0d 0a 00 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><download_track client_sign="{7C9F717C-EEB4-48a5-94F1-C9F36AA59499}" product_id="384"><download_start>2024-04-25 22:24:09</download_start><download_end>2024-04-25 22:25:05</download_end><download_status>1</download_status><install_start/><install_end/><install_status/></download_track>
Apr 25, 2024 22:24:48.579677105 CEST	427	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:24:48 GMT Content-Type: text/xml; Charset=UTF-8;charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5cadfe6cd388e5df4f7260f0b7763031; path=/ Expires: Thu, 25 Apr 2024 20:24:47 GMT Cache-Control: no-cache Pragma: no-cache Data Raw: 37 36 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 77 73 72 70 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 3e 3c 54 72 61 63 6b 53 74 61 74 75 73 3e 3c 21 5b 43 44 41 54 41 5b 4f 4b 5d 5d 3e 3c 2f 54 72 61 63 6b 53 74 61 74 75 73 3e 3c 2f 77 73 72 70 3e 0d 0a Data Ascii: 76<?xml version="1.0" encoding="utf-8"?><wsrp version="1.0" status="ok"><TrackStatus><![CDATA[OK...</TrackStatus></wsrp>
Apr 25, 2024 22:24:48.579694986 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49770	47.88.25.126	80	8104	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:25:25.369321108 CEST	278	OUT	GET /go.php?pid=384&m=i HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; CIBA; MS-RTC LM 8) Host: cbs.wondershare.com
Apr 25, 2024 22:25:25.572705030 CEST	487	IN	HTTP/1.1 302 Found Date: Thu, 25 Apr 2024 20:25:25 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=9eedf93b20f698884b75f7ab55909d50; path=/ Expires: Mon, 24 Jun 2024 20:25:25 GMT Cache-Control: max-age=5184000 Pragma: no-cache P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49773	47.88.25.126	80	6880	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:25:57.738380909 CEST	766	OUT	POST /rest/v2/downloader/track?client_sign={7C9F717C-EEB4-48a5-94F1-C9F36AA59499} HTTP/1.1 Accept: / Referer: http://platform.wondershare.com/rest/v2/downloader User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) Host: platform.wondershare.com Content-Type: text/xml Content-Length: 424 Connection: Close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 74 72 61 63 6b 20 63 6c 69 65 6e 74 5f 73 69 67 6e 3d 22 7b 37 43 39 46 37 31 37 43 2d 45 45 42 34 2d 34 38 61 35 2d 39 34 46 31 2d 43 39 46 33 36 41 41 35 39 34 39 39 7d 22 20 70 72 6f 64 75 63 74 5f 69 64 3d 22 33 38 34 22 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 72 74 3e 32 30 32 34 2d 30 34 2d 32 35 20 32 32 3a 32 34 3a 30 39 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 72 74 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 65 6e 64 3e 32 30 32 34 2d 30 34 2d 32 35 20 32 32 3a 32 35 3a 30 35 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 65 6e 64 3e 0d 0a 3c 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 74 75 73 3e 31 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 74 75 73 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 73 74 61 72 74 3e 32 30 32 34 2d 30 34 2d 32 35 20 32 32 3a 32 35 3a 30 36 3c 2f 69 6e 73 74 61 6c 6c 5f 73 74 61 72 74 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 65 6e 64 3e 32 30 32 34 2d 30 34 2d 32 38 20 31 30 3a 32 30 3a 32 34 3c 2f 69 6e 73 74 61 6c 6c 5f 65 6e 64 3e 0d 0a 3c 69 6e 73 74 61 6c 6c 5f 73 74 61 74 75 73 3e 31 3c 2f 69 6e 73 74 61 6c 6c 5f 73 74 61 74 75 73 3e 0d 0a 3c 2f 64 6f 77 6e 6c 6f 61 64 5f 74 72 61 63 6b 3e 0d 0a 00 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><download_track client_sign="{7C9F717C-EEB4-48a5-94F1-C9F36AA59499}" product_id="384"><download_start>2024-04-25 22:24:09</download_start><download_end>2024-04-25 22:25:05</download_end><download_status>1</download_status><install_start>2024-04-25 22:25:06</install_start><install_end>2024-04-28 10:20:24</install_end><install_status>1</install_status></download_track>
Apr 25, 2024 22:25:57.937685013 CEST	427	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:25:57 GMT Content-Type: text/xml; Charset=UTF-8;charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=71473d4a302e110c76c59a46595f5a4f; path=/ Expires: Thu, 25 Apr 2024 20:25:56 GMT Cache-Control: no-cache Pragma: no-cache Data Raw: 37 36 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 77 73 72 70 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 3e 3c 54 72 61 63 6b 53 74 61 74 75 73 3e 3c 21 5b 43 44 41 54 41 5b 4f 4b 5d 5d 3e 3c 2f 54 72 61 63 6b 53 74 61 74 75 73 3e 3c 2f 77 73 72 70 3e 0d 0a Data Ascii: 76<?xml version="1.0" encoding="utf-8"?><wsrp version="1.0" status="ok"><TrackStatus><![CDATA[OK...</TrackStatus></wsrp>
Apr 25, 2024 22:25:57.937721014 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49778	47.88.25.126	80	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:26:03.150357008 CEST	543	OUT	GET /go.php?m=ic&back_url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall HTTP/1.1 Host: cbs.wondershare.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Apr 25, 2024 22:26:03.358092070 CEST	487	IN	HTTP/1.1 302 Found Date: Thu, 25 Apr 2024 20:26:03 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=f48689ed886553b6b7e588a9c34f940d; path=/ Expires: Mon, 24 Jun 2024 20:26:03 GMT Pragma: no-cache P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Cache-Control: max-age=5184000 Location: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 25, 2024 22:26:48.371397018 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49777	47.88.25.126	80	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 22:26:48.152651072 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:24:08 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+m4WCRnsRpMdkul&MD=H+CPbanN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 20:24:09 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 86acb9b8-c058-4c9d-bf7f-265e97e9e2b6 MS-RequestId: fc0e7e62-0e9c-4552-8c28-4c3b3df777cc MS-CV: B1BXYxA/+Um2+gUd.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 20:24:08 GMT Connection: close Content-Length: 24490
2024-04-25 20:24:09 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-25 20:24:09 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49763	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:24:16 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 20:24:16 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0790) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=124759 Date: Thu, 25 Apr 2024 20:24:16 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49764	184.31.62.93	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:24:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-25 20:24:17 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=124758 Date: Thu, 25 Apr 2024 20:24:17 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-25 20:24:17 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49765	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:24:46 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+m4WCRnsRpMdkul&MD=H+CPbanN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-25 20:24:47 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 2e01c301-9908-406e-aa75-bdac791218c9 MS-RequestId: 66fe0840-1ab9-4274-b2f1-89e9925faeff MS-CV: dRqlg5pGK0SIeGpT.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 25 Apr 2024 20:24:46 GMT Connection: close Content-Length: 25457
2024-04-25 20:24:47 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-25 20:24:47 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49769	173.222.162.32	443

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:25:15 UTC	2301	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109000CC6 X-BM-CBT: 1696420817 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 60 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109000CC6 X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-t X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2236 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997
2024-04-25 20:25:15 UTC	2236	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 36 36 36 36 36 39 34 32 38 34 34 38 34 46 41 31 42 33 35 43 43 42 34 33 33 44 34 32 45 39 39 37 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 38 39 32 46 41 30 37 38 38 36 34 31 34 42 44 46 38 45 45 31 37 36 34 41 35 39 46 46 33 39 43 36 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>6666694284484FA1B35CCB433D42E997</CID><Events><E><T>Event.ClientInst</T><IG>892FA07886414BDF8EE1764A59FF39C6</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2024-04-25 20:25:15 UTC	478	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 75184DA94DF746DB8786C3FC2670EDD4 Ref B: LAX311000114019 Ref C: 2024-04-25T20:25:15Z Date: Thu, 25 Apr 2024 20:25:15 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.20a6dc17.1714076715.c744cb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49779	173.194.219.132	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:03 UTC	563	OUT	GET /crx/blobs/AfQPRnlXATSkKTK5C0dqeT98RaNcEj49dhlIQyGC_aOHcez6nMt8cEUs35X-FTeEzupXDCyW4Eh-Ikr3wo0WxD8E482m5dnO1Mqpx8QWzv2ayEY0pB5XkNtsdBjeqrhFbrIAxlKa5fNP7GUfiINIpvEHcgcb0jvoaIGD/DHDGFFKKEBHMKFJOJEJMPBLDMPOBFKFO_5_1_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:03 UTC	567	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPqRKMghK8VZWcQ8ybkUZx9-xr_8kwOzx-2K7YhIXNNTe424iTtyrM4IdPhF_WVIwIMjbwg Accept-Ranges: bytes Content-Length: 1596312 X-Goog-Hash: crc32c=dx/Dlw== Server: UploadServer Date: Thu, 25 Apr 2024 04:51:57 GMT Expires: Fri, 25 Apr 2025 04:51:57 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 22 Apr 2024 18:36:09 GMT ETag: 80ac1997_6540f73f_2165aa86_b683a26d_5fdc3b29 Content-Type: application/x-chrome-extension Age: 56046 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:03 UTC	688	IN	Data Raw: 43 72 32 34 03 00 00 00 1a 04 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 8f fb bf 5c 37 63 94 3c b0 ee 01 c4 b5 a6 9a b1 9f 46 74 6f 16 38 a0 32 27 35 dd f0 71 6b 0e dc f6 25 cb b2 ed ea fb 32 d5 af 1e 03 43 03 46 f0 a7 39 db 23 96 1d 65 e5 78 51 f0 84 b0 0e 12 ac 0e 5b dc c9 d6 4c 7c 00 d5 b8 1b 88 33 3e 2f da eb aa f7 1a 75 c2 ae 3a 54 de 37 8f 10 d2 28 e6 84 79 4d 15 b4 f3 bd 3f 56 d3 3c 3f 18 ab fc 2e 05 c0 1e 08 31 b6 61 d0 fd 9f 4f 3f 64 0d 17 93 bc ad 41 c7 48 be 00 27 a8 4d 70 42 92 05 54 a6 6d b8 de 56 6e 20 49 70 ee 10 3e 6b d2 7c 31 bd 1b 6e a4 3c 46 62 9f 08 66 93 f9 2a 51 31 a8 db b5 9d b9 0f 73 e8 a0 09 32 01 e9 7b 2a 8a 36 a0 cf 17 b0 50 70 9d a2 f9 a4 6f 62 4d Data Ascii: Cr240"0H0\7c<Fto82'5qk%2CF9#exQ[L\|3>/u:T7(yM?V<?.1aO?dAH'MpBTmVn Ip>k\|1n<FbfQ1s2{*6PpobM
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: 81 32 7e eb 72 f9 c3 d6 8b b1 3b c0 d9 fa 9d 0d f8 70 f0 c9 e5 d4 63 1c 25 df d1 23 f6 62 04 49 b4 b2 da 20 d1 97 f2 42 30 f5 8e 94 84 5d 02 03 01 00 01 12 80 01 40 07 4a 62 6e 7a 19 72 ad 37 b3 3b e0 ca bf d8 53 51 e9 6c ce 0a 42 cf 57 8c ce df 8c 27 67 55 7e a0 7d 84 3f 2a a7 5c f8 2f 53 57 1a c5 99 24 ba 39 10 aa 27 84 e8 73 ba e3 cf b9 3a aa 6c 94 53 e5 cd c2 91 30 58 82 e6 0f 4b 23 5a 27 dc 93 83 53 65 d0 d1 be 00 e5 a0 99 c8 47 4f d9 67 3b 85 1b 45 53 99 0d 14 a8 7c aa 61 da 4a 8c 84 88 a5 ad 63 89 93 91 41 48 92 7d 82 d9 19 73 ac e6 1a a7 01 0a 5b 30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a 86 48 ce 3d 03 01 07 03 42 00 04 b4 02 f9 a9 1c ae e1 0c 84 f8 dc 9b 17 72 98 a5 e0 32 d5 db 2b 59 d8 49 c0 ef be e8 6b f9 f8 62 52 b8 6a 35 53 6c 07 8b 38 Data Ascii: 2~r;pc%#bI B0]@Jbnzr7;SQlBW'gU~}?\/SW$9's:lS0XK#Z'SeGOg;ES\|aJcAH}s[0Y0H=*H=Br2+YIkbRj5Sl8
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: d9 68 65 38 b6 09 b9 1f 3c 0f fe 02 50 4b 07 08 58 82 c2 8a 25 03 00 00 ce 08 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 2d 00 4c 49 43 45 4e 53 45 55 54 05 00 01 86 b8 26 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 47 49 28 ea 94 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 ce 2f a8 2c ca 4c cf 28 51 30 32 30 b4 50 f0 4a cc 53 70 ca cc cb cc cf d6 53 70 cc c9 51 00 4b 15 2b 14 a5 16 a7 16 95 a5 a6 e8 71 71 01 00 50 4b 07 08 21 5c 34 21 30 00 00 00 31 00 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 2d 00 61 73 6b 2e 68 74 6d 6c 55 54 05 00 01 86 b8 26 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 47 49 28 ea 94 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: he8<PKX%PK!-LICENSEUT&f GI(s/,L(Q020PJSpSpQK+qqPK!\4!01PK!-ask.htmlUT&f GI(
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: f8 35 0d 26 ba b3 16 0d ca 08 44 05 1b 44 6d 10 4e 07 f2 72 c1 63 5e 91 f0 91 94 6e d5 15 99 86 be e7 e3 94 60 e6 41 7a 2c ba 02 ab 1c 3a 56 30 36 a0 65 55 85 a7 83 e7 a7 71 40 43 15 4a 52 83 02 98 7b 70 fa ec e5 0f a4 37 6c a0 51 04 00 51 69 5e 02 8e 84 60 ef 41 b0 42 e4 fb 2d c9 63 5c 08 80 d7 9d 8a 55 85 83 a8 5d 72 5b ed 53 78 bd 85 93 4a 8b b5 b6 ec 8e 78 af a8 02 e4 00 fb 06 ad 4c e7 7e 45 70 f5 dd c6 d8 ff 55 32 7e ed bd b2 4b 44 20 5c 16 0a 4c 89 25 79 7e ef 95 5c 26 33 ea 25 3c f3 16 c9 bd 77 05 98 74 25 0b 40 30 8a a0 fd 21 e1 6c 06 48 ef dd 9c e1 2b 4d 04 74 39 3d 39 3d 8b bc 8f 39 4d 24 f5 e4 2d 83 59 3c 55 78 af 16 38 5f 84 ab 08 7f 38 39 7b f9 27 1c 08 e5 b2 14 d4 2b 01 b8 4c ab f4 60 eb 1e 4c 35 f7 22 6c 8d fe 90 6d 1f f2 33 2e f1 a3 48 40 Data Ascii: 5&DDmNrc^n`Az,:V06eUq@CJR{p7lQQi^`AB-c\U]r[SxJxL~EpU2~KD \L%y~\&3%<wt%@0!lH+Mt9=9=9M$-Y<Ux8_89{'+L`L5"lm3.H@
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: 89 87 6e c3 2c a3 d9 7a 5d 41 fa 5b a1 2e ea a2 c4 6b f5 69 4e cf 31 d2 f6 5f 37 25 26 39 2f ca 1c c7 b9 86 21 74 a6 f0 6a bb 94 b4 4b f6 b0 b7 d8 e5 09 16 78 32 ed f3 8d e0 fd 69 5d 6d 6a 3e 83 6a f4 f6 ea c6 fe 44 a0 53 3a 42 03 df 2c 1d 81 99 1b 0b 92 dd 22 52 63 ce 13 f0 2f 53 5d 36 a2 e8 14 30 cd 26 2b c8 d5 19 41 10 61 bc a4 43 e7 79 3a 26 aa 8e 06 1b 56 b9 d5 2e 6d 3e 5c 55 43 7e 78 78 20 77 95 83 fa 7d cc 1c dc a7 71 37 53 10 6d f3 ee 88 da ef 55 24 e6 4d c7 1d 63 ee aa 70 c9 6e 9d e8 94 b8 79 b1 bc 15 1f 7c 75 c0 47 8f 87 25 a4 b8 bb e9 2e c5 76 4d 6c 1f e5 66 fa d4 61 ca 57 14 1a 03 09 5b 71 72 29 a0 22 2b 2c f4 ca ba 90 25 9b 82 d0 8e 1d 76 eb 6b c0 84 cd 82 e2 38 e8 0e f0 95 aa e2 8e 11 d6 eb 66 83 3d dc e1 9f 5c 11 3a 87 0d c5 e9 42 0b 70 25 Data Ascii: n,z]A[.kiN1_7%&9/!tjKx2i]mj>jDS:B,"Rc/S]60&+AaCy:&V.m>\UC~xx w}q7SmU$Mcpny\|uG%.vMlfaW[qr)"+,%vk8f=\:Bp%
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: 57 32 f0 60 35 72 ec e3 0d 08 8d 4c 00 2c 9e 1f 83 d7 8b fd e6 bd 42 07 69 16 a7 ef 4a f8 a4 da e4 8d 76 7a ad 6a ee 97 47 5c 50 50 e3 c9 37 97 1e a7 71 b1 5e 9b 1b 80 ed 4b 0c 5b 32 fe b2 47 c6 78 44 b0 25 d8 2f 78 4e 28 9a 6b 71 7c 6c 2e c6 c5 66 a2 1d 39 b7 d8 91 73 ef bf 09 57 e0 8f 1c 7f a4 a0 15 df 7a 07 6e 16 1c e4 f8 f3 51 17 e1 08 4c 73 32 a4 b9 a4 1e 76 79 c4 15 38 9d fa 7f f5 1a 1c 69 15 1b 1e bc 02 37 f1 2e d5 d4 de 82 1b ad 6e 10 ae 1e d5 a1 69 b7 8a e6 bb 0c 3f 6c f0 a9 be 07 17 f6 30 69 51 15 66 43 e9 44 4d 37 63 6d dd 06 e1 36 fe 1e 4d f0 27 d8 08 fe b2 d1 ad 4e b0 74 a9 a3 d2 24 b2 aa 34 cf b0 14 8a e2 3a b1 09 58 d6 b9 51 97 ea 7b 76 07 6a bd 3e 28 b0 2e d6 ae ca ed ad c1 ad d7 59 03 c1 ac 39 53 d2 7c 97 87 87 7b be c2 c7 64 cf 1d 35 7d Data Ascii: W2`5rL,BiJvzjG\PP7q^K[2GxD%/xN(kq\|l.f9sWznQLs2vy8i7.ni?l0iQfCDM7cm6M'Nt$4:XQ{vj>(.Y9S\|{d5}
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: fb c7 07 10 20 00 9f 47 45 d5 94 7d 59 04 08 c7 66 f7 56 ef 2a 12 08 78 60 c4 a0 c1 b2 90 ea 83 c1 83 60 d5 13 54 c2 e0 32 96 da 04 c1 6f a6 08 27 f8 27 15 db c4 5a 3b b1 d0 68 28 e1 1f 09 88 fb 7f f8 9f 50 4b 07 08 4c c3 14 fe ec 11 00 00 ed 35 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 2d 00 61 63 74 69 6f 6e 2e 68 74 6d 6c 55 54 05 00 01 86 b8 26 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 47 49 28 ea 94 da 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 35 8e b1 0e c3 20 0c 44 f7 7c 85 eb bd 61 ed 00 fc 4b 4a 1c 41 4b 20 c2 ae 54 fe be 04 52 2f 27 df b3 4f a7 6f 6b 76 52 0f 02 2f 7b b4 93 fe 0b 2d ab 9d a0 8d de 49 16 70 7e 29 4c 62 f0 23 db fd 81 17 8a 21 bd c1 17 da 0c b2 d4 48 b3 63 46 28 14 af 9d 3d Data Ascii: GE}YfV*x``T2o''Z;h(PKL5PK!-action.htmlUT&f GI(5 D\|aKJAK TR/'OokvR/{-Ip~)Lb#!HcF(=
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: ae 56 6c 38 d8 1d 7a 4e c8 0a 96 b8 8a 28 c0 72 77 86 3b 4f f6 dc c6 58 93 c6 cc 01 12 35 8d 17 40 47 18 ac 77 c7 b9 45 ca f7 e7 20 f6 b0 23 40 bc 3e 17 5e b1 c2 4a 8a ba 79 bb 5d 87 f0 34 84 fe 8a a6 55 ad 6c 6b 7a cf c3 02 28 07 ac 6f c0 ca e9 bc b5 72 b1 f7 76 a2 d7 fa 90 47 c9 65 f3 0f a2 8b 48 08 af d3 02 96 52 14 c4 f1 97 e6 22 c9 83 8b b0 19 24 b3 e6 55 f0 a5 79 0e 34 e9 3c 4f 81 82 85 48 b4 bf 0f 92 e8 02 28 7d f3 66 84 af 61 90 41 91 61 7f 38 ea 35 df c4 61 90 87 cd fc 53 04 ad 34 8b b4 f9 87 2b 6c af 87 bd 60 7b fd d1 93 5f c1 40 c2 24 5f 64 61 73 01 84 8b a7 e6 4d 18 7a 13 9a 9a 37 7b 98 da fb 7b 6e f2 90 a7 d8 c5 37 59 00 88 3d b5 39 48 98 00 bf 38 01 8e f4 29 f8 02 45 5a 49 78 03 9c e4 d4 62 1b 0d 20 c0 61 12 5c 85 c7 9f 01 2e 39 f5 e0 2d 25 Data Ascii: Vl8zN(rw;OX5@GwE #@>^Jy]4Ulkz(orvGeHR"$Uy4<OH(}faAa85aS4+l`{_@$_dasMz7{{n7Y=9H8)EZIxb a\.9-%
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: af d2 e2 9d 32 4a 1c 16 ef e7 e1 5b 94 b4 5b 87 da c4 94 cf d3 45 8c f5 5c 42 15 a4 29 fc a1 6a 4a aa 9b 7b 18 9b 27 f5 04 41 78 66 c4 f3 f9 c4 b7 4e 95 b5 49 7f 06 d4 68 ac c5 8d f5 8a 80 65 3a c2 05 5e 36 1d c1 32 e7 2b 28 b7 8d 48 7a 39 9f 00 7f 39 25 b3 51 88 4c 01 d5 6c f7 16 74 f5 dc 45 22 12 25 8b 70 2c 39 8f b5 44 8b ce a0 b4 2a 2b e9 89 d0 87 57 ab 71 d4 6e 6f 25 75 e6 a0 47 8f 50 73 90 9f 26 b6 a6 90 99 cb db 9a ea 56 63 e5 7a 91 2e 58 53 67 9d 85 2b b1 ed 44 43 57 b6 8b e6 2d 6f eb ce 0a ef 5d 1f 9a 90 3c 7b d0 76 8e aa 4d 6c 5d ce b2 fa 64 01 e5 0e 84 46 41 42 58 9c a4 0a 58 b8 b7 68 e8 4d 94 21 2b d1 06 a1 9a 11 da f6 35 00 42 d9 a0 38 71 ec 0a ee b0 2a d6 d4 b0 5c ea 01 36 70 84 bf b2 47 c8 1c 4a 88 63 93 16 80 0a 33 55 40 84 b0 7e eb c1 fa Data Ascii: 2J[[E\B)jJ{'AxfNIhe:^62+(Hz99%QLltE"%p,9D+Wqno%uGPs&Vcz.XSg+DCW-o]<{vMl]dFABXXhM!+5B8q\6pGJc3U@~
2024-04-25 20:26:03 UTC	1255	IN	Data Raw: 2d 27 d2 64 d0 84 de 24 93 16 7a 40 10 65 02 c2 d2 6c 79 c0 f5 bc 96 7e 5f 21 83 e4 9d 23 5f 89 96 bb 2a c3 86 98 9e 61 cd fd db 3d 1c 14 8a c9 c9 83 4d 8f a7 5e b0 5c 72 0f 40 d3 89 a1 32 c7 7f 5b 33 c7 b8 45 50 99 d8 bf e1 3e 61 a6 dd e2 a2 09 77 8c f3 78 43 35 3a 77 56 a3 73 af f7 84 0b f0 4f 8c 7f a6 80 15 0f f4 81 03 79 7f 2b c6 bf f7 72 84 73 a1 99 fe 38 8c f3 b0 89 45 ee e1 02 47 aa ff 9d 6e 70 ae 61 6c d8 e8 02 77 d2 fc a9 38 e5 5e 70 89 7f 7b 83 e4 ea 5e 05 74 ba 40 b4 96 d4 f0 99 a6 4f ca 0f 8e 35 50 69 29 56 a8 0d 4d 4f 8a d3 b2 ac 4d 69 20 6e e3 af 7f 82 7f 61 8d e0 8f 90 6e 49 c1 22 53 c7 8a b2 24 ab 15 87 19 40 0f a7 ab 2f 14 b0 99 e5 51 37 25 3f bb ad 62 b9 dc 0a d0 2e 66 5a e5 d6 da e0 96 cb 99 26 c1 b9 de 53 22 b8 27 ed f6 9a af f0 31 5d Data Ascii: -'d$z@ely~_!#_*a=M^\r@2[3EP>awxC5:wVsOy+rs8EGnpalw8^p{^t@O5Pi)VMOMi nanI"S$@/Q7%?b.fZ&S"'1]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49809	89.187.167.3	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:06 UTC	598	OUT	GET /delivery/customcmp/86321.js HTTP/1.1 Host: cdn.consentmanager.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:06 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:06 GMT Content-Type: text/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-XSS-Protection: 0 Expires: Thu, 25 Apr 2024 20:44:08 GMT Cache-Control: public, max-age=1800 Edge-Control: public, max-age=1800 Last-Modified: Thu, 25 Apr 2024 20:14:08 GMT X-77-NZT: EwwBWbunAQGzBhAAAAwBuUwKCQGzlgMAAAwBJRPCLgH3zgIAAA X-77-NZT-Ray: 9a26d7264db488fa5ebc2a6658043419 X-Accel-Expires: @1714077848 X-Accel-Date: 1714072664 X-77-Cache: HIT X-77-Age: 1636 Server: CDN77-Turbo X-Cache: EXPIRED X-Age: 4102 X-77-POP: londonGB
2024-04-25 20:26:06 UTC	15227	IN	Data Raw: 33 62 37 33 0d 0a 77 69 6e 64 6f 77 2e 63 6d 70 5f 69 64 20 3d 20 38 36 33 32 31 3b 77 69 6e 64 6f 77 2e 63 6d 70 5f 72 65 61 64 50 61 72 61 6d 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 66 29 7b 76 61 72 20 62 3d 22 64 61 74 61 2d 63 6d 70 2d 22 2b 67 2e 73 70 6c 69 74 28 22 5f 22 29 2e 6a 6f 69 6e 28 22 2d 22 29 3b 76 61 72 20 63 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 5b 64 61 74 61 2d 63 6d 70 2d 69 64 5d 22 29 3b 69 66 28 63 26 26 63 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 62 29 29 7b 72 65 74 75 72 6e 20 63 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 62 29 7d 65 6c 73 65 7b 63 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 5b 64 61 74 61 2d 63 6d 70 2d 63 64 69 64 5d 22 29 3b 69 66 28 63 26 26 Data Ascii: 3b73window.cmp_id = 86321;window.cmp_readParam=function(g,f){var b="data-cmp-"+g.split("_").join("-");var c=document.querySelector("[data-cmp-id]");if(c&&c.hasAttribute(b)){return c.getAttribute(b)}else{c=document.querySelector("[data-cmp-cdid]");if(c&&
2024-04-25 20:26:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49832	89.187.167.3	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:07 UTC	599	OUT	GET /delivery/js/cmp_final.min.js HTTP/1.1 Host: cdn.consentmanager.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:07 UTC	642	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:07 GMT Content-Type: application/javascript Content-Length: 429977 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Wed, 24 Apr 2024 09:35:32 GMT ETag: "68f99-616d4644e6100" Cache-Control: max-age=86400 Expires: Thu, 25 Apr 2024 09:41:22 GMT Edge-Control: max-age=86400 X-77-NZT: EwwBWbunAQH3X5UAAAgBuUwKAQFhDAElE8I0Afe6AAAA X-77-NZT-Ray: 9a26d72605bd72135fbc2a66e3b7d71d X-Accel-Expires: @1714124483 X-Accel-Date: 1714038528 X-77-Cache: HIT X-77-Age: 38239 Server: CDN77-Turbo X-Cache: HIT X-Age: 38239 X-77-POP: londonGB Accept-Ranges: bytes
2024-04-25 20:26:07 UTC	15742	IN	Data Raw: 77 69 6e 64 6f 77 2e 63 6d 70 63 63 73 76 65 72 73 69 6f 6e 62 75 69 6c 64 3d 22 32 30 32 34 2d 34 2d 32 34 2e 39 2e 33 35 22 3b 69 66 28 21 28 22 72 70 6c 22 20 69 6e 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 29 29 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 72 70 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 63 2e 73 70 6c 69 74 28 61 29 2e 6a 6f 69 6e 28 62 29 7d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 66 61 6c 73 65 7d 29 7d 69 66 28 21 28 22 63 6d 70 5f 75 6e 71 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 75 6e 71 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 Data Ascii: window.cmpccsversionbuild="2024-4-24.9.35";if(!("rpl" in String.prototype)){Object.defineProperty(String.prototype,"rpl",{value:function(a,b){var c=this;return c.split(a).join(b)},enumerable:false})}if(!("cmp_unq" in window)){window.cmp_unq=function(a){re
2024-04-25 20:26:07 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 74 68 69 73 2e 72 65 61 64 49 6e 74 28 33 36 29 2a 31 30 30 29 7d 3b 74 68 69 73 2e 72 65 61 64 4c 61 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 72 65 61 64 53 74 72 69 6e 67 28 32 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 3b 74 68 69 73 2e 72 65 61 64 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 76 61 72 20 65 3d 22 22 3b 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 63 3b 64 2b 2b 29 7b 65 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 74 68 69 73 2e 72 65 61 64 49 6e 74 28 36 29 2b 36 35 29 7d 72 65 74 75 72 6e 20 65 7d 3b 74 68 69 73 2e 72 65 61 64 42 6f 6f 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 72 73 65 Data Ascii: ){return new Date(this.readInt(36)*100)};this.readLang=function(){return this.readString(2).toLowerCase()};this.readString=function(c){var e="";for(var d=0;d<c;d++){e+=String.fromCharCode(this.readInt(6)+65)}return e};this.readBool=function(){return parse
2024-04-25 20:26:07 UTC	16384	IN	Data Raw: 72 70 6f 73 65 4f 6e 65 54 72 65 61 74 6d 65 6e 74 3b 63 2e 50 75 62 6c 69 73 68 65 72 43 43 3d 74 68 69 73 2e 50 75 62 6c 69 73 68 65 72 43 43 3b 63 2e 56 65 6e 64 6f 72 73 4c 49 3d 74 68 69 73 2e 56 65 6e 64 6f 72 73 4c 49 3b 63 2e 50 75 62 6c 69 73 68 65 72 52 65 73 74 72 69 63 74 69 6f 6e 73 3d 74 68 69 73 2e 50 75 62 6c 69 73 68 65 72 52 65 73 74 72 69 63 74 69 6f 6e 73 3b 76 61 72 20 64 3d 63 2e 74 6f 53 74 72 69 6e 67 28 29 3b 76 61 72 20 68 3d 74 68 69 73 2e 6e 65 77 46 72 6f 6d 4d 61 6e 69 66 65 73 74 28 32 29 3b 68 2e 69 73 43 75 73 74 6f 6d 46 6f 72 6d 61 74 3d 74 72 75 65 3b 68 2e 72 65 61 64 28 64 29 3b 69 66 28 74 68 69 73 2e 67 70 70 53 65 63 74 69 6f 6e 49 64 73 2e 69 6e 64 65 78 4f 66 28 32 29 3d 3d 2d 31 29 7b 74 68 69 73 2e 67 70 70 53 Data Ascii: rposeOneTreatment;c.PublisherCC=this.PublisherCC;c.VendorsLI=this.VendorsLI;c.PublisherRestrictions=this.PublisherRestrictions;var d=c.toString();var h=this.newFromManifest(2);h.isCustomFormat=true;h.read(d);if(this.gppSectionIds.indexOf(2)==-1){this.gppS
2024-04-25 20:26:08 UTC	16384	IN	Data Raw: 5d 29 7b 66 2e 70 75 73 68 28 63 5b 65 5d 5b 6d 5d 28 29 29 7d 65 6c 73 65 7b 69 66 28 6a 3d 3d 63 5b 65 5d 2e 72 65 70 6c 61 63 65 28 22 2d 22 2c 22 2f 22 29 2b 22 2f 22 7c 7c 6a 3d 3d 22 2f 22 2b 63 5b 65 5d 2e 72 65 70 6c 61 63 65 28 22 2d 22 2c 22 2f 22 29 29 7b 66 2e 70 75 73 68 28 63 5b 65 5d 5b 6d 5d 28 29 29 7d 65 6c 73 65 7b 69 66 28 63 5b 65 5d 2e 6c 65 6e 67 74 68 3d 3d 35 29 7b 76 61 72 20 6b 3d 63 5b 65 5d 2e 73 75 62 73 74 72 69 6e 67 28 33 2c 35 29 2b 22 2d 22 2b 63 5b 65 5d 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 32 29 3b 76 61 72 20 68 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 6b 2e 6c 65 6e 67 74 68 2b 31 29 3b 69 66 28 68 3d 3d 6b 2b 22 2f 22 7c 7c 68 3d 3d 6b 2e 72 65 70 6c 61 63 65 28 22 2d 22 2c 22 2f 22 29 2b 22 2f 22 29 7b 66 2e Data Ascii: ]){f.push(c[e][m]())}else{if(j==c[e].replace("-","/")+"/"\|\|j=="/"+c[e].replace("-","/")){f.push(c[e][m]())}else{if(c[e].length==5){var k=c[e].substring(3,5)+"-"+c[e].substring(0,2);var h=a.substring(0,k.length+1);if(h==k+"/"\|\|h==k.replace("-","/")+"/"){f.
2024-04-25 20:26:08 UTC	16384	IN	Data Raw: 73 74 69 6e 67 55 73 65 72 43 68 6f 69 63 65 3d 66 61 6c 73 65 3b 74 68 69 73 2e 68 61 73 45 78 69 73 74 69 6e 67 55 73 65 72 43 68 6f 69 63 65 54 79 70 65 3d 30 3b 74 68 69 73 2e 70 61 75 73 65 43 68 6f 69 63 65 3d 66 61 6c 73 65 3b 74 68 69 73 2e 70 61 75 73 65 43 68 6f 69 63 65 55 6e 74 69 6c 3d 30 3b 74 68 69 73 2e 76 65 6e 64 6f 72 73 5f 63 6f 6e 73 65 6e 74 53 74 61 74 75 73 3d 7b 7d 3b 74 68 69 73 2e 76 65 6e 64 6f 72 73 5f 6c 69 53 74 61 74 75 73 3d 7b 7d 3b 74 68 69 73 2e 76 65 6e 64 6f 72 73 5f 63 6f 6e 73 65 6e 74 53 65 74 56 69 61 4c 49 3d 7b 7d 3b 74 68 69 73 2e 70 75 72 70 6f 73 65 73 5f 63 6f 6e 73 65 6e 74 53 74 61 74 75 73 3d 7b 7d 3b 74 68 69 73 2e 70 75 72 70 6f 73 65 73 5f 6c 69 53 74 61 74 75 73 3d 7b 7d 3b 74 68 69 73 2e 70 75 72 70 Data Ascii: stingUserChoice=false;this.hasExistingUserChoiceType=0;this.pauseChoice=false;this.pauseChoiceUntil=0;this.vendors_consentStatus={};this.vendors_liStatus={};this.vendors_consentSetViaLI={};this.purposes_consentStatus={};this.purposes_liStatus={};this.purp
2024-04-25 20:26:08 UTC	16384	IN	Data Raw: 47 70 70 46 69 65 6c 64 28 61 2c 22 47 70 63 22 2c 31 29 7d 72 65 74 75 72 6e 20 62 7d 3b 74 68 69 73 2e 61 70 70 6c 79 55 53 43 4f 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 61 3d 22 75 73 63 6f 22 3b 62 2e 53 75 62 56 65 72 73 69 6f 6e 73 2e 70 75 73 68 28 31 30 29 3b 62 2e 73 65 74 47 70 70 46 69 65 6c 64 28 61 2c 22 56 65 72 73 69 6f 6e 22 2c 31 29 3b 76 61 72 20 63 3d 5b 5d 3b 63 2e 70 75 73 68 28 7b 6e 61 6d 65 3a 22 53 68 61 72 69 6e 67 4e 6f 74 69 63 65 22 2c 61 6c 69 61 73 3a 5b 22 53 68 61 72 69 6e 67 4f 70 74 4f 75 74 4e 6f 74 69 63 65 22 2c 22 53 68 61 72 69 6e 67 4f 70 74 4f 75 74 22 5d 2c 74 79 70 65 3a 22 6e 6f 74 69 63 65 22 7d 29 3b 63 2e 70 75 73 68 28 7b 6e 61 6d 65 3a 22 53 61 6c 65 4f 70 74 4f 75 74 4e 6f 74 69 63 65 22 2c 61 Data Ascii: GppField(a,"Gpc",1)}return b};this.applyUSCO=function(b){var a="usco";b.SubVersions.push(10);b.setGppField(a,"Version",1);var c=[];c.push({name:"SharingNotice",alias:["SharingOptOutNotice","SharingOptOut"],type:"notice"});c.push({name:"SaleOptOutNotice",a
2024-04-25 20:26:08 UTC	16384	IN	Data Raw: 6e 67 2c 76 65 72 73 69 6f 6e 3a 22 32 2e 31 22 7d 3b 74 68 69 73 2e 63 62 28 64 2c 61 2c 74 72 75 65 29 3b 72 65 74 75 72 6e 20 61 7d 3b 74 68 69 73 2e 65 78 70 6f 72 74 43 6f 6e 73 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 63 6f 6e 73 65 6e 74 73 74 72 69 6e 67 2b 22 23 22 2b 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 67 65 74 43 50 43 28 29 2b 22 23 22 2b 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 67 65 74 43 56 43 28 29 2b 22 23 22 2b 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 75 73 70 73 53 74 72 69 6e 67 2b 22 23 22 3b 74 72 79 7b 76 61 72 20 61 3d 77 69 6e 64 6f 77 2e 62 74 6f 61 32 28 65 29 7d 63 61 74 63 68 28 62 29 7b 74 72 79 7b 76 61 72 20 61 3d 77 69 6e 64 6f 77 Data Ascii: ng,version:"2.1"};this.cb(d,a,true);return a};this.exportConsent=function(g,h){var e=window.cmpmngr.consentstring+"#"+window.cmpmngr.getCPC()+"#"+window.cmpmngr.getCVC()+"#"+window.cmpmngr.uspsString+"#";try{var a=window.btoa2(e)}catch(b){try{var a=window
2024-04-25 20:26:08 UTC	16384	IN	Data Raw: 69 64 22 29 29 7b 76 61 72 20 66 3d 66 61 6c 73 65 3b 76 61 72 20 6c 3d 63 6d 70 5f 67 63 28 22 61 64 6f 62 65 5f 61 61 22 2c 5b 5d 29 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 6c 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 69 66 28 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 67 65 74 56 65 6e 64 6f 72 43 6f 6e 73 65 6e 74 28 6c 5b 6b 5d 29 29 7b 66 3d 74 72 75 65 3b 62 72 65 61 6b 7d 7d 74 68 69 73 2e 73 65 6e 64 41 64 6f 62 65 53 61 74 54 72 61 63 6b 28 66 29 3b 76 61 72 20 72 3d 66 61 6c 73 65 3b 76 61 72 20 65 3d 63 6d 70 5f 67 63 28 22 61 64 6f 62 65 5f 61 61 6d 22 2c 5b 5d 29 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 65 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 69 66 28 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 67 65 74 56 65 6e 64 6f 72 43 6f 6e Data Ascii: id")){var f=false;var l=cmp_gc("adobe_aa",[]);for(var k=0;k<l.length;k++){if(window.cmpmngr.getVendorConsent(l[k])){f=true;break}}this.sendAdobeSatTrack(f);var r=false;var e=cmp_gc("adobe_aam",[]);for(var k=0;k<e.length;k++){if(window.cmpmngr.getVendorCon
2024-04-25 20:26:08 UTC	16384	IN	Data Raw: 6d 6e 67 72 2e 68 65 6c 70 65 72 5f 67 65 74 56 65 6e 64 6f 72 52 65 73 75 6c 74 28 29 3d 3d 31 3b 69 66 28 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 6c 61 79 65 72 4c 6f 67 69 63 3d 3d 33 29 7b 61 3d 74 72 75 65 7d 65 6c 73 65 7b 69 66 28 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 6c 61 79 65 72 4c 6f 67 69 63 3d 3d 31 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 6c 61 79 65 72 4c 6f 67 69 63 3d 3d 32 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 6c 61 79 65 72 4c 6f 67 69 63 3d 3d 35 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 6c 61 79 65 72 4c 6f 67 69 63 3d 3d 36 29 7b 69 66 28 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 75 73 70 73 53 74 72 69 6e 67 3d 3d 22 31 2d 2d 2d 22 7c 7c 77 69 6e 64 6f 77 2e 63 6d 70 6d 6e 67 72 2e 75 Data Ascii: mngr.helper_getVendorResult()==1;if(window.cmpmngr.layerLogic==3){a=true}else{if(window.cmpmngr.layerLogic==1\|\|window.cmpmngr.layerLogic==2\|\|window.cmpmngr.layerLogic==5\|\|window.cmpmngr.layerLogic==6){if(window.cmpmngr.uspsString=="1---"\|\|window.cmpmngr.u
2024-04-25 20:26:08 UTC	16384	IN	Data Raw: 69 62 75 74 65 49 66 4e 6f 74 45 78 69 73 74 73 28 49 2c 22 64 61 74 61 2d 63 6d 70 2d 68 69 64 65 2d 64 69 73 70 6c 61 79 22 2c 49 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 29 3b 49 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 6d 70 2d 68 69 64 65 2d 68 22 2c 49 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 29 3b 49 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 6d 70 2d 68 69 64 65 2d 6f 76 65 72 66 6c 6f 77 79 22 2c 49 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 29 3b 49 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 6d 70 2d 68 69 64 65 2d 70 6f 73 69 74 69 6f 6e 22 2c 49 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 29 3b 49 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 45 3b 49 2e 73 74 79 6c 65 2e 6f 76 65 Data Ascii: ibuteIfNotExists(I,"data-cmp-hide-display",I.style.display);I.setAttribute("data-cmp-hide-h",I.style.height);I.setAttribute("data-cmp-hide-overflowy",I.style.overflowY);I.setAttribute("data-cmp-hide-position",I.style.position);I.style.height=E;I.style.ove

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49837	87.230.98.78	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:07 UTC	742	OUT	GET /delivery/cmp.php?id=86321&h=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&__cmpfcc=1&l=en&ls=EN_EN_EN&lp=EN&o=1714076766082 HTTP/1.1 Host: delivery.consentmanager.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:08 UTC	409	IN	HTTP/1.1 200 OK date: Thu, 25 Apr 2024 20:26:07 GMT cache-control: no-store, no-cache, must-revalidate edge-control: no-store, no-cache, must-revalidate expires: Thu, 01 Dec 1994 16:00:00 GMT pragma: no-cache access-control-allow-origin: * x-xss-protection: 0 last-modified: Thu, 25 Apr 2024 20:26:07 GMT transfer-encoding: chunked content-type: text/javascript; charset=utf-8 connection: close
2024-04-25 20:26:08 UTC	5343	IN	Data Raw: 31 34 44 37 0d 0a 77 69 6e 64 6f 77 2e 63 6d 70 5f 63 6f 6e 66 69 67 5f 64 61 74 61 5f 63 73 3d 22 22 3b 0d 0a 77 69 6e 64 6f 77 2e 63 6d 70 5f 63 6f 6e 66 69 67 5f 64 61 74 61 3d 7b 22 64 6f 6e 74 53 68 6f 77 22 3a 31 2c 22 64 6f 6e 74 53 68 6f 77 52 65 61 73 6f 6e 22 3a 22 52 65 67 75 6c 61 74 69 6f 6e 3d 30 22 2c 22 69 6e 74 49 44 22 3a 38 36 33 32 31 2c 22 75 69 64 22 3a 34 37 39 36 30 2c 22 64 62 67 64 65 73 69 67 6e 69 64 22 3a 33 30 32 34 36 2c 22 63 6f 6f 6b 69 65 66 72 65 65 22 3a 32 2c 22 73 61 76 65 70 72 65 66 22 3a 30 2c 22 6c 76 74 22 3a 2d 31 2c 22 62 6e 63 22 3a 30 2c 22 62 6e 63 32 22 3a 30 2c 22 62 6e 63 64 22 3a 30 2c 22 69 61 62 69 64 22 3a 33 31 2c 22 68 6f 73 74 22 3a 22 62 2e 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e Data Ascii: 14D7window.cmp_config_data_cs="";window.cmp_config_data={"dontShow":1,"dontShowReason":"Regulation=0","intID":86321,"uid":47960,"dbgdesignid":30246,"cookiefree":2,"savepref":0,"lvt":-1,"bnc":0,"bnc2":0,"bncd":0,"iabid":31,"host":"b.delivery.consentman
2024-04-25 20:26:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49843	47.254.50.103	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:07 UTC	665	OUT	GET /api/v1/checkeu HTTP/1.1 Host: common-info.wondershare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.wondershare.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:07 UTC	480	IN	HTTP/1.1 200 OK Server: Tengine/2.2.0 Date: Thu, 25 Apr 2024 20:09:55 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Expires: Sat, 25 May 2024 20:09:55 GMT Cache-Control: max-age=2592000 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2024-04-25 20:26:07 UTC	44	IN	Data Raw: 32 31 0d 0a 7b 22 63 5f 74 79 70 65 22 3a 30 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 7d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 21{"c_type":0,"country_code":"US"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49854	142.250.105.138	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:07 UTC	393	OUT	GET /webstore/inlineinstall/detail/dhdgffkkebhmkfjojejmpbldmpobfkfo HTTP/1.1 Host: chrome.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:08 UTC	1457	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 25 Apr 2024 20:26:08 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/chromewebstore/2 Content-Security-Policy: script-src 'report-sample' 'nonce-YRrWFzlZSiLPeNXXzjh-nw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';worker-src 'self';report-uri /webstore/cspreport Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="coop_chromewebstore" Report-To: {"group":"coop_chromewebstore","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chromewebstore"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: NID=513=MCgK7c9TJ1Rk28DCNohGhs0ZrVp4V2qS-wqe84GLRlx5DMygC8o8M3cUxU7XPKohsZvDnqUogDu-E6NKR5tWm-HktUHRdvHgGCVKIFO445svMxgPc4BFY6r7sLxW_GqUl8NLvNvbiJr4S74XZsQuvIFHouM5vR62UKXA5N6PUZY; expires=Fri, 25-Oct-2024 20:26:08 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-25 20:26:08 UTC	1457	IN	Data Raw: 63 35 34 0d 0a 7b 22 69 63 6f 6e 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 68 33 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 7a 6f 59 38 46 77 6f 4f 71 50 6c 42 67 46 78 63 6d 46 64 4e 53 4b 32 51 34 43 63 4c 6d 76 2d 67 77 37 76 54 6a 46 32 4b 4d 52 39 63 45 61 62 77 42 73 47 4e 72 48 42 54 45 4d 69 74 6e 30 42 61 36 4f 6d 43 56 4a 30 4e 63 4c 6e 46 47 75 33 4e 39 37 42 50 38 50 68 75 30 67 3d 77 31 32 38 2d 68 31 32 38 2d 65 33 36 35 2d 72 6a 2d 73 63 30 78 30 30 66 66 66 66 66 66 22 2c 22 76 65 72 69 66 69 65 64 5f 73 69 74 65 22 3a 22 74 61 6d 70 65 72 6d 6f 6e 6b 65 79 2e 6e 65 74 22 2c 22 6c 6f 63 61 6c 69 7a 65 64 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 43 68 61 6e 67 65 20 74 68 65 20 77 65 62 20 61 74 20 77 69 Data Ascii: c54{"icon_url":"https://lh3.googleusercontent.com/zoY8FwoOqPlBgFxcmFdNSK2Q4CcLmv-gw7vTjF2KMR9cEabwBsGNrHBTEMitn0Ba6OmCVJ0NcLnFGu3N97BP8Phu0g=w128-h128-e365-rj-sc0x00ffffff","verified_site":"tampermonkey.net","localized_description":"Change the web at wi
2024-04-25 20:26:08 UTC	1457	IN	Data Raw: 20 20 20 5c 22 6e 61 6d 65 5c 22 3a 20 5c 22 5f 5f 4d 53 47 5f 65 78 74 4e 61 6d 65 5f 5f 5c 22 2c 5c 6e 20 20 20 20 5c 22 73 68 6f 72 74 5f 6e 61 6d 65 5c 22 3a 20 5c 22 5f 5f 4d 53 47 5f 65 78 74 53 68 6f 72 74 4e 61 6d 65 5f 5f 5c 22 2c 5c 6e 20 20 20 20 5c 22 64 65 73 63 72 69 70 74 69 6f 6e 5c 22 3a 20 5c 22 5f 5f 4d 53 47 5f 65 78 74 44 65 73 63 72 69 70 74 69 6f 6e 5f 5f 5c 22 2c 5c 6e 20 20 20 20 5c 22 76 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 35 2e 31 2e 31 5c 22 2c 5c 6e 20 20 20 20 5c 22 64 65 66 61 75 6c 74 5f 6c 6f 63 61 6c 65 5c 22 3a 20 5c 22 65 6e 5c 22 2c 5c 6e 20 20 20 20 5c 22 62 61 63 6b 67 72 6f 75 6e 64 5c 22 3a 20 7b 5c 6e 20 20 20 20 20 20 20 5c 22 70 61 67 65 5c 22 3a 20 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2e 68 74 6d 6c 5c 22 5c 6e Data Ascii: \"name\": \"__MSG_extName__\",\n \"short_name\": \"__MSG_extShortName__\",\n \"description\": \"__MSG_extDescription__\",\n \"version\": \"5.1.1\",\n \"default_locale\": \"en\",\n \"background\": {\n \"page\": \"background.html\"\n
2024-04-25 20:26:08 UTC	249	IN	Data Raw: 69 6e 65 5f 69 6e 73 74 61 6c 6c 5f 6e 6f 74 5f 73 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 75 73 65 72 73 22 3a 22 31 30 2c 30 30 30 2c 30 30 30 2b 22 2c 22 72 65 64 69 72 65 63 74 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 68 72 6f 6d 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 77 65 62 73 74 6f 72 65 2f 64 65 74 61 69 6c 2f 74 61 6d 70 65 72 6d 6f 6e 6b 65 79 2f 64 68 64 67 66 66 6b 6b 65 62 68 6d 6b 66 6a 6f 6a 65 6a 6d 70 62 6c 64 6d 70 6f 62 66 6b 66 6f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 69 6e 6c 69 6e 65 2d 69 6e 73 74 61 6c 6c 2d 64 69 73 61 62 6c 65 64 22 2c 22 72 61 74 69 6e 67 5f 63 6f 75 6e 74 22 3a 37 31 31 34 36 2c 22 6c 6f 63 61 6c 69 7a 65 64 5f 6e 61 6d 65 22 3a 22 54 61 6d 70 65 72 6d 6f 6e 6b 65 79 22 7d 0d 0a Data Ascii: ine_install_not_supported":true,"users":"10,000,000+","redirect_url":"https://chrome.google.com/webstore/detail/tampermonkey/dhdgffkkebhmkfjojejmpbldmpobfkfo?utm_source=inline-install-disabled","rating_count":71146,"localized_name":"Tampermonkey"}
2024-04-25 20:26:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49852	47.243.241.30	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:08 UTC	601	OUT	GET /brand/track.2.0.min.js?bid=85021 HTTP/1.1 Host: app.partnerboost.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:09 UTC	362	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 25 Apr 2024 20:26:08 GMT Content-Type: application/javascript Content-Length: 41915 Last-Modified: Thu, 25 Apr 2024 08:52:30 GMT Connection: close Vary: Accept-Encoding ETag: "662a19ce-a3bb" X-UA-Compatible: IE=Edge,chrome=1 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Accept-Ranges: bytes
2024-04-25 20:26:09 UTC	16022	IN	Data Raw: 76 61 72 20 50 42 54 5f 30 78 32 36 65 63 3d 5b 27 77 70 56 79 77 34 2f 44 6d 73 4b 6e 77 34 38 3d 27 2c 27 42 63 4b 2b 63 6b 66 43 75 79 77 3d 27 2c 27 4d 4d 4f 66 46 54 35 5a 27 2c 27 63 73 4b 73 45 38 4f 48 77 36 54 44 72 63 4b 46 77 37 67 2f 27 2c 27 77 72 4d 67 63 63 4b 2f 27 2c 27 77 37 33 43 6c 51 52 69 65 45 59 74 27 2c 27 77 34 54 44 71 63 4f 58 4b 38 4f 4a 77 34 49 77 27 2c 27 77 34 6f 6c 62 67 3d 3d 27 2c 27 77 36 35 7a 4e 4d 4b 79 58 69 50 44 75 32 55 44 77 6f 2f 44 6f 67 66 44 6e 55 7a 44 70 38 4b 4f 77 70 2f 43 6b 32 74 2b 77 6f 48 44 6a 55 74 61 77 36 37 43 67 4d 4f 62 77 34 34 48 77 36 6a 44 76 52 45 3d 27 2c 27 63 63 4b 6c 77 71 4c 44 72 38 4f 50 27 2c 27 77 72 45 73 46 48 72 44 6f 63 4f 36 58 4d 4b 32 77 36 5a 78 47 63 4b 66 4d 6e 33 43 Data Ascii: var PBT_0x26ec=['wpVyw4/DmsKnw48=','BcK+ckfCuyw=','MMOfFT5Z','csKsE8OHw6TDrcKFw7g/','wrMgccK/','w73ClQRieEYt','w4TDqcOXK8OJw4Iw','w4olbg==','w65zNMKyXiPDu2UDwo/DogfDnUzDp8KOwp/Ck2t+woHDjUtaw67CgMObw44Hw6jDvRE=','ccKlwqLDr8OP','wrEsFHrDocO6XMK2w6ZxGcKfMn3C
2024-04-25 20:26:09 UTC	16384	IN	Data Raw: 70 73 27 2c 27 70 74 27 2c 27 70 77 27 2c 27 70 79 27 2c 27 71 61 27 2c 27 72 65 27 2c 27 72 6f 27 2c 27 72 77 27 2c 27 73 61 27 2c 27 73 62 27 2c 27 73 63 27 2c 27 73 64 27 2c 27 73 67 27 2c 27 73 68 27 2c 27 73 69 27 2c 27 73 6b 27 2c 27 73 6c 27 2c 27 73 6d 27 2c 27 73 6e 27 2c 27 73 72 27 2c 27 73 74 27 2c 27 73 76 27 2c 27 73 79 27 2c 27 73 7a 27 2c 27 74 63 27 2c 27 74 66 27 2c 27 74 67 27 2c 27 74 68 27 2c 27 74 6a 27 2c 27 74 6b 27 2c 27 74 6c 27 2c 27 74 6d 27 2c 27 74 6e 27 2c 27 74 6f 27 2c 27 74 70 27 2c 27 74 72 27 2c 27 74 74 27 2c 27 74 76 27 2c 27 74 77 27 2c 27 74 7a 27 2c 27 75 61 27 2c 27 75 67 27 2c 27 75 79 27 2c 27 75 7a 27 2c 27 76 61 27 2c 27 76 63 27 2c 27 76 65 27 2c 27 76 67 27 2c 27 76 69 27 2c 27 76 6e 27 2c 27 76 75 27 2c 27 Data Ascii: ps','pt','pw','py','qa','re','ro','rw','sa','sb','sc','sd','sg','sh','si','sk','sl','sm','sn','sr','st','sv','sy','sz','tc','tf','tg','th','tj','tk','tl','tm','tn','to','tp','tr','tt','tv','tw','tz','ua','ug','uy','uz','va','vc','ve','vg','vi','vn','vu','
2024-04-25 20:26:09 UTC	9509	IN	Data Raw: 64 35 36 61 29 7b 72 65 74 75 72 6e 20 5f 30 78 31 37 64 35 36 61 3b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 7d 3b 5f 30 78 33 34 38 36 63 64 5b 50 42 54 5f 30 78 33 31 37 61 28 27 30 78 31 61 36 27 2c 27 75 6e 66 75 27 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 62 39 31 38 36 2c 5f 30 78 35 37 61 30 35 33 2c 5f 30 78 33 61 38 33 66 63 29 7b 5f 30 78 33 34 38 36 63 64 5b 50 42 54 5f 30 78 33 31 37 61 28 27 30 78 62 35 27 2c 27 25 38 51 70 27 29 5d 28 50 42 54 5f 30 78 33 31 37 61 28 27 30 78 63 33 27 2c 27 73 35 51 78 27 29 2c 5f 30 78 33 62 39 31 38 36 2c 5f 30 78 35 37 61 30 35 33 2c 5f 30 78 33 61 38 33 66 63 29 3b 69 66 28 77 69 6e 64 6f 77 5b 50 42 54 5f 30 78 33 31 37 61 28 27 30 78 62 32 27 2c 27 53 78 55 74 27 29 5d 29 7b 72 65 74 75 72 6e 20 Data Ascii: d56a){return _0x17d56a;}return null;};_0x3486cd[PBT_0x317a('0x1a6','unfu')]=function(_0x3b9186,_0x57a053,_0x3a83fc){_0x3486cd[PBT_0x317a('0xb5','%8Qp')](PBT_0x317a('0xc3','s5Qx'),_0x3b9186,_0x57a053,_0x3a83fc);if(window[PBT_0x317a('0xb2','SxUt')]){return

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49866	47.254.50.103	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:08 UTC	549	OUT	GET /api/v1/checkeu HTTP/1.1 Host: common-info.wondershare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _gcl_au=1.1.1367721842.1714076765; srcSite=www.wondershare.com; referrer=; _uetsid=0b3e81f0034211ef80523331be39900f; _uetvid=0b3ea370034211ef8f1ecfac22ceebac; gdprAgree-eu=no
2024-04-25 20:26:08 UTC	480	IN	HTTP/1.1 200 OK Server: Tengine/2.2.0 Date: Thu, 25 Apr 2024 18:04:12 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Expires: Sat, 25 May 2024 18:04:12 GMT Cache-Control: max-age=2592000 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
2024-04-25 20:26:08 UTC	44	IN	Data Raw: 32 31 0d 0a 7b 22 63 5f 74 79 70 65 22 3a 30 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 7d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 21{"c_type":0,"country_code":"US"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49882	18.165.98.11	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:09 UTC	580	OUT	GET /clk.min.js HTTP/1.1 Host: analytics.webgains.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:09 UTC	533	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 57065 Connection: close Last-Modified: Fri, 19 Apr 2024 09:51:17 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 25 Apr 2024 10:08:44 GMT ETag: "98b7a5233450de9ed1142fdc8a41aee7" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4091abb8cac392d8bc54145a27288bc6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P4 X-Amz-Cf-Id: mtU4A8R7nayfINC4wafTWV8hLax1GFgOc_CB--_pZbfJ8lBcnJY38A== Age: 37045
2024-04-25 20:26:09 UTC	15851	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 38 32 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 3b 21 66 75 6e 63 74 69 6f 6e 28 6f 2c 61 2c 73 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 6e 2e 61 6d 64 4f 3f 76 6f 69 64 20 30 3d 3d 3d 28 69 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 72 3d 73 29 3f 72 2e 63 61 6c 6c 28 74 2c 6e 2c 74 2c 65 29 3a 72 29 7c 7c 28 65 2e 65 78 70 6f 72 74 73 3d 69 29 3a 65 2e 65 78 70 6f 72 74 73 3f 65 2e 65 78 70 6f 72 74 73 3d 73 28 29 3a 61 2e 65 78 70 6f 72 74 73 3f 61 2e 65 78 70 6f 72 74 73 3d 73 28 29 3a 61 2e 46 69 6e 67 65 72 70 72 69 6e 74 32 3d 73 28 29 7d 28 30 2c 74 68 69 73 2c 28 66 75 6e Data Ascii: (()=>{var e={820:function(e,t,n){var r,i;!function(o,a,s){"use strict";"undefined"!=typeof window&&n.amdO?void 0===(i="function"==typeof(r=s)?r.call(t,n,t,e):r)\|\|(e.exports=i):e.exports?e.exports=s():a.exports?a.exports=s():a.Fingerprint2=s()}(0,this,(fun
2024-04-25 20:26:09 UTC	16384	IN	Data Raw: 74 75 72 6e 21 30 3b 69 66 28 6e 2e 69 6e 64 65 78 4f 66 28 22 6c 69 6e 75 78 22 29 3e 3d 30 26 26 22 4c 69 6e 75 78 22 21 3d 3d 65 26 26 22 41 6e 64 72 6f 69 64 22 21 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 69 66 28 6e 2e 69 6e 64 65 78 4f 66 28 22 6d 61 63 22 29 3e 3d 30 26 26 22 4d 61 63 22 21 3d 3d 65 26 26 22 69 4f 53 22 21 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 69 66 28 28 2d 31 3d 3d 3d 6e 2e 69 6e 64 65 78 4f 66 28 22 77 69 6e 22 29 26 26 2d 31 3d 3d 3d 6e 2e 69 6e 64 65 78 4f 66 28 22 6c 69 6e 75 78 22 29 26 26 2d 31 3d 3d 3d 6e 2e 69 6e 64 65 78 4f 66 28 22 6d 61 63 22 29 29 21 3d 28 22 4f 74 68 65 72 22 3d 3d 3d 65 29 29 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 20 72 2e 69 6e 64 65 78 4f 66 28 22 77 69 6e 22 29 3e 3d 30 26 26 22 57 69 6e 64 Data Ascii: turn!0;if(n.indexOf("linux")>=0&&"Linux"!==e&&"Android"!==e)return!0;if(n.indexOf("mac")>=0&&"Mac"!==e&&"iOS"!==e)return!0;if((-1===n.indexOf("win")&&-1===n.indexOf("linux")&&-1===n.indexOf("mac"))!=("Other"===e))return!0}return r.indexOf("win")>=0&&"Wind
2024-04-25 20:26:09 UTC	16384	IN	Data Raw: 67 63 61 6d 70 61 69 67 6e 69 64 3d 22 2b 74 2b 22 26 63 6c 69 63 6b 52 65 66 65 72 65 6e 63 65 3d 22 2b 6e 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 6e 64 70 6f 69 6e 74 2b 72 7d 2c 73 65 74 45 6c 61 70 73 65 64 54 69 6d 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 73 68 6f 75 6c 64 54 72 61 63 6b 54 69 6d 65 26 26 28 65 2e 65 6c 61 70 73 65 64 54 69 6d 65 3d 74 68 69 73 2e 67 65 74 45 6c 61 70 73 65 64 54 69 6d 65 28 29 29 7d 7d 7d 2c 36 36 33 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 63 6f 6e 73 74 20 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 29 29 7d 2c 69 3d 5b 4a 53 4f 4e 2e 70 61 72 73 65 28 22 74 72 75 65 22 29 26 26 6e 28 31 34 37 Data Ascii: gcampaignid="+t+"&clickReference="+n;return this.endpoint+r},setElapsedTime:function(e){this.shouldTrackTime&&(e.elapsedTime=this.getElapsedTime())}}},663:(e,t,n)=>{const r=function(e){return e.filter((function(e){return e}))},i=[JSON.parse("true")&&n(147
2024-04-25 20:26:09 UTC	8446	IN	Data Raw: 3d 3d 65 2e 76 61 6c 75 65 7d 29 29 7d 2c 68 61 6e 64 6c 65 43 6c 69 63 6b 50 72 6f 6d 69 73 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 65 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 74 2e 68 61 73 52 75 6e 26 26 74 2e 73 74 6f 72 65 49 64 65 6e 74 69 66 69 65 72 73 28 65 29 7d 29 29 2e 63 61 74 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 6e 3d 75 2e 62 75 69 6c 64 28 22 68 61 6e 64 6c 65 43 6c 69 63 6b 50 72 6f 6d 69 73 65 22 2c 65 29 3b 74 2e 6e 6f 74 69 66 79 45 72 72 6f 72 28 6e 29 7d 29 29 2e 74 68 65 6e 28 74 2e 66 69 6e 69 73 68 2e 62 69 6e 64 28 74 29 29 7d 2c 67 65 74 54 72 61 63 6b 49 64 4d 6f 64 75 6c 65 73 3a 66 75 6e 63 74 69 6f Data Ascii: ==e.value}))},handleClickPromise:function(e){const t=this;return e.then((function(e){return!t.hasRun&&t.storeIdentifiers(e)})).catch((function(e){const n=u.build("handleClickPromise",e);t.notifyError(n)})).then(t.finish.bind(t))},getTrackIdModules:functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49886	3.163.101.90	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:09 UTC	570	OUT	GET /20200.js HTTP/1.1 Host: www.dwin1.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:10 UTC	747	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 44211 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD x-amz-replication-status: COMPLETED Last-Modified: Tue, 16 Apr 2024 08:53:20 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: bGyTt7jKzJgipt_GKMG7WxSIIXagSPZA Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 25 Apr 2024 20:26:10 GMT Cache-Control: max-age=600, s-maxage=600 ETag: "43939098f65ea189a1f42a8b3d005118" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 94bfb7d862be49d4dc2eadc0fd2c452a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P8 X-Amz-Cf-Id: PdRe6Kjn3H3sYI-6ibzS7byICO3EyG8j5E9v0pS-cMVP_SQzZis-gw==
2024-04-25 20:26:10 UTC	16384	IN	Data Raw: 76 61 72 20 41 57 49 4e 3d 41 57 49 4e 7c 7c 7b 7d 3b 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 7c 7c 7b 7d 2c 41 57 49 4e 2e 73 50 72 6f 74 6f 63 6f 6c 3d 22 68 74 74 70 73 3a 22 3d 3d 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 3f 22 68 74 74 70 73 3a 2f 2f 22 3a 22 68 74 74 70 3a 2f 2f 22 2c 41 57 49 4e 2e 69 53 63 72 69 70 74 43 6f 75 6e 74 3d 30 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 64 65 76 69 63 65 39 55 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 73 63 69 65 6e 63 65 62 65 68 69 6e 64 65 63 6f 6d 6d 65 72 63 65 2e 63 6f 6d 2f 64 39 63 6f 72 65 22 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 66 6c 61 67 73 3d 7b 61 6c 6c 6f 77 4e 65 77 41 57 43 43 6f 6f 6b 69 65 3a 21 30 2c 61 6c 6c 6f 77 4e Data Ascii: var AWIN=AWIN\|\|{};AWIN.Tracking=AWIN.Tracking\|\|{},AWIN.sProtocol="https:"==location.protocol?"https://":"http://",AWIN.iScriptCount=0,AWIN.Tracking.device9Url="https://the.sciencebehindecommerce.com/d9core",AWIN.Tracking.flags={allowNewAWCCookie:!0,allowN
2024-04-25 20:26:10 UTC	16384	IN	Data Raw: 74 6f 6d 45 76 65 6e 74 3d 77 69 6e 64 6f 77 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 43 6f 6e 73 65 6e 74 3d 7b 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 72 3d 21 31 2c 74 3d 21 31 2c 61 3d 21 31 2c 69 3d 21 31 2c 63 3d 2f 5f 61 77 5f 73 6e 5f 5c 64 2b 2f 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 3f 22 74 72 75 65 22 3d 3d 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 22 66 61 6c 73 65 22 3d 3d 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7c 7c 22 31 22 3d 3d 3d 65 7c 7c 22 30 22 3d 3d 3d 65 3a 31 3d 3d 65 7c 7c 30 3d 3d 65 7d 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 Data Ascii: tomEvent=window.CustomEvent,AWIN.Tracking.Consent={},function(e){var n,r=!1,t=!1,a=!1,i=!1,c=/_aw_sn_\d+/;function o(e){return"string"==typeof e?"true"===e.toLowerCase()\|\|"false"===e.toLowerCase()\|\|"1"===e\|\|"0"===e:1==e\|\|0==e}function s(e){if("string"==ty
2024-04-25 20:26:10 UTC	8806	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 65 2e 73 65 6e 64 44 65 62 75 67 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 29 74 72 79 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 28 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 65 29 29 2c 65 2e 62 6f 64 79 2e 69 73 49 45 3d 28 72 3d 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2c 2f 54 72 69 64 65 6e 74 7c 4d 53 49 45 2f 2e 74 65 73 74 28 72 29 29 2c 65 2e 62 6f 64 79 2e 69 73 53 61 6c 65 3d 76 6f 69 64 20 30 21 3d 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 53 61 6c 65 2c 65 2e 62 6f 64 79 2e 68 61 73 41 77 63 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 67 65 Data Ascii: tion(e){e.sendDebugEvent=function(e,n){if("function"==typeof navigator.sendBeacon)try{"string"==typeof e&&(e=JSON.parse(e)),e.body.isIE=(r=navigator.userAgent,/Trident\|MSIE/.test(r)),e.body.isSale=void 0!==AWIN.Tracking.Sale,e.body.hasAwc=AWIN.Tracking.ge
2024-04-25 20:26:10 UTC	2637	IN	Data Raw: 67 2e 67 65 74 43 6f 6f 6b 69 65 73 41 73 53 74 72 69 6e 67 28 2f 5f 61 77 5f 61 74 70 2f 29 29 3b 69 3e 30 26 26 28 61 3d 22 26 61 74 70 3d 22 2b 69 29 7d 76 61 72 20 63 3d 65 2e 63 75 73 74 6f 6d 4c 50 61 72 61 6d 65 74 65 72 3b 22 66 63 22 3d 3d 6e 26 26 28 63 3d 65 73 63 61 70 65 28 63 29 29 3b 76 61 72 20 6f 3d 22 22 3b 31 3d 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 53 61 6c 65 2e 70 76 4f 6e 6c 79 26 26 28 6f 3d 22 26 70 76 3d 31 22 29 3b 76 61 72 20 73 3d 41 57 49 4e 2e 73 50 72 6f 74 6f 63 6f 6c 2b 22 77 77 77 2e 61 77 69 6e 31 2e 63 6f 6d 2f 73 72 65 61 64 2e 22 2b 72 2b 22 3f 61 3d 22 2b 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 69 4d 65 72 63 68 61 6e 74 49 64 2b 22 26 62 3d 22 2b 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 53 61 6c 65 2e 61 Data Ascii: g.getCookiesAsString(/_aw_atp/));i>0&&(a="&atp="+i)}var c=e.customLParameter;"fc"==n&&(c=escape(c));var o="";1==AWIN.Tracking.Sale.pvOnly&&(o="&pv=1");var s=AWIN.sProtocol+"www.awin1.com/sread."+r+"?a="+AWIN.Tracking.iMerchantId+"&b="+AWIN.Tracking.Sale.a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49887	3.163.101.90	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:09 UTC	570	OUT	GET /19038.js HTTP/1.1 Host: www.dwin1.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:09 UTC	750	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 41842 Connection: close Date: Thu, 25 Apr 2024 20:19:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD x-amz-replication-status: COMPLETED Last-Modified: Wed, 24 May 2023 10:09:50 GMT ETag: "9575e6eeef2b4a42e72a0401cbc03c24" x-amz-server-side-encryption: AES256 Cache-Control: max-age=600, s-maxage=600 x-amz-version-id: zR32WRrkE_nbij0xnr90P7uyNi3RXSM2 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 93309f2e8a93384beeedfcc4af03fcb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P8 X-Amz-Cf-Id: VBOV0_GeUbBQgd09QfOFkHbBm5IQl1Livpx1_FjyDVbmdM3pEBloMw== Age: 430
2024-04-25 20:26:09 UTC	15634	IN	Data Raw: 76 61 72 20 41 57 49 4e 3d 41 57 49 4e 7c 7c 7b 7d 3b 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 7c 7c 7b 7d 2c 41 57 49 4e 2e 73 50 72 6f 74 6f 63 6f 6c 3d 22 68 74 74 70 73 3a 22 3d 3d 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 3f 22 68 74 74 70 73 3a 2f 2f 22 3a 22 68 74 74 70 3a 2f 2f 22 2c 41 57 49 4e 2e 69 53 63 72 69 70 74 43 6f 75 6e 74 3d 30 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 64 65 76 69 63 65 39 55 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 74 68 65 2e 73 63 69 65 6e 63 65 62 65 68 69 6e 64 65 63 6f 6d 6d 65 72 63 65 2e 63 6f 6d 2f 64 39 63 6f 72 65 22 2c 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 66 6c 61 67 73 3d 7b 61 6c 6c 6f 77 4e 65 77 41 57 43 43 6f 6f 6b 69 65 3a 21 30 2c 61 6c 6c 6f 77 4e Data Ascii: var AWIN=AWIN\|\|{};AWIN.Tracking=AWIN.Tracking\|\|{},AWIN.sProtocol="https:"==location.protocol?"https://":"http://",AWIN.iScriptCount=0,AWIN.Tracking.device9Url="https://the.sciencebehindecommerce.com/d9core",AWIN.Tracking.flags={allowNewAWCCookie:!0,allowN
2024-04-25 20:26:09 UTC	16384	IN	Data Raw: 65 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 67 65 74 41 57 43 6f 6f 6b 69 65 73 28 29 2c 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 72 3d 65 5b 6e 5d 5b 30 5d 2c 74 3d 65 5b 6e 5d 5b 31 5d 3b 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 73 65 74 43 6f 6f 6b 69 65 28 72 2c 74 2c 31 29 3b 76 61 72 20 61 3d 74 2e 73 70 6c 69 74 28 22 5f 22 29 2c 69 3d 33 31 35 33 36 65 33 2b 70 61 72 73 65 49 6e 74 28 61 5b 31 5d 29 3b 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 73 65 74 43 6f 6f 6b 69 65 28 72 2c 74 2c 69 29 7d 7d 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 43 75 73 74 6f 6d 45 76 65 6e 74 3f 77 69 6e 64 6f 77 2e 41 77 69 6e 43 75 73 74 6f 6d 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c Data Ascii: e=AWIN.Tracking.getAWCookies(),n=0;n<e.length;n++){var r=e[n][0],t=e[n][1];AWIN.Tracking.setCookie(r,t,1);var a=t.split("_"),i=31536e3+parseInt(a[1]);AWIN.Tracking.setCookie(r,t,i)}},"function"!=typeof window.CustomEvent?window.AwinCustomEvent=function(e,
2024-04-25 20:26:09 UTC	9824	IN	Data Raw: 20 65 72 72 6f 72 22 7d 2c 69 73 49 45 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 2f 54 72 69 64 65 6e 74 7c 4d 53 49 45 2f 2e 74 65 73 74 28 65 29 7d 2c 73 65 6e 64 44 65 62 75 67 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 29 74 72 79 7b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 28 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 65 29 29 2c 65 2e 62 6f 64 79 2e 69 73 49 45 3d 69 73 49 45 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 2c 65 2e 62 6f 64 79 2e 69 73 53 61 6c 65 3d 76 6f 69 64 20 30 21 3d 3d 41 57 49 4e 2e 54 72 61 63 6b 69 6e 67 2e 53 61 6c 65 2c 65 2e 62 6f 64 Data Ascii: error"},isIE=function(e){return/Trident\|MSIE/.test(e)},sendDebugEvent=function(e,n){if("function"==typeof navigator.sendBeacon)try{"string"==typeof e&&(e=JSON.parse(e)),e.body.isIE=isIE(navigator.userAgent),e.body.isSale=void 0!==AWIN.Tracking.Sale,e.bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49890	172.67.22.39	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:09 UTC	592	OUT	GET /uts_lp.php?cgid=900133 HTTP/1.1 Host: www.linkconnector.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:09 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:09 GMT Content-Type: text/javascript; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-content-type-options: nosniff Access-Control-Allow-Origin: https://www.wondershare.com timing-allow-origin: * Cache-Control: no-cache, must-revalidate Set-Cookie: uts_900133_lpcheck=1; expires=Thu, 25-Apr-2024 21:26:09 GMT; Max-Age=3600; path=/; samesite=none; domain=.linkconnector.com; secure Vary: Accept-Encoding X-Server: lcweb1 P3P: CP="NOI DSP COR NID CUR OUR NOR" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a11102bd8153ed-ATL
2024-04-25 20:26:09 UTC	762	IN	Data Raw: 32 31 36 36 0d 0a 76 61 72 20 75 74 73 5f 69 70 20 3d 20 27 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 27 3b 0d 0a 76 61 72 20 75 74 73 5f 72 65 66 72 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 6f 6e 64 65 72 73 68 61 72 65 2e 63 6f 6d 2f 67 75 69 64 65 2f 66 72 65 65 2d 79 6f 75 74 75 62 65 2d 64 6f 77 6e 6c 6f 61 64 65 72 2e 68 74 6d 6c 3f 61 63 74 3d 69 6e 73 74 61 6c 6c 27 3b 0d 0a 76 61 72 20 75 74 73 5f 70 72 6f 74 6f 63 6f 6c 20 3d 20 27 27 3b 0d 0a 76 61 72 20 75 74 73 5f 6e 6f 77 20 3d 20 27 32 30 32 34 2d 30 34 2d 32 35 20 31 33 3a 32 36 3a 30 39 27 3b 0d 0a 76 61 72 20 75 74 73 5f 64 6e 74 20 3d 20 27 30 27 3b 0a 76 61 72 20 75 74 73 5f 6c 63 5f 63 6f 6f 6b 69 65 76 61 6c 75 65 20 3d 20 27 27 3b 0a 76 61 72 20 75 74 73 5f 6c 63 5f 75 74 Data Ascii: 2166var uts_ip = '185.152.66.230';var uts_refr = 'https://www.wondershare.com/guide/free-youtube-downloader.html?act=install';var uts_protocol = '';var uts_now = '2024-04-25 13:26:09';var uts_dnt = '0';var uts_lc_cookievalue = '';var uts_lc_ut
2024-04-25 20:26:09 UTC	1369	IN	Data Raw: 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 68 65 69 67 68 74 22 2c 22 31 22 29 3b 78 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 77 69 64 74 68 22 2c 22 31 22 29 3b 74 72 79 7b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 78 29 7d 0a 63 61 74 63 68 28 65 29 7b 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 78 29 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 75 74 73 5f 72 65 61 64 43 6f 6f 6b 69 65 28 6e 61 6d 65 29 7b 76 61 72 20 6e 61 6d 65 45 51 3d 6e 61 6d 65 2b 22 3d 22 3b 76 61 72 20 63 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 2e 73 70 6c 69 74 28 27 3b 27 29 3b 66 6f 72 28 76 61 72 20 69 3d 30 3b 69 3c 63 61 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 0a 7b 76 61 72 20 63 3d 63 61 5b 69 5d Data Ascii: .setAttribute("height","1");x.setAttribute("width","1");try{document.body.appendChild(x)}catch(e){document.head.appendChild(x)}}function uts_readCookie(name){var nameEQ=name+"=";var ca=document.cookie.split(';');for(var i=0;i<ca.length;i++){var c=ca[i]
2024-04-25 20:26:09 UTC	1369	IN	Data Raw: 20 6f 3d 27 27 3b 76 61 72 20 69 6e 70 75 74 5f 63 68 61 72 61 63 74 65 72 5f 70 6f 73 3d 27 27 3b 66 6f 72 28 69 3d 30 3b 69 3c 76 2e 6c 65 6e 67 74 68 3b 69 2b 2b 29 7b 69 6e 70 75 74 5f 63 68 61 72 61 63 74 65 72 5f 70 6f 73 3d 73 2e 69 6e 64 65 78 4f 66 28 76 2e 63 68 61 72 41 74 28 69 29 29 3b 6f 2b 3d 62 2e 63 68 61 72 41 74 28 69 6e 70 75 74 5f 63 68 61 72 61 63 74 65 72 5f 70 6f 73 29 7d 0a 72 65 74 75 72 6e 20 6f 7d 0a 66 75 6e 63 74 69 6f 6e 20 75 74 73 5f 67 65 74 4c 53 43 6f 6f 6b 69 65 28 63 5f 6e 61 6d 65 29 7b 72 65 74 75 72 6e 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 63 5f 6e 61 6d 65 29 7d 0a 66 75 6e 63 74 69 6f 6e 20 75 74 73 5f 73 65 74 4c 53 43 6f 6f 6b 69 65 28 63 5f 6e 61 6d 65 2c 76 61 6c 75 65 29 7b 72 65 Data Ascii: o='';var input_character_pos='';for(i=0;i<v.length;i++){input_character_pos=s.indexOf(v.charAt(i));o+=b.charAt(input_character_pos)}return o}function uts_getLSCookie(c_name){return localStorage.getItem(c_name)}function uts_setLSCookie(c_name,value){re
2024-04-25 20:26:09 UTC	1369	IN	Data Raw: 70 6c 69 74 28 27 3b 27 29 3b 69 66 28 75 69 64 5f 63 61 29 7b 76 61 72 20 75 69 64 5f 75 72 6c 3d 75 74 73 5f 70 72 6f 74 6f 63 6f 6c 2b 27 2f 2f 27 2b 75 74 73 5f 63 61 6c 6c 69 6e 67 5f 64 6f 6d 61 69 6e 2b 27 2f 74 75 2e 70 68 70 3f 70 69 64 3d 27 2b 75 69 64 5f 63 75 73 74 6f 6d 65 72 69 64 2b 27 26 6e 76 3d 27 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 75 69 64 5f 63 61 29 3b 49 6d 67 46 75 6e 63 74 69 6f 6e 28 75 69 64 5f 75 72 6c 29 7d 0a 76 61 72 20 75 74 73 5f 75 69 64 5f 63 75 72 6c 3d 75 74 73 5f 70 72 6f 74 6f 63 6f 6c 2b 27 2f 2f 27 2b 75 74 73 5f 63 61 6c 6c 69 6e 67 5f 64 6f 6d 61 69 6e 2b 27 2f 6a 73 2f 75 74 73 5f 75 69 64 2e 70 68 70 3f 63 67 69 64 3d 27 2b 75 74 73 5f 63 67 69 64 2b 27 26 75 74 73 5f 70 72 6f 74 6f 63 Data Ascii: plit(';');if(uid_ca){var uid_url=uts_protocol+'//'+uts_calling_domain+'/tu.php?pid='+uid_customerid+'&nv='+encodeURIComponent(uid_ca);ImgFunction(uid_url)}var uts_uid_curl=uts_protocol+'//'+uts_calling_domain+'/js/uts_uid.php?cgid='+uts_cgid+'&uts_protoc
2024-04-25 20:26:09 UTC	1369	IN	Data Raw: 72 72 65 72 26 26 74 6f 70 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 21 3d 27 27 29 7b 6c 63 5f 61 72 65 66 3d 74 6f 70 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 7d 0a 65 6c 73 65 20 69 66 28 73 65 6c 66 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 26 26 73 65 6c 66 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 21 3d 27 27 29 7b 6c 63 5f 61 72 65 66 3d 73 65 6c 66 2e 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 7d 0a 76 61 72 20 75 74 73 5f 77 63 6f 6f 6b 69 65 3d 21 30 3b 69 66 28 21 75 74 73 5f 63 6f 6f 6b 69 65 76 61 6c 29 7b 75 74 73 5f 63 6f 6f 6b 69 65 76 61 6c 3d 75 74 73 5f 72 65 61 64 43 6f 6f 6b 69 65 28 75 74 73 5f 74 72 61 66 66 69 63 6e 61 6d 65 29 7d 0a 69 66 28 21 75 74 73 5f 63 6f 6f 6b 69 65 Data Ascii: rrer&&top.document.referrer!=''){lc_aref=top.document.referrer}else if(self.document.referrer&&self.document.referrer!=''){lc_aref=self.document.referrer}var uts_wcookie=!0;if(!uts_cookieval){uts_cookieval=uts_readCookie(uts_trafficname)}if(!uts_cookie
2024-04-25 20:26:09 UTC	1369	IN	Data Raw: 61 72 72 2e 70 75 73 68 28 75 74 73 5f 6e 6c 63 69 64 29 7d 7d 0a 76 61 72 20 75 74 73 5f 6d 6c 63 69 64 3d 75 74 73 5f 67 65 74 4c 53 43 6f 6f 6b 69 65 28 27 6c 63 69 64 27 29 3b 69 66 28 75 74 73 5f 6d 6c 63 69 64 3d 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 75 74 73 5f 6d 6c 63 69 64 3d 75 74 73 5f 72 65 61 64 43 6f 6f 6b 69 65 28 27 6c 63 69 64 27 29 7d 0a 69 66 28 75 74 73 5f 6d 6c 63 69 64 3d 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 75 74 73 5f 6d 6c 63 69 64 3d 75 74 73 5f 6c 63 69 64 7d 0a 69 66 28 75 74 73 5f 6d 6c 63 69 64 2e 73 65 61 72 63 68 28 27 4c 43 27 29 3d 3d 2d 31 29 7b 76 61 72 20 64 61 74 65 54 69 6d 65 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 76 61 72 20 75 74 73 5f 6d 6c 63 69 64 3d 27 4c 43 27 2b 4d 61 74 68 2e 66 6c 6f 6f 72 28 64 61 74 65 54 69 Data Ascii: arr.push(uts_nlcid)}}var uts_mlcid=uts_getLSCookie('lcid');if(uts_mlcid===null){var uts_mlcid=uts_readCookie('lcid')}if(uts_mlcid===null){var uts_mlcid=uts_lcid}if(uts_mlcid.search('LC')==-1){var dateTime=Date.now();var uts_mlcid='LC'+Math.floor(dateTi
2024-04-25 20:26:09 UTC	951	IN	Data Raw: 5f 63 6a 5f 67 75 79 29 7b 76 61 72 20 63 6a 5f 76 61 6c 3d 75 74 73 5f 67 65 74 51 75 65 72 79 53 74 72 69 6e 67 56 61 6c 75 65 28 27 63 6a 65 76 65 6e 74 27 29 3b 69 66 28 63 6a 5f 76 61 6c 29 7b 65 78 64 61 74 65 2e 73 65 74 54 69 6d 65 28 65 78 64 61 74 65 2e 67 65 74 54 69 6d 65 28 29 2b 28 75 74 73 5f 64 75 72 61 74 69 6f 6e 2a 32 34 2a 36 30 2a 36 30 2a 31 30 30 30 29 29 3b 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 27 75 74 73 5f 63 6a 65 76 65 6e 74 3d 27 2b 63 6a 5f 76 61 6c 2b 27 3b 20 65 78 70 69 72 65 73 3d 27 2b 65 78 64 61 74 65 2e 74 6f 55 54 43 53 74 72 69 6e 67 28 29 2b 27 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 27 2b 75 74 73 5f 64 6f 6d 61 69 6e 2b 27 3b 27 7d 7d 0a 69 66 28 75 74 73 5f 73 73 5f 67 75 79 29 7b 76 61 Data Ascii: _cj_guy){var cj_val=uts_getQueryStringValue('cjevent');if(cj_val){exdate.setTime(exdate.getTime()+(uts_duration2460601000));document.cookie='uts_cjevent='+cj_val+'; expires='+exdate.toUTCString()+'; path=/; domain=.'+uts_domain+';'}}if(uts_ss_guy){va
2024-04-25 20:26:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49889	108.138.85.117	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:09 UTC	570	OUT	GET /1020181/ HTTP/1.1 Host: cdn.avmws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:09 UTC	375	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 14 Connection: close Date: Thu, 25 Apr 2024 14:00:59 GMT Server: Apache/2.4.52 (Ubuntu) X-Cache: Hit from cloudfront Via: 1.1 c59b5a542015c208c95d2ed3c65cdbcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P2 X-Amz-Cf-Id: uOcbf3_pqUHaajmpxuHjkTUWEWz_3MmMECjP1unStn0XxU9mIVLynA== Age: 23110
2024-04-25 20:26:09 UTC	14	IN	Data Raw: 49 6e 61 63 74 69 76 65 20 73 69 74 65 2e Data Ascii: Inactive site.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49891	35.186.249.72	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:09 UTC	606	OUT	GET /A3249244-0e36-42f8-aac7-447bef0e6e601.js HTTP/1.1 Host: utt.impactcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:09 UTC	907	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPrFbbOAcL0vZACNqONIdOCr2TmrUVae2wS67A3YCcx9D44y1voVv3a4pGA8gQB0yTDu8I_XUu7LHg Date: Thu, 25 Apr 2024 20:26:09 GMT Cache-Control: public,max-age=900,s-maxage=300 Expires: Thu, 25 Apr 2024 20:31:09 GMT Last-Modified: Fri, 22 Mar 2024 17:48:47 GMT ETag: W/"f16bfae15a20e5578897416c77e8b64d" Vary: Accept-Encoding x-goog-generation: 1711129727091186 x-goog-metageneration: 1 x-goog-stored-content-encoding: gzip x-goog-stored-content-length: 15558 Content-Type: text/javascript; charset=utf-8 x-goog-hash: crc32c=00Y/og== x-goog-hash: md5=8Wv64Vog5VeIl0Fsd+i2TQ== x-goog-storage-class: MULTI_REGIONAL Access-Control-Allow-Origin: * X-GUploader-Response-Body-Transformations: gunzipped Warning: 214 UploadServer gunzipped Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2024-04-25 20:26:09 UTC	348	IN	Data Raw: 61 35 63 0d 0a 2f 2a 21 20 40 62 75 69 6c 64 20 65 34 33 36 65 35 62 34 20 40 64 61 74 65 20 32 30 32 34 2d 30 33 2d 32 32 54 31 36 3a 30 31 3a 33 32 2e 37 36 38 5a 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 33 32 37 32 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 63 3d 72 28 33 33 32 38 29 2c 66 3d 72 28 34 39 39 34 29 2c 64 3d 72 28 39 37 32 35 29 2c 73 3d 72 28 36 36 31 30 29 2c 6c 3d 72 28 34 35 34 36 29 2c 76 3d 72 28 33 31 35 39 29 2e 74 2c 6d 3d 72 28 37 37 38 36 29 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 69 2c 6f 29 7b 76 61 72 20 6e 3d 6e 65 77 20 44 61 74 65 2c 74 3d 66 28 69 2e 69 2e 7a 39 29 2c 72 3d 73 28 69 2e 6f 29 2c 65 3d 6c 28 72 2c 69 2e Data Ascii: a5c/! @build e436e5b4 @date 2024-03-22T16:01:32.768Z /!function(){"use strict";var r={3272:function(n,t,r){var c=r(3328),f=r(4994),d=r(9725),s=r(6610),l=r(4546),v=r(3159).t,m=r(7786);n.exports=function(i,o){var n=new Date,t=f(i.i.z9),r=s(i.o),e=l(r,i.
2024-04-25 20:26:09 UTC	1255	IN	Data Raw: 28 6d 28 22 75 6e 6b 6e 6f 77 6e 20 61 63 74 69 6f 6e 22 29 29 3b 72 3d 76 28 72 29 3b 74 72 79 7b 6f 5b 6e 5d 28 72 2c 69 2c 61 2c 74 29 7d 63 61 74 63 68 28 65 29 7b 72 28 6d 28 65 2e 6d 65 73 73 61 67 65 2c 7b 7a 31 30 3a 65 2e 6e 61 6d 65 7d 29 29 7d 7d 7d 7d 2c 33 32 35 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 64 3d 72 28 36 33 37 29 2e 24 2c 73 3d 72 28 33 32 37 32 29 2c 6c 3d 72 28 37 37 35 34 29 2c 76 3d 72 28 38 37 34 32 29 2c 6d 3d 72 28 33 36 33 38 29 2c 70 3d 72 28 39 33 33 36 29 2c 67 3d 72 28 37 32 31 39 29 2c 79 3d 72 28 32 35 37 38 29 2c 24 3d 72 28 39 39 37 29 2c 68 3d 72 28 33 31 35 39 29 2e 68 2c 62 3d 72 28 35 38 31 34 29 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 Data Ascii: (m("unknown action"));r=v(r);try{o[n](r,i,a,t)}catch(e){r(m(e.message,{z10:e.name}))}}}},325:function(n,t,r){var d=r(637).$,s=r(3272),l=r(7754),v=r(8742),m=r(3638),p=r(9336),g=r(7219),y=r(2578),$=r(997),h=r(3159).h,b=r(5814);n.exports=function(n,t,r){var
2024-04-25 20:26:09 UTC	1056	IN	Data Raw: 2f 66 61 73 74 2e 73 73 71 74 2e 69 6f 2f 73 71 75 61 74 63 68 2d 6a 73 40 32 22 2c 63 64 64 3a 22 64 2e 69 6d 70 63 74 2e 73 69 74 65 22 2c 7a 31 69 3a 22 68 74 74 70 73 3a 2f 2f 70 2e 69 6d 70 63 74 2e 73 69 74 65 2f 64 65 62 75 67 22 2c 7a 31 66 3a 22 69 6d 70 61 63 74 2d 65 76 65 6e 74 73 22 2c 7a 31 67 3a 22 69 6d 70 61 63 74 2d 6c 6f 79 61 6c 74 79 22 2c 7a 31 68 3a 22 63 74 22 7d 7d 2c 39 33 33 36 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 66 3d 72 28 35 32 33 34 29 2c 64 3d 72 28 33 31 35 39 29 2e 4f 2c 73 3d 72 28 35 37 37 35 29 2e 55 2c 6c 3d 5b 22 64 65 62 75 67 22 2c 22 69 6e 66 6f 22 2c 22 77 61 72 6e 22 2c 22 65 72 72 6f 72 22 5d 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 76 61 72 20 61 3d Data Ascii: /fast.ssqt.io/squatch-js@2",cdd:"d.impct.site",z1i:"https://p.impct.site/debug",z1f:"impact-events",z1g:"impact-loyalty",z1h:"ct"}},9336:function(n,t,r){var f=r(5234),d=r(3159).O,s=r(5775).U,l=["debug","info","warn","error"];n.exports=function(n,t){var a=
2024-04-25 20:26:09 UTC	1255	IN	Data Raw: 38 30 30 30 0d 0a 2e 58 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 65 3d 6f 2e 48 28 6f 2e 47 28 29 29 2c 72 3d 72 2e 59 28 6e 75 6c 6c 2c 65 2e 57 29 3b 69 66 28 72 26 26 75 28 65 2e 56 5b 72 2e 67 70 5d 29 26 26 21 75 28 65 2e 56 5b 72 2e 67 63 7c 7c 22 69 72 63 6c 69 63 6b 69 64 22 5d 29 29 72 65 74 75 72 6e 20 6e 28 69 28 22 4e 6f 20 67 61 74 65 77 61 79 43 6c 69 63 6b 49 64 20 66 6f 75 6e 64 20 66 6f 72 20 61 20 67 61 74 65 77 61 79 43 6c 69 63 6b 20 65 76 65 6e 74 22 2c 7b 64 6f 6d 61 69 6e 3a 65 2e 4b 2c 63 69 64 3a 72 2e 69 64 2c 74 64 3a 6f 2e 4a 28 72 29 7d 29 29 3b 6e 28 29 7d 7d 2c 37 37 38 36 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c Data Ascii: 8000.X;n.exports=function(n,t,r){var e=o.H(o.G()),r=r.Y(null,e.W);if(r&&u(e.V[r.gp])&&!u(e.V[r.gc\|\|"irclickid"]))return n(i("No gatewayClickId found for a gatewayClick event",{domain:e.K,cid:r.id,td:o.J(r)}));n()}},7786:function(n){n.exports=function(n,
2024-04-25 20:26:09 UTC	1255	IN	Data Raw: 28 37 32 31 39 29 2c 66 3d 5b 22 64 6f 22 2c 22 70 6f 73 74 62 61 63 6b 22 5d 3b 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 61 2e 6f 28 66 2c 69 2e 71 2c 7b 74 70 73 3a 6f 7d 29 3b 76 61 72 20 75 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 6e 3f 61 2e 6f 28 66 2c 69 2e 4e 2c 6e 29 3a 61 2e 6f 28 66 2c 69 2e 5f 2c 74 29 7d 3b 69 66 28 21 6f 7c 7c 21 6f 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 75 28 29 3b 65 2e 66 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 74 3d 6f 2e 6c 65 6e 67 74 68 3b 6e 3c 74 3b 2b 2b 6e 29 7b 76 61 72 20 72 3d 6f 5b 6e 5d 3b 69 66 28 72 2e 75 26 26 61 2e 67 2e 73 6e 2e 64 6e 28 72 2e 75 2c 6e 75 6c 6c 2c 7b 74 61 67 3a Data Ascii: (7219),f=["do","postback"];n.exports=function(a){return function(o){a.o(f,i.q,{tps:o});var u=function(n,t){n?a.o(f,i.N,n):a.o(f,i._,t)};if(!o\|\|!o.length)return u();e.fn(function(){for(var n=0,t=o.length;n<t;++n){var r=o[n];if(r.u&&a.g.sn.dn(r.u,null,{tag:
2024-04-25 20:26:09 UTC	1255	IN	Data Raw: 73 2e 67 2e 73 6e 2e 77 6e 28 72 2c 61 2c 6f 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 69 66 28 6e 29 72 65 74 75 72 6e 20 64 28 6e 29 3b 73 2e 6f 28 24 2c 67 2e 5f 2c 74 29 2c 75 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 7d 7d 2c 38 38 38 30 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 69 3d 72 28 35 37 37 35 29 2c 75 3d 72 28 32 34 31 39 29 2c 61 3d 72 28 39 38 31 31 29 2e 75 6e 2c 63 3d 5b 22 6f 72 67 49 64 22 2c 22 63 61 6d 70 61 69 67 6e 49 64 22 2c 22 72 65 71 75 65 73 74 54 79 70 65 22 2c 22 73 6f 75 72 63 65 49 64 22 2c 22 73 63 6f 72 65 22 2c 22 70 61 67 65 55 72 6c 22 2c 22 73 75 62 53 6f 75 72 63 65 49 64 22 2c 22 73 65 73 73 69 6f 6e 49 64 22 5d 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 74 3d 74 7c 7c 5b 5d 3b 76 61 72 Data Ascii: s.g.sn.wn(r,a,o,function(n,t){if(n)return d(n);s.o($,g._,t),u(null,t)}))}}},8880:function(n,t,r){var i=r(5775),u=r(2419),a=r(9811).un,c=["orgId","campaignId","requestType","sourceId","score","pageUrl","subSourceId","sessionId"],f=function(n,t){t=t\|\|[];var
2024-04-25 20:26:09 UTC	1255	IN	Data Raw: 72 6f 70 65 72 74 79 28 74 29 26 26 28 72 5b 6e 5b 74 5d 5d 3d 5b 5d 29 3b 72 65 74 75 72 6e 20 72 7d 28 65 29 3b 72 65 74 75 72 6e 7b 53 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 6f 5b 6e 5d 26 26 6f 5b 6e 5d 2e 70 75 73 68 28 74 29 7d 2c 79 6e 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 6f 5b 6e 5d 7c 7c 5b 5d 2c 65 3d 30 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 65 3c 69 3b 2b 2b 65 29 72 5b 65 5d 26 26 72 5b 65 5d 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 7c 7c 5b 5d 29 3b 6f 5b 6e 5d 3d 5b 5d 7d 7d 7d 7d 2c 39 39 37 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 2e 65 78 70 6f 72 74 73 3d 7b 41 3a 22 7a 63 22 2c 54 3a 22 7a 64 22 7d 7d 2c 34 39 39 34 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 6f 3d 72 28 33 31 Data Ascii: roperty(t)&&(r[n[t]]=[]);return r}(e);return{S:function(n,t){o[n]&&o[n].push(t)},yn:function(n,t){for(var r=o[n]\|\|[],e=0,i=r.length;e<i;++e)r[e]&&r[e].apply(null,t\|\|[]);o[n]=[]}}}},997:function(n){n.exports={A:"zc",T:"zd"}},4994:function(n,t,r){var o=r(31
2024-04-25 20:26:09 UTC	1255	IN	Data Raw: 64 3f 22 68 74 74 70 73 3a 2f 2f 22 2b 74 2e 63 64 64 3a 22 22 2c 6f 3d 65 28 6e 2c 66 2c 74 2c 72 29 2c 73 3d 6f 2e 4d 6e 28 29 3f 76 2e 4f 6e 3a 6e 75 6c 6c 2c 75 3d 28 61 2e 55 6e 28 73 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 65 29 7b 76 61 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 5b 64 26 26 72 2e 63 6f 6e 73 65 6e 74 53 74 61 74 75 73 3d 3d 3d 76 2e 50 6e 3f 64 3a 70 28 74 29 2c 6e 5d 2e 6a 6f 69 6e 28 22 2f 22 29 7d 3b 69 66 28 21 72 2e 65 76 65 6e 74 73 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 61 2e 55 6e 28 73 29 2c 65 28 67 28 22 6e 6f 20 6e 65 77 20 63 6f 6e 73 65 6e 74 20 65 76 65 6e 74 73 20 74 6f 20 72 65 70 6f 72 74 22 29 29 3b 76 61 72 20 6f 3d 7b 63 6f 6e 73 65 6e 74 55 70 64 61 74 65 3a 24 28 79 2e 42 28 Data Ascii: d?"https://"+t.cdd:"",o=e(n,f,t,r),s=o.Mn()?v.On:null,u=(a.Un(s),function(t,r,e){var i=function(n){return[d&&r.consentStatus===v.Pn?d:p(t),n].join("/")};if(!r.events.length)return a.Un(s),e(g("no new consent events to report"));var o={consentUpdate:$(y.B(
2024-04-25 20:26:09 UTC	1255	IN	Data Raw: 61 67 65 20 71 75 65 75 65 22 2c 7b 7a 31 6a 3a 74 2c 7a 31 6b 3a 6e 7c 7c 22 7b 7d 22 7d 29 29 7d 72 65 74 75 72 6e 7b 7d 7d 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 3d 2b 6e 65 77 20 44 61 74 65 2c 6e 2e 5a 6e 28 6f 2c 69 29 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 74 3d 5b 5d 2c 72 3d 63 28 29 3b 66 6f 72 28 6e 20 69 6e 20 72 29 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6e 29 26 26 74 2e 70 75 73 68 28 72 5b 6e 5d 29 3b 72 65 74 75 72 6e 20 70 2e 72 65 6d 6f 76 65 49 74 65 6d 28 75 29 2c 74 7d 2c 64 3d 28 69 3e 70 61 72 73 65 49 6e 74 28 6e 2e 6e 74 28 6f 29 7c 7c 22 30 22 2c 31 30 29 2b 6d 26 26 28 65 28 29 2c 70 2e 72 65 6d 6f 76 65 49 74 65 6d 28 61 29 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 Data Ascii: age queue",{z1j:t,z1k:n\|\|"{}"}))}return{}},f=function(){i=+new Date,n.Zn(o,i)},e=function(){var n,t=[],r=c();for(n in r)r.hasOwnProperty(n)&&t.push(r[n]);return p.removeItem(u),t},d=(i>parseInt(n.nt(o)\|\|"0",10)+m&&(e(),p.removeItem(a)),function(){try{var
2024-04-25 20:26:09 UTC	1255	IN	Data Raw: 2b 72 29 2e 74 6f 55 54 43 53 74 72 69 6e 67 28 29 3a 30 29 2c 22 70 61 74 68 3d 22 2b 28 69 7c 7c 22 2f 22 29 2c 22 73 65 63 75 72 65 22 5d 3b 65 3f 6e 2e 70 75 73 68 28 22 64 6f 6d 61 69 6e 3d 22 2b 65 29 3a 28 74 3d 75 28 29 29 26 26 6e 2e 70 75 73 68 28 22 64 6f 6d 61 69 6e 3d 22 2b 74 29 2c 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 3d 6e 2e 6a 6f 69 6e 28 22 3b 22 29 7d 2c 6e 74 3a 66 7d 7d 7d 2c 34 35 34 36 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 72 29 7b 76 61 72 20 65 2c 66 3d 72 28 33 34 31 29 2c 64 3d 72 28 34 32 34 34 29 2e 44 6e 2c 6c 3d 37 32 30 2a 64 2c 76 3d 28 65 3d 2f 5b 78 79 5d 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 78 78 78 78 78 78 78 78 2d 78 78 78 78 2d 34 78 78 78 2d 79 78 78 78 2d 78 78 78 78 78 78 78 Data Ascii: +r).toUTCString():0),"path="+(i\|\|"/"),"secure"];e?n.push("domain="+e):(t=u())&&n.push("domain="+t),document.cookie=n.join(";")},nt:f}}},4546:function(n,t,r){var e,f=r(341),d=r(4244).Dn,l=720*d,v=(e=/[xy]/g,function(){return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49893	34.102.147.248	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:10 UTC	580	OUT	GET /120272.ct.js HTTP/1.1 Host: tag.rmp.rakuten.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:10 UTC	390	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=86400 Content-Length: 42339 Content-Type: text/javascript Last-Modified: Thu, 25 Apr 2024 20:26:10 GMT X-Cache: hit X-Dyn: 0 X-Samesite: secure Date: Thu, 25 Apr 2024 20:26:10 GMT Via: 1.1 google Strict-Transport-Security: max-age=31536000 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:10 UTC	1255	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 72 29 7b 69 66 28 6e 5b 72 5d 29 72 65 74 75 72 6e 20 6e 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 69 3d 6e 5b 72 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 72 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 69 2e 65 78 70 6f 72 74 73 2c 69 2c 69 2e 65 78 70 6f 72 74 73 2c 74 29 2c 69 2e 6c 6f 61 64 65 64 3d 21 30 2c 69 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 6e 3d 7b 7d 3b 72 65 74 75 72 6e 20 74 2e 6d 3d 65 2c 74 2e 63 3d 6e 2c 74 2e 70 3d 22 22 2c 74 28 30 29 7d 28 5b 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 6e 28 33 33 29 2c 6e 28 33 38 29 2e 69 73 54 65 73 74 69 6e 67 7c 7c 28 6e 28 Data Ascii: !function(e){function t(r){if(n[r])return n[r].exports;var i=n[r]={exports:{},id:r,loaded:!1};return e[r].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}var n={};return t.m=e,t.c=n,t.p="",t(0)}([function(e,t,n){function r(){n(33),n(38).isTesting\|\|(n(
2024-04-25 20:26:10 UTC	1255	IN	Data Raw: 6e 64 65 6e 63 79 3d 7b 7d 2c 6e 2e 6c 61 73 74 46 69 72 65 3d 7b 64 61 74 65 3a 6e 75 6c 6c 2c 76 61 6c 75 65 3a 6e 75 6c 6c 7d 2c 6e 2e 65 72 72 6f 72 53 69 67 6e 61 6c 3d 21 31 2c 65 7c 7c 28 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 3b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 74 72 69 67 67 65 72 43 6f 75 6e 74 2b 2b 3b 76 61 72 20 72 3b 74 72 79 7b 72 3d 65 2e 61 70 70 6c 79 28 74 7c 7c 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 63 61 74 63 68 28 69 29 7b 74 68 72 6f 77 20 6e 2e 65 72 72 6f 72 53 69 67 6e 61 6c 26 26 6e 2e 65 72 72 6f 72 53 69 67 6e 61 6c 28 69 29 2c 69 7d 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 6e 2e 66 69 6c 74 65 72 73 29 69 66 28 6e 2e 66 69 6c 74 65 72 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6f Data Ascii: ndency={},n.lastFire={date:null,value:null},n.errorSignal=!1,e\|\|(e=function(){});var r=function(){n.triggerCount++;var r;try{r=e.apply(t\|\|this,arguments)}catch(i){throw n.errorSignal&&n.errorSignal(i),i}for(var o in n.filters)if(n.filters.hasOwnProperty(o
2024-04-25 20:26:10 UTC	54	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 2e 66 69 72 65 43 6f 75 6e 74 3d 65 7c 7c 30 2c 72 7d 2c 72 2e 67 65 74 49 44 3d 66 75 6e 63 74 69 Data Ascii: =function(e){return n.fireCount=e\|\|0,r},r.getID=functi
2024-04-25 20:26:10 UTC	1255	IN	Data Raw: 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 73 69 67 49 64 7d 2c 72 2e 6c 69 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 2e 74 68 72 65 73 68 6f 6c 64 2e 75 70 70 65 72 3d 65 2c 72 7d 2c 72 2e 6d 69 6e 54 72 69 67 67 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 2e 74 68 72 65 73 68 6f 6c 64 2e 6c 6f 77 65 72 3d 65 2c 72 7d 2c 72 2e 66 69 6c 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 75 28 65 29 2c 6e 2e 66 69 6c 74 65 72 73 5b 65 2e 67 65 74 49 44 28 29 5d 3d 65 2c 72 7d 2c 72 2e 72 65 6d 6f 76 65 46 69 6c 74 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 75 28 65 29 2c 64 65 6c 65 74 65 20 6e 2e 66 69 6c 74 65 72 73 5b 65 2e 67 65 74 49 44 28 29 Data Ascii: on(){return n.sigId},r.limit=function(e){return n.threshold.upper=e,r},r.minTriggers=function(e){return n.threshold.lower=e,r},r.filter=function(e){return e=u(e),n.filters[e.getID()]=e,r},r.removeFilter=function(e){return e=u(e),delete n.filters[e.getID()
2024-04-25 20:26:10 UTC	1255	IN	Data Raw: 61 72 20 72 3d 74 3f 75 28 74 2c 6e 29 3a 66 28 29 2c 69 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 72 2c 65 29 3b 72 65 74 75 72 6e 20 72 2e 73 74 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 69 29 7d 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 65 2e 77 72 61 70 70 65 64 29 72 65 74 75 72 6e 20 65 3b 76 61 72 20 6e 3d 77 28 68 2c 65 29 3b 69 66 28 6e 3e 2d 31 29 72 65 74 75 72 6e 20 79 5b 6e 5d 3b 76 61 72 20 69 3d 6e 65 77 20 72 28 65 2c 74 29 3b 72 65 74 75 72 6e 20 68 2e 70 75 73 68 28 65 29 2c 79 2e 70 75 73 68 28 69 29 2c 69 7d 66 75 6e 63 74 69 6f 6e 20 63 28 65 2c 74 29 7b Data Ascii: ar r=t?u(t,n):f(),i=setInterval(r,e);return r.stop=function(){clearInterval(i)},r}function u(e,t){if("undefined"==typeof e&&(e=function(){}),e.wrapped)return e;var n=w(h,e);if(n>-1)return y[n];var i=new r(e,t);return h.push(e),y.push(i),i}function c(e,t){
2024-04-25 20:26:10 UTC	1255	IN	Data Raw: 49 74 65 6d 28 74 2c 65 29 2c 6e 3d 72 2e 67 65 74 49 74 65 6d 28 74 29 2c 72 2e 72 65 6d 6f 76 65 49 74 65 6d 28 74 29 2c 6e 3d 3d 3d 65 7d 63 61 74 63 68 28 69 29 7b 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 31 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 63 6d 70 5f 72 65 61 64 79 3a 6e 28 31 30 29 2c 63 6d 70 5f 6d 61 74 63 68 3a 6e 28 32 37 29 2c 61 6c 77 61 79 73 3a 6e 28 32 35 29 7d 3b 72 2e 72 75 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 2c 6f 29 7b 76 61 72 20 61 3d 7b 7d 3b 66 6f 72 28 76 61 72 20 73 20 69 6e 20 72 29 72 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 73 29 26 26 28 61 5b 73 5d 3d 72 5b 73 5d 29 3b 66 6f 72 28 73 20 69 6e 20 74 29 74 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 73 Data Ascii: Item(t,e),n=r.getItem(t),r.removeItem(t),n===e}catch(i){return!1}return!1}},function(e,t,n){var r={cmp_ready:n(10),cmp_match:n(27),always:n(25)};r.run=function(e,t,i,o){var a={};for(var s in r)r.hasOwnProperty(s)&&(a[s]=r[s]);for(s in t)t.hasOwnProperty(s
2024-04-25 20:26:10 UTC	331	IN	Data Raw: 72 6f 70 65 72 74 79 28 76 29 26 26 28 65 2b 3d 76 2b 22 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 63 5b 76 5d 29 2b 22 26 22 29 3b 22 3f 22 21 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 22 26 22 21 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 7c 7c 28 65 3d 65 2e 73 6c 69 63 65 28 30 2c 2d 31 29 29 2c 64 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 65 29 2c 6c 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 65 78 70 6f 72 74 73 2e 67 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 3d 22 22 3b 66 6f 72 28 65 3d 30 3b 65 3c 33 32 3b 65 2b 2b 29 74 3d 31 36 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 2c 38 21 3d 65 26 26 31 32 21 3d Data Ascii: roperty(v)&&(e+=v+"="+encodeURIComponent(c[v])+"&");"?"!==e[e.length-1]&&"&"!==e[e.length-1]\|\|(e=e.slice(0,-1)),d.setAttribute("src",e),l.appendChild(d)}},function(e,t){e.exports.gen=function(){var e,t,n="";for(e=0;e<32;e++)t=16*Math.random()\|0,8!=e&&12!=
2024-04-25 20:26:10 UTC	1255	IN	Data Raw: 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 63 6d 70 49 73 47 64 70 72 3f 22 67 64 70 72 22 3a 22 22 7d 2c 6e 3d 5b 5d 2c 72 3d 52 2e 70 6f 6c 69 63 69 65 73 28 29 3b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 5b 65 5d 26 26 22 63 63 70 61 22 21 3d 3d 65 26 26 6e 2e 70 75 73 68 28 65 29 7d 29 2c 30 3d 3d 3d 6e 2e 6c 65 6e 67 74 68 3f 74 28 29 7c 7c 22 22 3a 6e 5b 30 5d 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 76 61 72 20 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 Data Ascii: ,function(e,t,n){function r(e){"use strict";var t=function(){return e&&e.cmpIsGdpr?"gdpr":""},n=[],r=R.policies();return Object.keys(r).forEach(function(e){r[e]&&"ccpa"!==e&&n.push(e)}),0===n.length?t()\|\|"":n[0]}function i(e){var t=[];return Object.keys(e
2024-04-25 20:26:10 UTC	1255	IN	Data Raw: 2c 6e 26 26 6e 2e 6c 65 6e 67 74 68 3e 30 26 26 65 2e 61 6c 6c 56 65 6e 64 6f 72 43 6f 6e 73 65 6e 74 73 26 26 6e 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 2e 61 6c 6c 56 65 6e 64 6f 72 43 6f 6e 73 65 6e 74 73 2e 69 6e 64 65 78 4f 66 28 74 29 3d 3d 3d 2d 31 29 72 65 74 75 72 6e 20 76 6f 69 64 28 6f 3d 21 31 29 7d 29 2c 6f 26 26 74 26 26 74 2e 6c 65 6e 67 74 68 3e 30 26 26 28 6f 3d 21 31 2c 74 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 30 3d 3d 3d 74 2e 6c 65 6e 67 74 68 7c 7c 69 28 65 2c 74 29 29 72 65 74 75 72 6e 20 76 6f 69 64 28 6f 3d 21 30 29 7d 29 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 66 28 21 45 2e 69 73 56 61 6c 69 64 28 29 29 72 65 Data Ascii: ,n&&n.length>0&&e.allVendorConsents&&n.forEach(function(t){if(e.allVendorConsents.indexOf(t)===-1)return void(o=!1)}),o&&t&&t.length>0&&(o=!1,t.forEach(function(t){if(0===t.length\|\|i(e,t))return void(o=!0)})),o}function c(){"use strict";if(!E.isValid())re
2024-04-25 20:26:10 UTC	1255	IN	Data Raw: 6f 6e 73 65 6e 74 73 3d 75 28 65 2e 61 6c 6c 50 75 72 70 6f 73 65 43 6f 6e 73 65 6e 74 73 29 2c 69 2e 70 75 72 70 6f 73 65 49 64 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 65 2e 61 6c 6c 50 75 72 70 6f 73 65 43 6f 6e 73 65 6e 74 73 2e 69 6e 64 65 78 4f 66 28 74 29 3e 2d 31 26 26 65 2e 72 6d 50 75 72 70 6f 73 65 43 6f 6e 73 65 6e 74 73 2e 70 75 73 68 28 74 29 7d 29 29 7d 65 2e 70 72 6f 64 75 63 74 43 6f 6e 73 65 6e 74 73 3d 7b 72 61 6e 54 72 6b 49 6e 74 3a 61 28 65 2c 6f 2e 72 61 6e 54 72 6b 49 6e 74 2c 73 29 2c 72 61 6e 54 72 6b 45 78 74 3a 61 28 65 2c 6f 2e 72 61 6e 54 72 6b 45 78 74 2c 73 29 2c 72 61 6e 41 75 74 3a 61 28 65 2c 6f 2e 72 61 6e 41 75 74 2c 73 29 2c 72 61 6e 43 47 45 3a 61 28 65 2c 6f 2e 72 61 6e 43 47 45 2c 73 29 2c Data Ascii: onsents=u(e.allPurposeConsents),i.purposeIds.forEach(function(t){e.allPurposeConsents.indexOf(t)>-1&&e.rmPurposeConsents.push(t)}))}e.productConsents={ranTrkInt:a(e,o.ranTrkInt,s),ranTrkExt:a(e,o.ranTrkExt,s),ranAut:a(e,o.ranAut,s),ranCGE:a(e,o.ranCGE,s),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49894	31.13.65.7	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:10 UTC	586	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:10 UTC	1465	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2024-04-25 20:26:10 UTC	1496	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2024-04-25 20:26:10 UTC	1	IN	Data Raw: 2f Data Ascii: /
2024-04-25 20:26:10 UTC	14842	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2024-04-25 20:26:10 UTC	16384	IN	Data Raw: 6c 6c 3b 61 3d 61 2e 65 78 74 72 61 63 74 6f 72 5f 63 6f 6e 66 69 67 3b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 78 74 2c 63 3d 61 2e 70 61 72 61 6d 65 74 65 72 5f 74 79 70 65 3b 61 3d 61 2e 76 61 6c 75 65 3b 62 3d 62 21 3d 6e 75 6c 6c 26 26 74 79 70 65 6f 66 20 62 3d 3d 3d 22 73 74 72 69 6e 67 22 26 26 62 21 3d 3d 22 22 3f 62 3a 6e 75 6c 6c 3b 63 3d 64 28 63 29 3b 61 3d 61 21 3d 6e 75 6c 6c 26 26 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 26 26 61 21 3d 3d 22 22 3f 61 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 21 3d Data Ascii: ll;a=a.extractor_config;if(a==null\|\|(typeof a==="undefined"?"undefined":i(a))!=="object")return null;var b=a.context,c=a.parameter_type;a=a.value;b=b!=null&&typeof b==="string"&&b!==""?b:null;c=d(c);a=a!=null&&typeof a==="string"&&a!==""?a:null;return b!=
2024-04-25 20:26:10 UTC	16384	IN	Data Raw: 50 41 52 41 4d 45 54 45 52 2c 78 3d 73 2e 72 65 61 64 50 61 63 6b 65 64 43 6f 6f 6b 69 65 2c 79 3d 73 2e 43 4c 49 43 4b 54 48 52 4f 55 47 48 5f 43 4f 4f 4b 49 45 5f 4e 41 4d 45 3b 73 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 70 65 72 69 6d 65 6e 74 4e 61 6d 65 73 22 29 3b 76 61 72 20 7a 3d 73 2e 55 53 45 5f 46 42 43 5f 41 53 5f 43 41 43 48 45 5f 4b 45 59 5f 45 58 50 45 52 49 4d 45 4e 54 2c 41 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 51 45 22 29 2c 42 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 Data Ascii: PARAMETER,x=s.readPackedCookie,y=s.CLICKTHROUGH_COOKIE_NAME;s=f.getFbeventsModules("SignalsFBEventsExperimentNames");var z=s.USE_FBC_AS_CACHE_KEY_EXPERIMENT,A=f.getFbeventsModules("SignalsFBEventsQE"),B=f.getFbeventsModules("SignalsFBEventsModuleEncodings
2024-04-25 20:26:10 UTC	16384	IN	Data Raw: 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 47 75 61 72 64 72 61 69 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 69 2c 6a 2c 6b 29 7b 76 61 72 20 6c 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6c 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 31 3b 62 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 62 2b 2b 29 7b 76 61 72 20 63 3d 61 72 67 75 6d 65 6e 74 73 5b 62 5d 3b 66 6f 72 28 76 61 72 20 64 20 69 6e 20 63 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 Data Ascii: Registered("SignalsFBEventsGuardrail",function(){return function(g,i,j,k){var l={exports:{}};l.exports;(function(){"use strict";var a=Object.assign\|\|function(a){for(var b=1;b<arguments.length;b++){var c=arguments[b];for(var d in c)Object.prototype.hasOwnP
2024-04-25 20:26:10 UTC	1541	IN	Data Raw: 73 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 61 72 72 61 79 4f 66 28 62 2e 73 74 72 69 6e 67 28 29 29 29 7d 29 29 2c 61 64 64 69 74 69 6f 6e 61 6c 55 73 65 72 44 61 74 61 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 2e 6f 62 6a 65 63 74 57 69 74 68 46 69 65 6c 64 73 28 7b 73 65 6e 64 46 42 4c 6f 67 69 6e 49 44 3a 62 2e 61 6c 6c 6f 77 4e 75 6c 6c 28 62 5b 22 62 6f 6f 6c 65 61 6e 22 5d 28 29 29 7d 29 29 7d 29 3b 6b 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 4f 70 74 49 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 Data Ascii: s:b.allowNull(b.arrayOf(b.string()))})),additionalUserData:b.allowNull(b.objectWithFields({sendFBLoginID:b.allowNull(b["boolean"]())}))});k.exports=a})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsOptIn",function(){return functi
2024-04-25 20:26:10 UTC	14843	IN	Data Raw: 6c 3f 63 28 64 28 62 29 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 62 5b 61 5d 3d 3d 3d 21 30 7d 29 3a 5b 5d 7d 7d 5d 29 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 6c 2e 65 78 70 6f 72 74 73 3d 61 7d 29 28 29 3b 72 65 74 75 72 6e 20 6c 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 61 72 61 6c 6c 65 6c 46 69 72 65 43 6f 6e 66 69 67 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 Data Ascii: l?c(d(b),function(a){return b[a]===!0}):[]}}]);return a}();l.exports=a})();return l.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsParallelFireConfigTypedef",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use s
2024-04-25 20:26:10 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 29 29 72 65 74 75 72 6e 3b 66 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 62 2c 22 63 75 73 74 6f 6d 44 61 74 61 22 29 26 26 74 79 70 65 6f 66 20 62 2e 63 75 73 74 6f 6d 44 61 74 61 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 62 2e 63 75 73 74 6f 6d 44 61 74 61 21 3d 3d 6e 75 6c 6c 3b 66 7c 7c 28 62 2e 63 75 73 74 6f 6d 44 61 74 61 3d 7b 7d 29 3b 71 28 62 29 7d 6b 2e 65 78 70 6f 72 74 73 3d 72 7d 29 28 29 3b 72 65 74 75 72 6e 20 6b 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 45 76 Data Ascii: tion(a){return a}))return;f=Object.prototype.hasOwnProperty.call(b,"customData")&&typeof b.customData!=="undefined"&&b.customData!==null;f\|\|(b.customData={});q(b)}k.exports=r})();return k.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsSendEv
2024-04-25 20:26:10 UTC	16384	IN	Data Raw: 26 62 2e 70 75 73 68 28 73 5b 63 5d 29 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 76 28 61 2c 62 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 20 61 72 72 61 79 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 61 3d 4f 62 6a 65 63 74 28 61 29 3b 76 61 72 20 63 3d 61 2e 6c 65 6e 67 74 68 3e 3e 3e 30 3b 69 66 28 74 79 70 65 6f 66 20 62 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 62 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 76 61 72 20 64 3d 6e 65 77 20 41 72 72 61 79 28 63 29 2c 65 3d 30 3b 77 68 69 6c 65 28 65 3c 63 29 7b 76 61 72 20 66 3b 65 20 69 6e 20 61 26 26 28 66 3d 61 Data Ascii: &b.push(s[c]);return b}function v(a,b){if(a==null)throw new TypeError(" array is null or not defined");a=Object(a);var c=a.length>>>0;if(typeof b!=="function")throw new TypeError(b+" is not a function");var d=new Array(c),e=0;while(e<c){var f;e in a&&(f=a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49892	104.248.96.70	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:10 UTC	587	OUT	GET /js/platform/handle.js HTTP/1.1 Host: trk.indoleads.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:10 UTC	358	IN	HTTP/1.1 200 OK Server: nginx/1.10.3 (Ubuntu) Date: Thu, 25 Apr 2024 20:26:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 3407 Connection: close Vary: Accept-Encoding Last-Modified: Thursday, 25-Apr-2024 20:26:10 GMT Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Accept-Ranges: bytes
2024-04-25 20:26:10 UTC	3407	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 70 61 72 73 65 55 54 4d 28 29 0a 7b 0a 20 20 20 20 76 61 72 20 75 72 6c 53 65 61 72 63 68 50 61 72 61 6d 73 20 3d 20 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 29 3b 0a 0a 20 20 20 20 2f 2f 20 69 66 20 70 72 6f 76 69 64 65 64 20 63 75 73 74 6f 6d 20 70 61 72 61 6d 20 6e 61 6d 65 20 74 68 65 6e 20 75 73 65 20 69 74 20 74 6f 20 66 69 6e 64 20 63 6c 69 63 6b 5f 69 64 0a 20 20 20 20 69 66 20 28 74 79 70 65 6f 66 20 49 4e 44 4f 4c 45 41 44 53 5f 43 4c 49 43 4b 5f 50 41 52 41 4d 20 21 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 0a 20 20 20 20 20 20 20 20 26 26 20 75 72 6c 53 65 61 72 63 68 50 61 72 61 6d 73 2e 68 61 73 28 49 4e 44 4f 4c 45 41 44 53 5f 43 Data Ascii: function parseUTM(){ var urlSearchParams = new URLSearchParams(window.location.search); // if provided custom param name then use it to find click_id if (typeof INDOLEADS_CLICK_PARAM !== 'undefined' && urlSearchParams.has(INDOLEADS_C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49896	18.244.202.7	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:10 UTC	621	OUT	GET /healthcheck HTTP/1.1 Host: assets-tracking.crazyegg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.wondershare.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:10 UTC	631	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 19 Connection: close Date: Tue, 16 Apr 2024 23:59:37 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Access-Control-Expose-Headers: Access-Control-Allow-Origin Access-Control-Max-Age: 31536000 Last-Modified: Fri, 08 Jul 2022 22:25:51 GMT ETag: "d06f04fccf68d0b228a5923187ce1afd" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6cf9bdddad5852349f8ad08f11a96fac.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P4 X-Amz-Cf-Id: aOVFxBFdiOAc9utXfGDioeQA1LYUp12lwIuXl_cgjHyduCzDTYWM0Q== Age: 764795
2024-04-25 20:26:10 UTC	19	IN	Data Raw: 7b 20 22 73 74 61 74 75 73 22 3a 20 22 6f 6b 22 20 7d 0a Data Ascii: { "status": "ok" }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49897	18.165.98.69	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:10 UTC	625	OUT	GET /healthcheck HTTP/1.1 Host: pagestates-tracking.crazyegg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.wondershare.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:10 UTC	632	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 19 Connection: close Date: Sat, 06 Apr 2024 19:55:05 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Access-Control-Expose-Headers: Access-Control-Allow-Origin Access-Control-Max-Age: 31536000 Last-Modified: Fri, 08 Jul 2022 22:25:51 GMT ETag: "d06f04fccf68d0b228a5923187ce1afd" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 10a35db7a5db275f537a340dc439408c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P4 X-Amz-Cf-Id: JYJdEX1ZCUl48b-87Q8VTWDcNYUjP9GykY1RnLksN0GFupSfC57jkw== Age: 1643466
2024-04-25 20:26:10 UTC	19	IN	Data Raw: 7b 20 22 73 74 61 74 75 73 22 3a 20 22 6f 6b 22 20 7d 0a Data Ascii: { "status": "ok" }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49899	52.72.78.243	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:11 UTC	943	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=ad.admitad.com HTTP/1.1 Host: ad.admitad.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:11 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:11 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:11 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49898	3.218.217.33	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:11 UTC	939	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=z.asbmit.com HTTP/1.1 Host: z.asbmit.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:11 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:11 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:11 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49895	3.218.217.33	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:11 UTC	937	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=lenkmio.com HTTP/1.1 Host: lenkmio.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:11 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:11 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:11 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49903	3.218.217.33	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:11 UTC	933	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=tjzuh.com HTTP/1.1 Host: tjzuh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:11 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:11 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:11 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49901	3.218.217.33	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:11 UTC	937	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=pafutos.com HTTP/1.1 Host: pafutos.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:11 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:11 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:11 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49904	89.187.167.3	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:11 UTC	664	OUT	GET /delivery/customdata/bV8xLndfODYzMjEucl8ubF9lbi5kXzMwMjQ2LnhfMTA1LnYucC50XzMwMjQ2Lnh0XzEwNQ.js HTTP/1.1 Host: cdn.consentmanager.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	656	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: text/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Access-Control-Allow-Origin: * X-XSS-Protection: 0 Expires: Thu, 25 Apr 2024 20:43:23 GMT Cache-Control: public, max-age=1800 Edge-Control: public, max-age=1800 Last-Modified: Thu, 25 Apr 2024 20:13:23 GMT X-77-NZT: EwgBWbunAQFBDAG5TAoJAbOXAwAADAGKxyXBAfcBAwAA X-77-NZT-Ray: 9a26d7263ebfa87464bc2a66f3b9ed03 X-Accel-Expires: @1714077803 X-Accel-Date: 1714075853 X-77-Cache: HIT X-77-Age: 1688 Server: CDN77-Turbo X-Cache: MISS X-77-POP: londonGB
2024-04-25 20:26:12 UTC	15728	IN	Data Raw: 38 63 35 0d 0a 69 66 28 21 28 22 63 6d 70 5f 63 6f 6e 66 69 67 5f 64 61 74 61 22 20 69 6e 20 77 69 6e 64 6f 77 29 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 63 6f 6e 66 69 67 5f 64 61 74 61 3d 7b 7d 3b 7d 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 76 67 5f 6e 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 63 6d 70 5f 68 74 6d 6c 28 22 73 76 67 22 2c 7b 22 78 6d 6c 6e 73 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 77 77 77 2e 77 33 2e 6f 72 67 5c 2f 32 30 30 30 5c 2f 73 76 67 22 2c 22 78 6d 6c 6e 73 3a 73 76 67 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 77 77 77 2e 77 33 2e 6f 72 67 5c 2f 32 30 30 30 5c 2f 73 76 67 22 2c 22 76 69 65 77 42 6f 78 22 3a 22 30 20 30 20 32 30 20 31 30 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 22 7d 2c 20 22 22 2c 20 66 75 Data Ascii: 8c5if(!("cmp_config_data" in window)){window.cmp_config_data={};}window.cmp_svg_no=function(){return new cmp_html("svg",{"xmlns":"http:\/\/www.w3.org\/2000\/svg","xmlns:svg":"http:\/\/www.w3.org\/2000\/svg","viewBox":"0 0 20 10","version":"1.1"}, "", fu
2024-04-25 20:26:12 UTC	16384	IN	Data Raw: 2c 20 41 2e 63 6d 70 6d 6f 72 65 6c 69 6e 6b 3a 6c 69 6e 6b 2c 20 2e 63 6d 70 6d 6f 72 65 20 41 2c 20 2e 63 6d 70 6d 6f 72 65 20 41 3a 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6c 72 42 75 74 74 6f 6e 29 3b 7d 20 2e 63 6d 70 73 61 76 65 6d 79 63 68 6f 69 63 65 2c 20 2e 63 6d 70 73 61 76 65 6d 79 63 68 6f 69 63 65 20 6c 61 62 65 6c 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6c 72 54 65 78 74 29 3b 7d 20 20 2a 2e 63 6d 70 62 6f 78 62 74 6e 79 65 73 2c 20 41 2e 63 6d 70 62 6f 78 62 74 6e 79 65 73 2c 20 41 2e 63 6d 70 62 6f 78 62 74 6e 79 65 73 3a 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6c 72 42 75 74 74 6f 6e 54 65 78 74 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6c 72 42 75 74 74 6f 6e 29 3b 7d 20 Data Ascii: , A.cmpmorelink:link, .cmpmore A, .cmpmore A:link{color:var(--clrButton);} .cmpsavemychoice, .cmpsavemychoice label{color:var(--clrText);} *.cmpboxbtnyes, A.cmpboxbtnyes, A.cmpboxbtnyes:link{color:var(--clrButtonText);background-color:var(--clrButton);}
2024-04-25 20:26:12 UTC	16384	IN	Data Raw: 52 22 3a 30 2c 22 6c 65 67 50 49 50 41 22 3a 30 2c 22 6c 65 67 52 4f 57 22 3a 30 2c 22 6c 65 67 50 4f 50 49 41 22 3a 30 2c 22 6c 65 67 50 44 50 4c 22 3a 30 2c 22 6c 65 67 4c 46 50 44 50 50 50 22 3a 30 2c 22 6c 65 67 50 49 50 4c 22 3a 30 2c 22 6c 65 67 50 44 50 41 22 3a 30 2c 22 6c 65 67 50 50 41 22 3a 30 2c 22 6c 65 67 50 44 50 41 54 22 3a 30 2c 22 6c 65 67 44 53 47 4c 50 44 22 3a 30 2c 22 6c 65 67 47 44 50 52 55 4b 22 3a 30 2c 22 6c 65 67 55 53 56 43 44 50 41 22 3a 30 2c 22 6c 65 67 55 53 43 50 41 22 3a 30 2c 22 6c 65 67 55 53 55 43 50 41 22 3a 30 2c 22 6c 65 67 55 53 43 41 50 44 50 22 3a 30 2c 22 6c 65 67 41 50 50 49 22 3a 30 2c 22 6c 65 67 44 50 44 50 41 22 3a 30 2c 22 6c 65 67 55 53 54 44 50 53 41 22 3a 30 2c 22 6c 65 67 55 53 4f 43 44 50 41 22 3a 30 Data Ascii: R":0,"legPIPA":0,"legROW":0,"legPOPIA":0,"legPDPL":0,"legLFPDPPP":0,"legPIPL":0,"legPDPA":0,"legPPA":0,"legPDPAT":0,"legDSGLPD":0,"legGDPRUK":0,"legUSVCDPA":0,"legUSCPA":0,"legUSUCPA":0,"legUSCAPDP":0,"legAPPI":0,"legDPDPA":0,"legUSTDPSA":0,"legUSOCDPA":0
2024-04-25 20:26:12 UTC	16384	IN	Data Raw: 54 43 44 50 41 22 3a 30 2c 22 6c 65 67 55 53 46 44 42 52 22 3a 30 2c 22 6c 65 67 55 53 57 41 44 41 22 3a 30 7d 2c 7b 22 69 64 22 3a 22 73 32 37 32 33 22 2c 22 77 73 69 64 22 3a 38 36 33 32 31 2c 22 6e 22 3a 22 47 6f 6f 67 6c 65 20 4f 70 74 69 6d 69 7a 65 22 2c 22 6e 6f 6e 65 75 22 3a 31 2c 22 6c 22 3a 22 5c 2f 64 65 6c 69 76 65 72 79 5c 2f 69 63 6f 6e 73 5c 2f 69 63 6f 6e 73 5f 76 32 37 32 33 2e 70 6e 67 22 2c 22 70 73 22 3a 22 63 35 34 22 2c 22 63 70 22 3a 22 22 2c 22 6c 70 22 3a 22 22 2c 22 66 70 22 3a 22 22 2c 22 73 70 22 3a 22 22 2c 22 66 22 3a 22 22 2c 22 73 66 22 3a 22 22 2c 22 69 33 69 64 22 3a 30 2c 22 67 69 64 22 3a 32 32 39 2c 22 66 62 22 3a 30 2c 22 61 76 22 3a 22 22 2c 22 64 76 22 3a 22 22 2c 22 73 76 22 3a 30 2c 22 6c 65 67 47 44 50 52 22 3a Data Ascii: TCDPA":0,"legUSFDBR":0,"legUSWADA":0},{"id":"s2723","wsid":86321,"n":"Google Optimize","noneu":1,"l":"\/delivery\/icons\/icons_v2723.png","ps":"c54","cp":"","lp":"","fp":"","sp":"","f":"","sf":"","i3id":0,"gid":229,"fb":0,"av":"","dv":"","sv":0,"legGDPR":
2024-04-25 20:26:12 UTC	16384	IN	Data Raw: 73 70 22 3a 22 31 2c 32 22 2c 22 66 22 3a 22 22 2c 22 73 66 22 3a 22 22 2c 22 69 33 69 64 22 3a 36 39 2c 22 67 69 64 22 3a 33 36 33 2c 22 66 62 22 3a 30 2c 22 61 76 22 3a 22 22 2c 22 64 76 22 3a 22 22 2c 22 73 76 22 3a 30 2c 22 6c 65 67 47 44 50 52 22 3a 30 2c 22 6c 65 67 43 43 50 41 22 3a 30 2c 22 6c 65 67 50 49 50 45 44 41 22 3a 30 2c 22 6c 65 67 4c 47 50 44 22 3a 30 2c 22 6c 65 67 52 50 44 4c 22 3a 30 2c 22 6c 65 67 4e 44 50 52 22 3a 30 2c 22 6c 65 67 50 49 50 41 22 3a 30 2c 22 6c 65 67 52 4f 57 22 3a 30 2c 22 6c 65 67 50 4f 50 49 41 22 3a 30 2c 22 6c 65 67 50 44 50 4c 22 3a 30 2c 22 6c 65 67 4c 46 50 44 50 50 50 22 3a 30 2c 22 6c 65 67 50 49 50 4c 22 3a 30 2c 22 6c 65 67 50 44 50 41 22 3a 30 2c 22 6c 65 67 50 50 41 22 3a 30 2c 22 6c 65 67 50 44 50 41 Data Ascii: sp":"1,2","f":"","sf":"","i3id":69,"gid":363,"fb":0,"av":"","dv":"","sv":0,"legGDPR":0,"legCCPA":0,"legPIPEDA":0,"legLGPD":0,"legRPDL":0,"legNDPR":0,"legPIPA":0,"legROW":0,"legPOPIA":0,"legPDPL":0,"legLFPDPPP":0,"legPIPL":0,"legPDPA":0,"legPPA":0,"legPDPA
2024-04-25 20:26:12 UTC	16384	IN	Data Raw: 30 2c 22 6c 65 67 55 53 56 43 44 50 41 22 3a 30 2c 22 6c 65 67 55 53 43 50 41 22 3a 30 2c 22 6c 65 67 55 53 55 43 50 41 22 3a 30 2c 22 6c 65 67 55 53 43 41 50 44 50 22 3a 30 2c 22 6c 65 67 41 50 50 49 22 3a 30 2c 22 6c 65 67 44 50 44 50 41 22 3a 30 2c 22 6c 65 67 55 53 54 44 50 53 41 22 3a 30 2c 22 6c 65 67 55 53 4f 43 44 50 41 22 3a 30 2c 22 6c 65 67 55 53 4d 54 43 44 50 41 22 3a 30 2c 22 6c 65 67 55 53 46 44 42 52 22 3a 30 2c 22 6c 65 67 55 53 57 41 44 41 22 3a 30 7d 2c 7b 22 69 64 22 3a 22 73 39 30 32 22 2c 22 77 73 69 64 22 3a 38 36 33 32 31 2c 22 6e 22 3a 22 5a 65 6e 64 65 73 6b 20 49 6e 63 2e 22 2c 22 6e 6f 6e 65 75 22 3a 31 2c 22 6c 22 3a 22 5c 2f 64 65 6c 69 76 65 72 79 5c 2f 69 63 6f 6e 73 5c 2f 69 63 6f 6e 73 5f 76 39 30 32 2e 70 6e 67 22 2c 22 Data Ascii: 0,"legUSVCDPA":0,"legUSCPA":0,"legUSUCPA":0,"legUSCAPDP":0,"legAPPI":0,"legDPDPA":0,"legUSTDPSA":0,"legUSOCDPA":0,"legUSMTCDPA":0,"legUSFDBR":0,"legUSWADA":0},{"id":"s902","wsid":86321,"n":"Zendesk Inc.","noneu":1,"l":"\/delivery\/icons\/icons_v902.png","
2024-04-25 20:26:12 UTC	16384	IN	Data Raw: 6f 74 74 6f 6d 20 6c 65 66 74 2e 22 7d 2c 7b 22 73 74 72 4c 61 6e 67 22 3a 22 45 4e 22 2c 22 73 74 72 54 79 70 65 22 3a 22 72 70 64 6c 68 6c 22 2c 22 73 74 72 54 65 78 74 22 3a 22 43 6f 6e 73 65 6e 74 20 74 6f 20 43 6f 6f 6b 69 65 73 20 26 20 44 61 74 61 20 70 72 6f 63 65 73 73 69 6e 67 22 7d 2c 7b 22 73 74 72 4c 61 6e 67 22 3a 22 45 4e 22 2c 22 73 74 72 54 79 70 65 22 3a 22 72 70 64 6c 74 78 74 22 2c 22 73 74 72 54 65 78 74 22 3a 22 4f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 77 65 20 75 73 65 20 63 6f 6f 6b 69 65 73 20 61 6e 64 20 73 69 6d 69 6c 61 72 20 66 75 6e 63 74 69 6f 6e 73 20 74 6f 20 70 72 6f 63 65 73 73 20 65 6e 64 20 64 65 76 69 63 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 6e 64 20 70 65 72 73 6f 6e 61 6c 20 64 61 74 61 2e 20 54 68 65 Data Ascii: ottom left."},{"strLang":"EN","strType":"rpdlhl","strText":"Consent to Cookies & Data processing"},{"strLang":"EN","strType":"rpdltxt","strText":"On this website we use cookies and similar functions to process end device information and personal data. The
2024-04-25 20:26:12 UTC	13160	IN	Data Raw: 69 3e 3c 61 20 72 65 6c 3d 5c 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 75 70 70 6f 72 74 2e 62 72 61 76 65 2e 63 6f 6d 5c 2f 68 63 5c 2f 65 6e 2d 75 73 5c 2f 61 72 74 69 63 6c 65 73 5c 2f 33 36 30 30 32 32 38 30 36 32 31 32 2d 48 6f 77 2d 64 6f 2d 49 2d 75 73 65 2d 53 68 69 65 6c 64 73 2d 77 68 69 6c 65 2d 62 72 6f 77 73 69 6e 67 5c 22 3e 42 72 61 76 65 3c 5c 2f 61 3e 3c 5c 2f 6c 69 3e 5c 72 5c 6e 20 20 3c 6c 69 3e 3c 61 20 72 65 6c 3d 5c 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 66 6f 6c 6c 6f 77 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 68 65 6c 70 2e 6f 70 65 Data Ascii: i><a rel=\"noopener nofollow\" target=\"_blank\" href=\"https:\/\/support.brave.com\/hc\/en-us\/articles\/360022806212-How-do-I-use-Shields-while-browsing\">Brave<\/a><\/li>\r\n <li><a rel=\"noopener nofollow\" target=\"_blank\" href=\"https:\/\/help.ope

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49908	3.131.76.57	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	913	OUT	GET /clock?t=1714076770732&tk=187dd3044367ee2f390e706b16c4d1f5&s=379855&p=%2Fguide%2Ffree-youtube-downloader.html&u=1048432&v=58b776d3de2428599fd11c3427deaccfc480ab43&f=wondershare.com%2Fguide%2Ffree-youtube-downloader.html&ul=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall HTTP/1.1 Host: tracking.crazyegg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.wondershare.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	203	IN	HTTP/1.1 200 SUCCESS Server: awselb/2.0 Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: text/plain Content-Length: 40 Connection: close Cache-Control: no-store Access-Control-Allow-Origin: *
2024-04-25 20:26:12 UTC	40	IN	Data Raw: 31 37 31 34 30 37 36 37 37 32 31 30 31 2c 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 2c 31 2c 43 68 72 6f 6d 65 2c 55 53 Data Ascii: 1714076772101,185.152.66.230,1,Chrome,US

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49910	216.137.45.128	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	596	OUT	GET /lantern_global_20200.min.js HTTP/1.1 Host: lantern.roeyecdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	503	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 1821 Connection: close Last-Modified: Wed, 04 Oct 2023 13:29:29 GMT x-amz-version-id: fJYUF6m2XZ2IXt2687Humlk3u4PwmxEr Server: AmazonS3 Date: Wed, 24 Apr 2024 21:32:15 GMT ETag: "21687d781510e8548771fc69eb39b2c7" X-Cache: Hit from cloudfront Via: 1.1 befa97a817eaed04a94855080a3e4a54.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-C2 X-Amz-Cf-Id: EopFYtyDr8frxoxjAEVtsDLvP9pFmqe5GCihlOjLPxw1iMgHKWWAoQ== Age: 82438
2024-04-25 20:26:12 UTC	1821	IN	Data Raw: 76 61 72 20 6c 61 6e 74 65 72 6e 54 72 61 63 6b 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3f 28 65 5e 31 36 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 65 2f 34 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 3a 28 5b 31 65 37 5d 2b 2d 31 65 33 2b 2d 34 65 33 2b 2d 38 65 33 2b 2d 31 65 31 31 29 2e 72 65 70 6c 61 63 65 28 2f 5b 30 31 38 5d 2f 67 2c 6e 29 7d 72 65 74 75 72 6e 7b 64 6f 54 72 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 76 61 72 20 74 2c 61 2c 69 2c 63 2c 6c 3b 69 66 28 28 6f 3d 76 6f 69 64 20 30 3d 3d 3d 6f 3f 7b 7d 3a 6f 29 2e 73 69 74 65 3d 22 32 30 32 30 30 22 2c 72 2e 63 6f 6f 6b 69 65 2e 69 6e 64 65 78 4f 66 28 22 6c 61 6e 74 65 72 6e 3d 22 29 3e 3d 30 29 3b 65 Data Ascii: var lanternTracker=function(e,r){function n(e){return e?(e^16*Math.random()>>e/4).toString(16):([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,n)}return{doTrack:function(o){var t,a,i,c,l;if((o=void 0===o?{}:o).site="20200",r.cookie.indexOf("lantern=")>=0);e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49909	172.67.22.39	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	1129	OUT	GET /tu.php?pid=48130&nv=_gcl_au%3D1.1.1367721842.1714076765%2C%20srcSite%3Dwww.wondershare.com%2C%20referrer%3D%2C%20_uetsid%3D0b3e81f0034211ef80523331be39900f%2C%20_uetvid%3D0b3ea370034211ef8f1ecfac22ceebac%2C%20gdprAgree-eu%3Dno%2C%20_ce.irv%3Dnew%2C%20cebs%3D1%2C%20_ce.s%3Dv~58b776d3de2428599fd11c3427deaccfc480ab43~lcw~1714076769255~lva~1714076769255~vpv~0~lcw~1714076769256%2C%20IR_gbd%3Dwondershare.com%2C%20IR_15586%3D1714076769684%257C0%257C1714076769684%257C%257C HTTP/1.1 Host: www.linkconnector.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uts_900133_lpcheck=1
2024-04-25 20:26:12 UTC	561	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP="NOI DSP COR NID CUR OUR NOR", policyref="http://www.linkconnector.com/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR NOR" Cache-Control: no-cache Expires: Thu, 25 Apr 2024 20:26:11 GMT Set-Cookie: LCID=LC1714076772.5213308; expires=Tue, 24-Apr-2029 20:26:12 GMT; Max-Age=157680000; path=/; samesite=none; domain=.linkconnector.com; secure X-Server: lcweb1 CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a111138b137bac-ATL
2024-04-25 20:26:12 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 00 00 00 ff ff ff ff ff ff 00 00 00 21 f9 04 05 14 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49911	172.67.22.39	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	700	OUT	GET /js/uts_uid.php?cgid=900133&uts_protocol= HTTP/1.1 Host: www.linkconnector.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uts_900133_lpcheck=1
2024-04-25 20:26:12 UTC	426	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: image/gif Content-Length: 49 Connection: close Set-Cookie: LCUTS_UID_900133=2024-04-25+13%3A26%3A12; expires=Thu, 01-Jan-1970 01:00:00 GMT; Max-Age=-1714073172; path=/; samesite=none; domain=..linkconnector.com; secure X-Server: lcweb1 P3P: CP="NOI DSP COR NID CUR OUR NOR" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a111139aebad7d-ATL
2024-04-25 20:26:12 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 00 00 00 ff ff ff ff ff ff 00 00 00 21 f9 04 05 14 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49912	31.13.65.7	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	1363	OUT	GET /signals/config/475745997703022?v=2.9.154&r=stable&domain=www.wondershare.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105 HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	1465	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2024-04-25 20:26:12 UTC	1524	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2024-04-25 20:26:12 UTC	11	IN	Data Raw: 2f 2a 2a 0a 2a 20 43 6f 70 79 72 Data Ascii: /*** Copyr
2024-04-25 20:26:12 UTC	1500	IN	Data Raw: 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 68 20 74 68 65 20 77 65 62 20 Data Ascii: ight (c) 2017-present, Facebook, Inc. All rights reserved.** You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection with the web
2024-04-25 20:26:12 UTC	1500	IN	Data Raw: 74 75 72 6e 3b 76 61 72 20 67 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3a 22 40 40 69 74 65 72 61 74 6f 72 22 29 3d 3d 3d 22 73 79 6d 62 6f 6c 22 3f 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 61 7d 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 61 21 3d 3d 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f Data Ascii: turn;var g=typeof Symbol==="function"&&typeof (typeof Symbol==="function"?Symbol.iterator:"@@iterator")==="symbol"?function(a){return typeof a}:function(a){return a&&typeof Symbol==="function"&&a.constructor===Symbol&&a!==(typeof Symbol==="function"?Symbo
2024-04-25 20:26:12 UTC	1500	IN	Data Raw: 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 61 2c 62 29 3a 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 61 2c 62 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 7c 7c 28 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 3d 7b 7d 2c 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 3d 7b 7d 2c 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: rototypeOf?Object.setPrototypeOf(a,b):a.__proto__=b)}function l(a,b){if(!(a instanceof b))throw new TypeError("Cannot call a class as a function")}f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a)
2024-04-25 20:26:12 UTC	1500	IN	Data Raw: 2e 73 68 6f 75 6c 64 45 78 74 72 61 63 74 55 73 65 72 44 61 74 61 3b 76 61 72 20 6b 3d 61 26 26 69 3d 3d 6e 75 6c 6c 3b 69 3d 63 28 7b 62 75 74 74 6f 6e 3a 65 2c 63 6f 6e 74 61 69 6e 65 72 45 6c 65 6d 65 6e 74 3a 6b 3f 68 3a 69 2c 73 68 6f 75 6c 64 45 78 74 72 61 63 74 55 73 65 72 44 61 74 61 3a 61 7d 29 3b 61 3d 64 28 29 3b 76 61 72 20 6c 3d 69 2e 66 6f 72 6d 46 69 65 6c 64 46 65 61 74 75 72 65 73 3b 69 3d 69 2e 75 73 65 72 44 61 74 61 3b 66 3d 7b 62 75 74 74 6f 6e 46 65 61 74 75 72 65 73 3a 66 2c 62 75 74 74 6f 6e 54 65 78 74 3a 67 2c 66 6f 72 6d 46 65 61 74 75 72 65 73 3a 6b 3f 5b 5d 3a 6c 2c 70 61 67 65 46 65 61 74 75 72 65 73 3a 61 2c 70 61 72 61 6d 65 74 65 72 73 3a 62 2e 74 72 69 67 67 65 72 28 7b 70 69 78 65 6c 3a 6a 2c 74 61 72 67 65 74 3a 65 7d Data Ascii: .shouldExtractUserData;var k=a&&i==null;i=c({button:e,containerElement:k?h:i,shouldExtractUserData:a});a=d();var l=i.formFieldFeatures;i=i.userData;f={buttonFeatures:f,buttonText:g,formFeatures:k?[]:l,pageFeatures:a,parameters:b.trigger({pixel:j,target:e}
2024-04-25 20:26:12 UTC	1500	IN	Data Raw: 7b 7d 3b 69 66 28 68 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 7b 66 6f 72 6d 46 69 65 6c 64 46 65 61 74 75 72 65 73 3a 6b 2c 75 73 65 72 44 61 74 61 3a 6c 7d 3b 68 3d 68 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 65 29 3b 66 6f 72 28 76 61 72 20 6d 3d 30 3b 6d 3c 68 2e 6c 65 6e 67 74 68 3b 6d 2b 2b 29 7b 76 61 72 20 6e 3d 68 5b 6d 5d 3b 69 66 28 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 49 6e 70 75 74 45 6c 65 6d 65 6e 74 7c 7c 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 54 65 78 74 41 72 65 61 45 6c 65 6d 65 6e 74 7c 7c 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 53 65 6c 65 63 74 45 6c 65 6d 65 6e 74 7c 7c 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 54 4d 4c 42 75 74 74 6f 6e 45 6c 65 6d 65 6e 74 29 7b 76 61 72 20 6f 3d 22 Data Ascii: {};if(h==null)return{formFieldFeatures:k,userData:l};h=h.querySelectorAll(e);for(var m=0;m<h.length;m++){var n=h[m];if(n instanceof HTMLInputElement\|\|n instanceof HTMLTextAreaElement\|\|n instanceof HTMLSelectElement\|\|n instanceof HTMLButtonElement){var o="
2024-04-25 20:26:12 UTC	1500	IN	Data Raw: 76 61 72 20 64 20 69 6e 20 63 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 63 2c 64 29 26 26 28 61 5b 64 5d 3d 63 5b 64 5d 29 7d 72 65 74 75 72 6e 20 61 7d 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 55 74 69 6c 73 22 29 2c 63 3d 62 2e 65 61 63 68 2c 64 3d 2f 5b 5e 5c 73 5c 22 5d 2f 2c 65 3d 2f 5b 5e 5c 73 3a 2b 5c 22 5d 2f 3b 66 75 6e 63 74 69 6f 6e 20 67 28 62 2c 63 2c 66 29 7b 69 66 28 66 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 64 2e 74 65 73 74 28 63 29 3f 63 3d 3d 3d 22 40 22 3f 6e 75 6c 6c 3a 7b 73 74 61 72 74 3a 62 2c 75 73 65 72 4f 72 44 6f 6d 61 69 6e 3a 22 75 73 65 72 22 7d 3a 6e 75 6c 6c 3b 69 66 28 Data Ascii: var d in c)Object.prototype.hasOwnProperty.call(c,d)&&(a[d]=c[d])}return a},b=f.getFbeventsModules("SignalsFBEventsUtils"),c=b.each,d=/[^\s\"]/,e=/[^\s:+\"]/;function g(b,c,f){if(f==null)return d.test(c)?c==="@"?null:{start:b,userOrDomain:"user"}:null;if(
2024-04-25 20:26:12 UTC	1500	IN	Data Raw: 68 28 62 2c 5b 7b 6b 65 79 3a 22 5f 70 61 73 73 65 73 54 68 72 6f 74 74 6c 65 49 6d 70 6c 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 5f 6c 61 73 74 41 72 67 73 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 62 3d 44 61 74 65 2e 6e 6f 77 28 29 2c 63 3d 62 2d 74 68 69 73 2e 5f 6c 61 73 74 54 69 6d 65 3b 69 66 28 63 3e 3d 74 68 69 73 2e 5f 72 61 74 65 4d 53 29 72 65 74 75 72 6e 21 30 3b 66 6f 72 28 76 61 72 20 64 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 65 3d 41 72 72 61 79 28 64 29 2c 66 3d 30 3b 66 3c 64 3b 66 2b 2b 29 65 5b 66 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 66 5d 3b 69 66 28 61 2e 6c 65 6e 67 74 68 21 3d 3d 65 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 30 3b 66 Data Ascii: h(b,[{key:"_passesThrottleImpl",value:function(){var a=this._lastArgs;if(a==null)return!0;var b=Date.now(),c=b-this._lastTime;if(c>=this._rateMS)return!0;for(var d=arguments.length,e=Array(d),f=0;f<d;f++)e[f]=arguments[f];if(a.length!==e.length)return!0;f
2024-04-25 20:26:12 UTC	1500	IN	Data Raw: 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 74 72 61 63 74 46 72 6f 6d 49 6e 70 75 74 73 22 29 2c 42 3d 6e 65 77 20 74 28 29 2c 43 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 44 6f 41 75 74 6f 6d 61 74 69 63 4d 61 74 63 68 69 6e 67 22 29 2c 44 3d 31 30 30 3b 66 75 6e 63 74 69 6f 6e 20 45 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 26 26 62 2e 62 75 74 74 6f 6e 53 65 6c 65 63 74 6f 72 3d 3d 3d 22 65 78 74 65 6e 64 65 64 22 7d 66 75 6e 63 74 69 6f 6e 20 46 28 62 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 63 29 7b 69 66 28 62 2e 64 69 73 61 62 6c 65 41 75 74 6f 43 6f 6e 66 69 67 29 72 65 74 75 72 6e 3b 76 61 72 20 65 3d 63 2e Data Ascii: sModules("signalsFBEventsExtractFromInputs"),B=new t(),C=f.getFbeventsModules("signalsFBEventsDoAutomaticMatching"),D=100;function E(a,b){return b!=null&&b.buttonSelector==="extended"}function F(b){return function(c){if(b.disableAutoConfig)return;var e=c.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49913	34.98.67.3	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	599	OUT	GET /jsp?cn=rmuid&ro=0&cb=___rmuid HTTP/1.1 Host: ut.rd.linksynergy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	426	IN	HTTP/1.1 200 OK Set-Cookie: rmuid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f; Path=/; Domain=linksynergy.com; Expires=Fri, 25 Apr 2025 20:26:12 GMT; Secure; SameSite=None X-Samesite: secure Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Length: 148 Content-Type: text/plain; charset=utf-8 Via: 1.1 google Strict-Transport-Security: max-age=31536000 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:12 UTC	148	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 5f 5f 5f 72 6d 75 69 64 20 26 26 20 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 2e 5f 5f 5f 72 6d 75 69 64 29 20 3d 3d 20 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 5f 5f 5f 72 6d 75 69 64 28 22 33 61 39 64 62 32 35 61 2d 62 31 64 33 2d 34 63 35 32 2d 62 63 39 31 2d 30 63 35 66 32 65 34 32 36 62 32 66 22 29 7d 7d 63 61 74 63 68 28 69 29 7b 7d 7d 28 29 29 Data Ascii: (function(){try{if(window.___rmuid && typeof(window.___rmuid) == "function"){window.___rmuid("3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f")}}catch(i){}}())

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49915	18.244.202.78	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	363	OUT	GET /healthcheck HTTP/1.1 Host: assets-tracking.crazyegg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	631	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 19 Connection: close Date: Tue, 16 Apr 2024 23:59:37 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Access-Control-Expose-Headers: Access-Control-Allow-Origin Access-Control-Max-Age: 31536000 Last-Modified: Fri, 08 Jul 2022 22:25:51 GMT ETag: "d06f04fccf68d0b228a5923187ce1afd" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 93c7f54907396218467f0aa700588688.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P4 X-Amz-Cf-Id: xo9FCN5yvO-8tDcxW0PHIjG-sqWTStHZAslzhA2xUGlJe05t6jrACA== Age: 764797
2024-04-25 20:26:12 UTC	19	IN	Data Raw: 7b 20 22 73 74 61 74 75 73 22 3a 20 22 6f 6b 22 20 7d 0a Data Ascii: { "status": "ok" }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49914	18.165.98.71	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	367	OUT	GET /healthcheck HTTP/1.1 Host: pagestates-tracking.crazyegg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	632	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 19 Connection: close Date: Sat, 06 Apr 2024 19:55:05 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Access-Control-Expose-Headers: Access-Control-Allow-Origin Access-Control-Max-Age: 31536000 Last-Modified: Fri, 08 Jul 2022 22:25:51 GMT ETag: "d06f04fccf68d0b228a5923187ce1afd" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 7a9f6a4fba100d04559a6d3a82b7dc56.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P4 X-Amz-Cf-Id: lV4Lm_Rj3NZFNhkKczTyWaqijRewPzxtK9esHytlr551g-IO3ny7Bw== Age: 1643468
2024-04-25 20:26:12 UTC	19	IN	Data Raw: 7b 20 22 73 74 61 74 75 73 22 3a 20 22 6f 6b 22 20 7d 0a Data Ascii: { "status": "ok" }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49916	3.218.217.33	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	652	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=lenkmio.com HTTP/1.1 Host: lenkmio.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:12 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49921	3.218.217.33	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	654	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=z.asbmit.com HTTP/1.1 Host: z.asbmit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:12 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49920	52.0.201.85	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	658	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=ad.admitad.com HTTP/1.1 Host: ad.admitad.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:12 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49919	34.199.45.162	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	652	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=pafutos.com HTTP/1.1 Host: pafutos.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:12 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49922	34.199.45.162	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	648	OUT	GET /tt?response_type=img&adm_method=gtm_template&payment_type=sale&uid=&campaign_code=ef655e4ac9&channel=na&order_id=USD&action_code=1&promocode=USD&tariff_code=1&position_id=1&position_count=1&price=USD&quantity=1&currency_code=USD&product_id=total_cart&suid=gtm_template&action_useragent=gtm_template&domain=tjzuh.com HTTP/1.1 Host: tjzuh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	143	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: image/png Content-Length: 126 Connection: close Server: nginx/1.18.0
2024-04-25 20:26:12 UTC	126	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 00 10 49 44 41 54 78 da 62 fa ff ff 3f 03 40 80 01 00 09 06 03 00 f8 0f 87 64 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRgAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?@dIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49925	3.131.76.57	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	655	OUT	GET /clock?t=1714076770732&tk=187dd3044367ee2f390e706b16c4d1f5&s=379855&p=%2Fguide%2Ffree-youtube-downloader.html&u=1048432&v=58b776d3de2428599fd11c3427deaccfc480ab43&f=wondershare.com%2Fguide%2Ffree-youtube-downloader.html&ul=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall HTTP/1.1 Host: tracking.crazyegg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:12 UTC	203	IN	HTTP/1.1 200 SUCCESS Server: awselb/2.0 Date: Thu, 25 Apr 2024 20:26:12 GMT Content-Type: text/plain Content-Length: 40 Connection: close Cache-Control: no-store Access-Control-Allow-Origin: *
2024-04-25 20:26:12 UTC	40	IN	Data Raw: 31 37 31 34 30 37 36 37 37 32 38 32 35 2c 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 2c 31 2c 43 68 72 6f 6d 65 2c 55 53 Data Ascii: 1714076772825,185.152.66.230,1,Chrome,US

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49928	104.22.48.169	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	415	OUT	GET /js/uts_uid.php?cgid=900133&uts_protocol= HTTP/1.1 Host: www.linkconnector.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uts_900133_lpcheck=1
2024-04-25 20:26:13 UTC	426	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:13 GMT Content-Type: image/gif Content-Length: 49 Connection: close Set-Cookie: LCUTS_UID_900133=2024-04-25+13%3A26%3A13; expires=Thu, 01-Jan-1970 01:00:00 GMT; Max-Age=-1714073173; path=/; samesite=none; domain=..linkconnector.com; secure X-Server: lcweb1 P3P: CP="NOI DSP COR NID CUR OUR NOR" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a11117fb861f9d-ATL
2024-04-25 20:26:13 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 00 00 00 ff ff ff ff ff ff 00 00 00 21 f9 04 05 14 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49929	104.22.48.169	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	871	OUT	GET /tu.php?pid=48130&nv=_gcl_au%3D1.1.1367721842.1714076765%2C%20srcSite%3Dwww.wondershare.com%2C%20referrer%3D%2C%20_uetsid%3D0b3e81f0034211ef80523331be39900f%2C%20_uetvid%3D0b3ea370034211ef8f1ecfac22ceebac%2C%20gdprAgree-eu%3Dno%2C%20_ce.irv%3Dnew%2C%20cebs%3D1%2C%20_ce.s%3Dv~58b776d3de2428599fd11c3427deaccfc480ab43~lcw~1714076769255~lva~1714076769255~vpv~0~lcw~1714076769256%2C%20IR_gbd%3Dwondershare.com%2C%20IR_15586%3D1714076769684%257C0%257C1714076769684%257C%257C HTTP/1.1 Host: www.linkconnector.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uts_900133_lpcheck=1; LCID=LC1714076772.5213308
2024-04-25 20:26:13 UTC	561	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:13 GMT Content-Type: image/gif Content-Length: 49 Connection: close P3P: CP="NOI DSP COR NID CUR OUR NOR", policyref="http://www.linkconnector.com/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR NOR" Cache-Control: no-cache Expires: Thu, 25 Apr 2024 20:26:12 GMT Set-Cookie: LCID=LC1714076772.5213308; expires=Tue, 24-Apr-2029 20:26:13 GMT; Max-Age=157680000; path=/; samesite=none; domain=.linkconnector.com; secure X-Server: lcweb1 CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87a11117eec0674d-ATL
2024-04-25 20:26:13 UTC	49	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 91 00 00 00 00 00 ff ff ff ff ff ff 00 00 00 21 f9 04 05 14 00 02 00 2c 00 00 00 00 01 00 01 00 00 02 02 54 01 00 3b Data Ascii: GIF89a!,T;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49930	35.244.154.8	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:12 UTC	684	OUT	GET /458359.gif?partner_uid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:13 UTC	735	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://idsync.rlcdn.com/1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDNhOWRiMjVhLWIxZDMtNGM1Mi1iYzkxLTBjNWYyZTQyNmIyZhAAGg0I5fiqsQYSBQjoBxAAQgBKAA P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=D9ODw24nQCqLMucYiiJbK5HQEfqgOLnpzPc3OOEamos=; Path=/; Domain=rlcdn.com; Expires=Fri, 25 Apr 2025 20:26:13 GMT; Secure; SameSite=None Set-Cookie: pxrc=CAA=; Path=/; Domain=rlcdn.com; Expires=Mon, 24 Jun 2024 20:26:13 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Thu, 25 Apr 2024 20:26:13 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49932	31.13.65.36	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	927	OUT	GET /tr/?id=475745997703022&ev=PageView&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&rl=&if=false&ts=1714076772273&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1714076772272.1933195972&ler=empty&cdl=API_unavailable&it=1714076770754&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:13 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=109, rtx=0, c=10, mss=1277, tbw=3437, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Thu, 25 Apr 2024 20:26:13 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49931	31.13.65.36	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	1037	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=475745997703022&ev=PageView&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&rl=&if=false&ts=1714076772273&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1714076772272.1933195972&ler=empty&cdl=API_unavailable&it=1714076770754&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source;navigation-source, trigger Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:13 UTC	948	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-25 20:26:13 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-25 20:26:13 UTC	1576	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch
2024-04-25 20:26:13 UTC	73	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`
2024-04-25 20:26:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49927	34.252.42.217	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	928	OUT	GET /track.php?fingerprint=&referrer=&landingpage=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&site=20200 HTTP/1.1 Host: lantern.roeye.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:13 UTC	227	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:13 GMT Content-Type: image/gif Content-Length: 0 Connection: close Server: nginx Set-Cookie: 20200_lantern=; Path=/; Domain=roeye.com; Expires=Thu, 24 Oct 2024 20:26:13 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49933	89.187.167.4	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	759	OUT	GET /delivery/crossdomain.html HTTP/1.1 Host: cdn.consentmanager.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:13 UTC	553	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2107 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Last-Modified: Thu, 29 Sep 2022 20:25:49 GMT ETag: "83b-5e9d6aed4ad40" X-77-NZT: EwwBWbunAQG2Qw0AAAwBuUwKEwH3QAAAAAwBnJIhHwH3PAAAAA X-77-NZT-Ray: 9a26d72602be559865bc2a667e7c3427 X-Accel-Expires: @1714079259 X-Accel-Date: 1714073378 X-77-Cache: HIT X-77-Age: 3395 Server: CDN77-Turbo X-Cache: REVALIDATED X-Age: 3395 X-77-POP: londonGB Accept-Ranges: bytes
2024-04-25 20:26:13 UTC	2107	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 0d 0a 20 20 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 4d 65 73 73 61 67 65 20 28 65 76 65 6e 74 29 0d 0a 20 20 7b 0d 0a 20 20 20 74 72 79 0d 0a 20 20 20 7b 0d 0a 20 20 20 20 69 66 20 28 6c 6f 63 61 6c 53 74 6f 72 61 67 65 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 76 61 72 20 6d 73 67 20 3d 20 74 79 70 65 6f 66 20 65 76 65 6e 74 2e 64 61 74 61 20 3d 3d 3d 20 27 73 74 72 69 6e 67 27 20 3f 20 65 76 65 6e 74 2e 64 61 74 61 20 3a 20 27 27 3b 0d 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title></title> <script> function handleMessage (event) { try { if (localStorage) { var msg = typeof event.data === 'string' ? event.data : '';

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49935	35.244.154.8	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	808	OUT	GET /1000.gif?memo=CPf8GxIwCiwIARCd5gEaJDNhOWRiMjVhLWIxZDMtNGM1Mi1iYzkxLTBjNWYyZTQyNmIyZhAAGg0I5fiqsQYSBQjoBxAAQgBKAA HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=D9ODw24nQCqLMucYiiJbK5HQEfqgOLnpzPc3OOEamos=; pxrc=CAA=
2024-04-25 20:26:13 UTC	748	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://tags.rd.linksynergy.com/cs?ns=lr&uid3=3655b587ed44784ee9d0d5fb3f19f505e7d1a5e63b8fe901319014e3fd24a8086ac34734d8e453ee P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=D9ODw24nQCqLMucYiiJbK5HQEfqgOLnpzPc3OOEamos=; Path=/; Domain=rlcdn.com; Expires=Fri, 25 Apr 2025 20:26:13 GMT; Secure; SameSite=None Set-Cookie: pxrc=COX4qrEGEgUI6AcQABIGCOTrARAA; Path=/; Domain=rlcdn.com; Expires=Mon, 24 Jun 2024 20:26:13 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Thu, 25 Apr 2024 20:26:13 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49938	172.217.215.154	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	939	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&uid=not_logged_in&gjid=802999264&_gid=1258307180.1714076773&_u=6GhACEABBAAAAGAFKkC~&z=1543807389 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.wondershare.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:13 UTC	597	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.wondershare.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 25 Apr 2024 20:26:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:13 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49939	31.13.65.36	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	642	OUT	GET /tr/?id=475745997703022&ev=PageView&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&rl=&if=false&ts=1714076772273&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1714076772272.1933195972&ler=empty&cdl=API_unavailable&it=1714076770754&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:13 UTC	465	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=109, rtx=0, c=10, mss=1277, tbw=3437, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Thu, 25 Apr 2024 20:26:13 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49940	31.13.65.36	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	679	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=475745997703022&ev=PageView&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&rl=&if=false&ts=1714076772273&sw=1280&sh=1024&v=2.9.154&r=stable&ec=0&o=4126&fbp=fb.1.1714076772272.1933195972&ler=empty&cdl=API_unavailable&it=1714076770754&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	900	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-25 20:26:14 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-25 20:26:14 UTC	1609	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49941	173.194.219.154	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	1404	OUT	GET /td/rul/1004581587?random=1714076772858&cv=11&fst=1714076772858&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	785	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 25-Apr-2024 20:41:13 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-25 20:26:14 UTC	470	IN	Data Raw: 36 36 39 32 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 6f 72 69 67 69 6e 2d 74 72 69 61 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 41 76 68 35 4e 79 30 58 45 46 43 79 51 37 2b 6f 4e 69 65 58 73 6b 55 72 71 59 38 65 64 55 7a 4c 35 2f 58 72 77 4b 6c 47 6a 41 52 51 48 57 34 54 46 52 4b 2b 6a 56 64 35 48 6e 44 49 70 59 32 30 6e 35 4f 4c 48 66 67 55 34 6b 75 37 78 34 38 4e 33 75 68 47 2f 41 30 41 41 41 42 78 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 52 76 64 57 4a 73 5a 57 4e 73 61 57 4e 72 4c 6d 35 6c 64 44 6f 30 4e 44 4d 69 4c 43 4a 6d 5a 57 46 30 64 58 4a 6c 49 6a 6f 69 55 48 4a 70 64 6d 46 6a 65 56 4e 68 62 6d 52 69 62 33 68 42 5a 48 4e 42 55 45 6c 7a 49 69 77 69 5a 58 68 77 Data Ascii: 6692<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhw
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 70 69 72 61 74 69 6f 6e 54 69 6d 65 49 6e 53 65 63 6f 6e 64 73 22 3a 33 31 31 30 34 30 30 30 2c 22 69 6e 74 65 72 65 73 74 47 72 6f 75 70 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 6f 77 6e 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 22 2c 22 6e 61 6d 65 22 3a 22 31 6a 32 38 38 38 38 39 33 22 2c 22 62 69 64 64 69 6e 67 4c 6f 67 69 63 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 62 6a 73 22 2c 22 64 61 69 6c 79 55 70 64 61 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 75 70 64 61 74 65 3f 69 67 5f 6e 61 6d 65 3d 31 6a 32 38 38 38 38 39 33 5c 75 30 30 32 36 74 61 67 5f 65 69 64 3d Data Ascii: pirationTimeInSeconds":31104000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j2888893","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=1j2888893\u0026tag_eid=
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 67 5f 69 64 3d 31 32 32 32 31 31 30 31 35 33 34 30 5c 75 30 30 32 36 63 72 5f 69 64 3d 35 31 37 32 32 33 37 30 38 30 39 30 5c 75 30 30 32 36 63 76 5f 69 64 3d 33 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 31 6a 32 38 38 38 38 39 33 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 31 32 32 32 31 31 30 31 35 33 34 30 22 2c 22 35 31 37 32 32 33 37 30 38 30 39 30 22 2c 22 33 22 2c 22 31 32 38 35 30 34 30 35 31 30 38 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 31 74 4e 4e 71 4f 4b 43 4d 51 67 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 Data Ascii: g_id=122211015340\u0026cr_id=517223708090\u0026cv_id=3\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=1j2888893","metadata":["122211015340","517223708090","3","12850405108"],"adRenderId":"1tNNqOKCMQg"},{"renderUrl":"ht
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 2c 22 65 6e 61 62 6c 65 42 69 64 64 69 6e 67 53 69 67 6e 61 6c 73 50 72 69 6f 72 69 74 69 7a 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 74 72 75 73 74 65 64 42 69 64 64 69 6e 67 53 69 67 6e 61 6c 73 53 6c 6f 74 53 69 7a 65 4d 6f 64 65 22 3a 22 61 6c 6c 2d 73 6c 6f 74 73 2d 72 65 71 75 65 73 74 65 64 2d 73 69 7a 65 73 22 7d 7d 2c 7b 22 61 63 74 69 6f 6e 22 3a 31 2c 22 69 6e 74 65 72 65 73 74 47 72 6f 75 70 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 6f 77 6e 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 22 2c 22 6e 61 6d 65 22 3a 22 31 6a 38 38 30 36 30 39 33 33 22 2c 22 70 72 69 6f 72 69 74 79 22 3a 35 39 39 33 37 2c 22 65 6e 61 62 6c 65 42 69 64 64 69 6e 67 53 69 67 6e 61 6c 73 50 72 69 6f 72 69 74 69 7a 61 74 69 Data Ascii: ,"enableBiddingSignalsPrioritization":true,"trustedBiddingSignalsSlotSizeMode":"all-slots-requested-sizes"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j88060933","priority":59937,"enableBiddingSignalsPrioritizati
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 30 32 36 63 72 5f 69 64 3d 36 31 38 31 31 35 39 34 31 30 39 35 5c 75 30 30 32 36 63 76 5f 69 64 3d 30 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 31 6a 34 31 34 37 33 33 33 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 31 33 37 31 36 34 38 39 37 31 38 30 22 2c 22 36 31 38 31 31 35 39 34 31 30 39 35 22 2c 6e 75 6c 6c 2c 22 31 37 31 38 32 37 39 38 35 31 39 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 55 45 63 6b 54 43 6f 51 56 66 55 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 73 66 2e 64 6f 75 62 6c 65 63 6c Data Ascii: 026cr_id=618115941095\u0026cv_id=0\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=1j4147333","metadata":["137164897180","618115941095",null,"17182798519"],"adRenderId":"UEckTCoQVfU"},{"renderUrl":"https://tdsf.doublecl
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 31 6a 34 31 34 37 33 33 33 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 31 32 32 32 31 31 30 31 35 33 34 30 22 2c 22 36 38 32 30 34 30 33 30 32 32 36 37 22 2c 22 31 22 2c 22 31 32 38 35 30 34 30 35 31 30 38 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 6a 6c 79 67 35 35 72 6f 6c 2d 59 22 7d 5d 2c 22 65 78 65 63 75 74 69 6f 6e 4d 6f 64 65 22 3a 22 67 72 6f 75 70 2d 62 79 2d 6f 72 69 67 69 6e 22 2c 22 62 69 64 64 69 6e 67 57 61 73 6d 48 65 6c 70 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 62 75 79 Data Ascii: H}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=1j4147333","metadata":["122211015340","682040302267","1","12850405108"],"adRenderId":"jlyg55rol-Y"}],"executionMode":"group-by-origin","biddingWasmHelperUrl":"https://td.doubleclick.net/td/buy
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 22 31 32 38 35 30 35 39 32 35 38 35 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 78 61 47 4c 79 4b 57 68 65 6d 30 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 73 66 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 31 33 36 31 37 38 33 35 39 35 38 33 5c 75 30 30 32 36 63 72 5f 69 64 3d 36 37 37 37 33 34 36 34 31 33 34 37 5c 75 30 30 32 36 63 76 5f 69 64 3d 32 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 31 6a 33 30 30 30 32 37 37 33 22 2c 22 Data Ascii: "12850592585"],"adRenderId":"xaGLyKWhem0"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=136178359583\u0026cr_id=677734641347\u0026cv_id=2\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=1j30002773","
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 3a 22 68 74 74 70 73 3a 2f 2f 74 64 73 66 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 31 33 36 31 37 38 33 35 39 35 38 33 5c 75 30 30 32 36 63 72 5f 69 64 3d 36 38 31 34 39 32 38 31 33 33 34 35 5c 75 30 30 32 36 63 76 5f 69 64 3d 34 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 31 6a 33 30 30 30 32 37 37 33 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 31 33 36 31 37 38 33 35 39 35 38 33 22 2c 22 36 38 31 34 39 32 38 31 33 33 34 35 22 2c 22 34 22 2c 22 31 32 38 35 30 35 39 32 35 Data Ascii: :"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=136178359583\u0026cr_id=681492813345\u0026cv_id=4\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=1j30002773","metadata":["136178359583","681492813345","4","128505925
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 36 31 37 38 33 35 39 35 38 33 5c 75 30 30 32 36 63 72 5f 69 64 3d 36 38 31 34 39 32 38 31 33 33 35 37 5c 75 30 30 32 36 63 76 5f 69 64 3d 34 5c 75 30 30 32 36 66 6f 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 31 6a 33 30 30 30 32 37 37 33 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 31 33 36 31 37 38 33 35 39 35 38 33 22 2c 22 36 38 31 34 39 32 38 31 33 33 35 37 22 2c 22 34 22 2c 22 31 32 38 35 30 35 39 32 35 38 35 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 43 58 65 4c 55 4c 36 39 63 6b 45 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f Data Ascii: 6178359583\u0026cr_id=681492813357\u0026cv_id=4\u0026format=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=1j30002773","metadata":["136178359583","681492813357","4","12850592585"],"adRenderId":"CXeLUL69ckE"},{"renderUrl":"https://
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 72 6d 61 74 3d 24 7b 41 44 5f 57 49 44 54 48 7d 78 24 7b 41 44 5f 48 45 49 47 48 54 7d 5c 75 30 30 32 36 72 64 73 3d 24 7b 52 45 4e 44 45 52 5f 44 41 54 41 7d 5c 75 30 30 32 36 73 65 61 74 3d 32 5c 75 30 30 32 36 72 70 5f 69 64 3d 31 6a 33 30 30 30 32 37 37 33 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 5b 22 31 33 36 31 37 38 33 35 39 35 38 33 22 2c 22 36 38 31 35 33 38 33 37 38 37 31 37 22 2c 22 31 22 2c 22 31 32 38 35 30 35 39 32 35 38 35 22 5d 2c 22 61 64 52 65 6e 64 65 72 49 64 22 3a 22 6a 47 74 77 47 34 6d 6e 46 69 34 22 7d 2c 7b 22 72 65 6e 64 65 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 73 66 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 74 64 2f 61 64 66 65 74 63 68 2f 67 64 61 3f 61 64 67 5f 69 64 3d 31 33 36 31 37 38 33 35 39 35 38 33 Data Ascii: rmat=${AD_WIDTH}x${AD_HEIGHT}\u0026rds=${RENDER_DATA}\u0026seat=2\u0026rp_id=1j30002773","metadata":["136178359583","681538378717","1","12850592585"],"adRenderId":"jGtwG4mnFi4"},{"renderUrl":"https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=136178359583

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49942	173.194.219.154	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	1403	OUT	GET /td/rul/578746000?random=1714076772866&cv=11&fst=1714076772866&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	785	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 25-Apr-2024 20:41:14 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-25 20:26:14 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-04-25 20:26:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49944	34.98.67.3	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:13 UTC	778	OUT	GET /cs?ns=lr&uid3=3655b587ed44784ee9d0d5fb3f19f505e7d1a5e63b8fe901319014e3fd24a8086ac34734d8e453ee HTTP/1.1 Host: tags.rd.linksynergy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rmuid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f
2024-04-25 20:26:14 UTC	542	IN	HTTP/1.1 200 OK Set-Cookie: rmuid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f; Path=/; Domain=linksynergy.com; Expires=Fri, 25 Apr 2025 20:26:14 GMT; Secure; SameSite=None Set-Cookie: icts=2024-04-25T20:26:14Z; Path=/; Domain=linksynergy.com; Expires=Fri, 25 Apr 2025 20:26:14 GMT; Secure; SameSite=None X-Samesite: secure Date: Thu, 25 Apr 2024 20:26:14 GMT Content-Length: 37 Content-Type: image/gif Via: 1.1 google Strict-Transport-Security: max-age=31536000 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	37	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49943	34.252.42.217	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	643	OUT	GET /track.php?fingerprint=&referrer=&landingpage=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.0.0%20Safari%2F537.36&site=20200 HTTP/1.1 Host: lantern.roeye.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	227	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 20:26:14 GMT Content-Type: image/gif Content-Length: 0 Connection: close Server: nginx Set-Cookie: 20200_lantern=; Path=/; Domain=roeye.com; Expires=Thu, 24 Oct 2024 20:26:14 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49945	172.217.215.154	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	939	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&uid=not_logged_in&gjid=802999264&_gid=1258307180.1714076773&_u=6GhACEABBAAAACAFKkC~&z=1882367113 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.wondershare.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	597	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.wondershare.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49947	172.217.215.154	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	919	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-2&cid=512838165.1714076768&jid=951242064&gjid=765186483&_gid=1258307180.1714076773&_u=6GjACEABBAAAAGAFKkC~&z=505942294 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.wondershare.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	597	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.wondershare.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49949	74.125.138.157	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	1280	OUT	GET /pagead/viewthroughconversion/1004581587/?random=1714076772858&cv=11&fst=1714076772858&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	842	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 25-Apr-2024 20:41:14 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-25 20:26:14 UTC	413	IN	Data Raw: 61 34 62 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 7d 6b 3d 70 7d 76 61 72 20 Data Ascii: a4b(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 29 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 76 61 72 20 61 3b 61 3a 7b 69 66 28 61 3d 66 2e 6e 61 76 69 67 61 74 6f 72 29 69 66 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b 20 61 3b 61 3d 22 22 7d 72 65 74 75 72 6e 2d 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 79 28 29 7b 72 65 74 75 72 6e 20 67 3f 21 21 74 26 26 30 3c 74 2e 62 72 61 6e 64 73 2e 6c 65 6e 67 74 68 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 20 79 28 29 3f 77 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 78 28 22 43 68 72 6f 6d 65 22 29 7c 7c 78 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 79 28 29 3f 30 3a 78 28 22 45 64 67 65 22 29 29 7c 7c 78 28 22 53 69 6c 6b Data Ascii: a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk
2024-04-25 20:26:14 UTC	974	IN	Data Raw: 28 74 68 69 73 29 3b 3b 73 2e 73 73 5f 28 77 69 6e 64 6f 77 2c 27 4f 6a 45 33 4d 54 51 77 4e 7a 59 33 4e 7a 49 34 4e 54 67 27 2c 5b 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 61 67 65 61 64 2f 31 70 2d 75 73 65 72 2d 6c 69 73 74 2f 31 30 30 34 35 38 31 35 38 37 2f 3f 72 61 6e 64 6f 6d 5c 78 33 64 31 37 31 34 30 37 36 37 37 32 38 35 38 5c 78 32 36 63 76 5c 78 33 64 31 31 5c 78 32 36 66 73 74 5c 78 33 64 31 37 31 34 30 37 35 32 30 30 30 30 30 5c 78 32 36 62 67 5c 78 33 64 66 66 66 66 66 66 5c 78 32 36 67 75 69 64 5c 78 33 64 4f 4e 5c 78 32 36 61 73 79 6e 63 5c 78 33 64 31 5c 78 32 36 67 74 6d 5c 78 33 64 34 35 62 65 34 34 6f 30 7a 38 37 38 38 34 32 33 36 34 7a 61 32 30 31 5c 78 32 36 67 63 64 5c 78 33 64 31 33 72 33 72 33 72 Data Ascii: (this);;s.ss_(window,'OjE3MTQwNzY3NzI4NTg',['https://www.google.com/pagead/1p-user-list/1004581587/?random\x3d1714076772858\x26cv\x3d11\x26fst\x3d1714075200000\x26bg\x3dffffff\x26guid\x3dON\x26async\x3d1\x26gtm\x3d45be44o0z878842364za201\x26gcd\x3d13r3r3r
2024-04-25 20:26:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49950	172.217.215.156	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	635	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&uid=not_logged_in&gjid=802999264&_gid=1258307180.1714076773&_u=6GhACEABBAAAAGAFKkC~&z=1543807389 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49951	74.125.138.157	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	1319	OUT	GET /pagead/viewthroughconversion/578746000/?random=1714076772866&cv=11&fst=1714076772866&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-04-25 20:26:14 UTC	1011	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUkaoFjFT60v3DPVnpsF6-t-1rDa3x49wlwm0Anmo1rPQfa0Oo5rH2VzREmN; expires=Sat, 25-Apr-2026 20:26:14 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-25 20:26:14 UTC	244	IN	Data Raw: 61 35 63 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 20 3d 20 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 7d 3b 2f 2a 20 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 20 2a 2f 20 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 67 2c 6b 3b 61 3a 7b 66 6f 72 28 76 61 72 20 6c 3d 5b 22 43 4c 4f 53 55 52 45 5f 46 4c 41 47 53 22 5d 2c 70 3d 66 2c 71 3d 30 3b 71 3c 6c 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 69 66 28 70 3d 70 5b 6c 5b 71 5d 5d 2c 6e 75 6c 6c 3d 3d 70 29 7b 6b 3d 6e 75 6c 6c 3b 62 72 65 61 6b Data Ascii: a5c(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break
2024-04-25 20:26:14 UTC	1255	IN	Data Raw: 20 61 7d 6b 3d 70 7d 76 61 72 20 72 3d 6b 26 26 6b 5b 36 31 30 34 30 31 33 30 31 5d 3b 67 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 21 31 3b 76 61 72 20 74 2c 76 3d 66 2e 6e 61 76 69 67 61 74 6f 72 3b 74 3d 76 3f 76 2e 75 73 65 72 41 67 65 6e 74 44 61 74 61 7c 7c 6e 75 6c 6c 3a 6e 75 6c 6c 3b 66 75 6e 63 74 69 6f 6e 20 77 28 64 29 7b 72 65 74 75 72 6e 20 67 3f 74 3f 74 2e 62 72 61 6e 64 73 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 28 61 3d 61 2e 62 72 61 6e 64 29 26 26 2d 31 21 3d 61 2e 69 6e 64 65 78 4f 66 28 64 29 7d 29 3a 21 31 3a 21 31 7d 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 76 61 72 20 61 3b 61 3a 7b 69 66 28 61 3d 66 2e 6e 61 76 69 67 61 74 6f 72 29 69 66 28 61 3d 61 2e 75 73 65 72 41 67 65 6e 74 29 62 72 65 61 6b 20 61 3b Data Ascii: a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;
2024-04-25 20:26:14 UTC	1160	IN	Data Raw: 3d 74 79 70 65 6f 66 20 47 2e 65 78 65 63 53 63 72 69 70 74 7c 7c 47 2e 65 78 65 63 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 46 5b 30 5d 29 3b 20 66 6f 72 28 76 61 72 20 48 3b 46 2e 6c 65 6e 67 74 68 26 26 28 48 3d 46 2e 73 68 69 66 74 28 29 29 3b 29 46 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 43 3f 47 5b 48 5d 26 26 47 5b 48 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 48 5d 3f 47 3d 47 5b 48 5d 3a 47 3d 47 5b 48 5d 3d 7b 7d 3a 47 5b 48 5d 3d 43 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 3b 73 2e 73 73 5f 28 77 69 6e 64 6f 77 2c 27 4f 6a 45 33 4d 54 51 77 4e 7a 59 33 4e 7a 49 34 4e 6a 59 27 2c 5b 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 61 67 65 61 64 2f 31 70 2d 75 73 65 72 2d 6c 69 73 Data Ascii: =typeof G.execScript\|\|G.execScript("var "+F[0]); for(var H;F.length&&(H=F.shift());)F.length\|\|void 0===C?G[H]&&G[H]!==Object.prototype[H]?G=G[H]:G=G[H]={}:G[H]=C;}).call(this);;s.ss_(window,'OjE3MTQwNzY3NzI4NjY',['https://www.google.com/pagead/1p-user-lis
2024-04-25 20:26:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49952	34.98.67.3	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	520	OUT	GET /cs?ns=lr&uid3=3655b587ed44784ee9d0d5fb3f19f505e7d1a5e63b8fe901319014e3fd24a8086ac34734d8e453ee HTTP/1.1 Host: tags.rd.linksynergy.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rmuid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f; icts=2024-04-25T20:26:14Z
2024-04-25 20:26:14 UTC	542	IN	HTTP/1.1 200 OK Set-Cookie: rmuid=3a9db25a-b1d3-4c52-bc91-0c5f2e426b2f; Path=/; Domain=linksynergy.com; Expires=Fri, 25 Apr 2025 20:26:14 GMT; Secure; SameSite=None Set-Cookie: icts=2024-04-25T20:26:14Z; Path=/; Domain=linksynergy.com; Expires=Fri, 25 Apr 2025 20:26:14 GMT; Secure; SameSite=None X-Samesite: secure Date: Thu, 25 Apr 2024 20:26:14 GMT Content-Length: 37 Content-Type: image/gif Via: 1.1 google Strict-Transport-Security: max-age=31536000 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	37	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 00 00 00 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49954	172.217.215.156	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	675	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&uid=not_logged_in&gjid=802999264&_gid=1258307180.1714076773&_u=6GhACEABBAAAACAFKkC~&z=1882367113 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-04-25 20:26:14 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49955	172.217.215.156	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	655	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-4839360-2&cid=512838165.1714076768&jid=951242064&gjid=765186483&_gid=1258307180.1714076773&_u=6GjACEABBAAAAGAFKkC~&z=505942294 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-04-25 20:26:14 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49958	172.217.215.103	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	867	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&_u=6GhACEABBAAAAGAFKkC~&z=1285735140 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49961	172.217.215.103	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	867	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&_u=6GhACEABBAAAACAFKkC~&z=1654147962 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49957	172.217.215.103	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	866	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-2&cid=512838165.1714076768&jid=951242064&_u=6GjACEABBAAAAGAFKkC~&z=1454381953 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49959	172.217.215.103	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	1408	OUT	GET /pagead/1p-user-list/1004581587/?random=1714076772858&cv=11&fst=1714075200000&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqFvntLDuc52T4GOvgZLQOgwqvUVHllQ&random=3629556956&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49960	172.217.215.103	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	1425	OUT	GET /pagead/1p-user-list/578746000/?random=1714076772866&cv=11&fst=1714075200000&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQB7FLtqfqVZnJSkdyBmSwmLrbnuVKIeArFe11F7aIV2mMk_-GWAWZeZ&random=3332743189&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:14 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49962	172.217.215.103	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:14 UTC	939	OUT	POST /pagead/landing?gcs=G111&gcu=1&gcd=13r3r3r3r5&rnd=1640983559.1714076766&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html&dma=0&npa=0&gtm=45He44o0n81WRMX62Nv78842364za200&auid=1367721842.1714076765 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.wondershare.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	876	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G111&gcu=1&gcd=13r3r3r3r5&rnd=1640983559.1714076766&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html&dma=0&npa=0&gtm=45He44o0n81WRMX62Nv78842364za200&auid=1367721842.1714076765 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49956	87.230.98.78	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	861	OUT	GET /delivery/info/?id=86321&did=1&cfdid=1&t=pv.cn.d_reg0.oonv.d_dnsx&h=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&o=1714076772825&l=EN&lv=92582&d=1&ct=14&e=&e2=&e3=&i=&sv=57&dv=105& HTTP/1.1 Host: b.delivery.consentmanager.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	380	IN	HTTP/1.1 200 OK date: Thu, 25 Apr 2024 20:26:15 GMT cache-control: no-store, no-cache, must-revalidate edge-control: no-store, no-cache, must-revalidate expires: Thu, 01 Dec 1994 16:00:00 GMT pragma: no-cache access-control-allow-origin: * x-xss-protection: 0 last-modified: Thu, 25 Apr 2024 20:26:15 GMT content-length: 43 content-type: image/gif connection: close
2024-04-25 20:26:15 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 04 02 04 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49965	142.250.105.99	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	1140	OUT	GET /pagead/1p-user-list/578746000/?random=1714076772866&cv=11&fst=1714075200000&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQB7FLtqfqVZnJSkdyBmSwmLrbnuVKIeArFe11F7aIV2mMk_-GWAWZeZ&random=3332743189&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49964	142.250.105.99	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	1123	OUT	GET /pagead/1p-user-list/1004581587/?random=1714076772858&cv=11&fst=1714075200000&bg=ffffff&guid=ON&async=1&gtm=45be44o0z878842364za201&gcd=13r3r3r3r5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&hn=www.googleadservices.com&frm=0&tiba=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&npa=0&us_privacy=1---&pscdl=noapi&auid=1367721842.1714076765&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqFvntLDuc52T4GOvgZLQOgwqvUVHllQ&random=3629556956&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49966	142.250.105.99	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	582	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&_u=6GhACEABBAAAAGAFKkC~&z=1285735140 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49963	142.250.105.99	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	582	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-64&cid=512838165.1714076768&jid=452140802&_u=6GhACEABBAAAACAFKkC~&z=1654147962 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49967	74.125.138.157	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	973	OUT	GET /pagead/landing?gcs=G111&gcu=1&gcd=13r3r3r3r5&rnd=1640983559.1714076766&url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html&dma=0&npa=0&gtm=45He44o0n81WRMX62Nv78842364za200&auid=1367721842.1714076765 HTTP/1.1 Host: googleads.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkaoFjFT60v3DPVnpsF6-t-1rDa3x49wlwm0Anmo1rPQfa0Oo5rH2VzREmN
2024-04-25 20:26:15 UTC	652	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49968	142.250.105.99	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	581	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-4839360-2&cid=512838165.1714076768&jid=951242064&_u=6GjACEABBAAAAGAFKkC~&z=1454381953 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-25 20:26:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49969	172.217.215.154	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	939	OUT	POST /g/collect?v=2&tid=G-24WTSJBD5B&cid=512838165.1714076768&gtm=45je44o0v868368117z8831908228za200&aip=1&dma=0&gcs=G111&gcd=13r3r3r3r5&npa=0 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.wondershare.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkaoFjFT60v3DPVnpsF6-t-1rDa3x49wlwm0Anmo1rPQfa0Oo5rH2VzREmN
2024-04-25 20:26:15 UTC	453	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.wondershare.com Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49972	216.239.36.181	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	1618	OUT	POST /g/collect?v=2&tid=G-24WTSJBD5B&gtm=45je44o0v868368117z8831908228za200&_p=1714076763530&_gaz=1&gcs=G111&gcd=13r3r3r3r5&npa=0&dma=0&gdid=dMzk4MW&cid=512838165.1714076768&ecid=447344511&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&ec_mode=a&_eu=EA&_s=1&sid=1714076774&sct=1&seg=0&dl=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&dt=How%20to%20Use%20WondershareFree%20YouTube%20Downloader&en=page_view&_fv=2&_ss=1&ep.page=www.wondershare.com%2Fguide%2Ffree-youtube-downloader.html&ep.sourceSite=www.wondershare.com&ep.domain=wondershare.com&ep.page_path_level_2=guide&ep.page_path_level_3=free-youtube-downloader.html&ep.gtm_id=GTM-57FR6ZG&ep.gtm_version=438&ep.page_language=English&tfd=13417 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.wondershare.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.wondershare.com/guide/free-youtube-downloader.html?act=install Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:15 UTC	453	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.wondershare.com Date: Thu, 25 Apr 2024 20:26:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49971	87.230.98.78	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 20:26:15 UTC	576	OUT	GET /delivery/info/?id=86321&did=1&cfdid=1&t=pv.cn.d_reg0.oonv.d_dnsx&h=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall&o=1714076772825&l=EN&lv=92582&d=1&ct=14&e=&e2=&e3=&i=&sv=57&dv=105& HTTP/1.1 Host: b.delivery.consentmanager.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-25 20:26:16 UTC	380	IN	HTTP/1.1 200 OK date: Thu, 25 Apr 2024 20:26:16 GMT cache-control: no-store, no-cache, must-revalidate edge-control: no-store, no-cache, must-revalidate expires: Thu, 01 Dec 1994 16:00:00 GMT pragma: no-cache access-control-allow-origin: * x-xss-protection: 0 last-modified: Thu, 25 Apr 2024 20:26:16 GMT content-length: 43 content-type: image/gif connection: close
2024-04-25 20:26:16 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 04 02 04 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Target ID:	0
Start time:	22:23:48
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\free-youtube-downloader_setup_full384.exe"
Imagebase:	0xb00000
File size:	754'320 bytes
MD5 hash:	E7D83F875043ECE6F2FDB16EC9485EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:23:49
Start date:	25/04/2024
Path:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Documents\Wondershare\NFWCHK.exe
Imagebase:	0x870000
File size:	15'136 bytes
MD5 hash:	10A678F6B41D513E27FAC510F4368A32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:23:49
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:24:47
Start date:	25/04/2024
Path:	C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\"
Imagebase:	0x400000
File size:	39'787'352 bytes
MD5 hash:	E1F9B186653025CDA1496212A7F57114
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-11UPV.tmp\free-youtube-downloader_full384.tmp" /SL5="$1401F6,39165086,132096,C:\Users\Public\Documents\Wondershare\free-youtube-downloader_full384.exe" /VERYSILENT /LANG=ENG /NOPAGE /installpath: "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\"
Imagebase:	0x7b0000
File size:	1'193'224 bytes
MD5 hash:	6534DC07A839274161DB6F77BF18B631
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM ScreenCapture.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM RegFloatButton.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM PluginInstallForExe.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM BrowserPlugInHelper.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM URLReqService.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM WsConverter.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM WsMediaInfo.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM DriverInstall.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM PluginInstaller.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:24:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM CreateLib.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM FreeYouTubeDownloaderUpdateHelper.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM kv_dr.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /F /IM sniffer.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\TASKKILL.exe" /F /IM FreeYouTubeDownloader.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:24:49
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:24:50
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\TASKKILL.exe" /F /IM iexplore.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	22:24:50
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\TASKKILL.exe" /F /IM URLReqService.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\TASKKILL.exe" /F /IM DelayPluginI.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\TASKKILL.exe" /F /IM pluginInstall.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\TASKKILL.exe" /F /IM BrowserPlugInHelper.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\TASKKILL.exe" /F /IM PluginInstallForExe.exe
Imagebase:	0xd20000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	22:24:51
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	22:25:11
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe" /VERYSILENT
Imagebase:	0x400000
File size:	2'363'968 bytes
MD5 hash:	44E68F722BBF4530E230B930655DCBD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	22:25:11
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-FG7JB.tmp\Wondershare Helper Compact.tmp" /SL5="$204C4,2101139,54272,C:\Program Files (x86)\Wondershare\Free YouTube Downloader\Wondershare Helper Compact.exe" /VERYSILENT
Imagebase:	0x400000
File size:	712'704 bytes
MD5 hash:	8AA8C628F7B7B7F3E96EFF00557BD0BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000033.00000003.2560443028.0000000002920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	22:25:19
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" /regserver
Imagebase:	0x400000
File size:	2'133'216 bytes
MD5 hash:	DB67E9196605D61D8278E5278777C71F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000035.00000000.2547642375.0000000000401000.00000020.00000001.01000000.0000001A.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	22:25:21
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wondershare\Free YouTube Downloader\CreateLib.exe" -add "Free YouTube Downloader" -folders "" -icon "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe"
Imagebase:	0x750000
File size:	23'792 bytes
MD5 hash:	8275F3D5425BDEF42556720384B1F98F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	22:25:21
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	22:25:23
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wondershare\Free YouTube Downloader\DownloadRes\URLReqService.exe" /regserver
Imagebase:	0xdc0000
File size:	495'856 bytes
MD5 hash:	A38CD36F5280A0F2693AA53F71656635
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	22:25:23
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe"
Imagebase:	0x400000
File size:	172'784 bytes
MD5 hash:	47399B65BC25F6E74E32ED5C658B2B08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000039.00000000.2589975690.0000000000401000.00000020.00000001.01000000.00000023.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	22:25:26
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wondershare\Free YouTube Downloader\PluginInstaller.exe" -i
Imagebase:	0x520000
File size:	34'544 bytes
MD5 hash:	E0580B7F660E5A4D0B8191A9CC2475AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	22:25:26
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	22:25:26
Start date:	25/04/2024
Path:	C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Wondershare\Free YouTube Downloader\BrowserPlugin\KVYDUrlProtocol.exe" "register" "Allmytube" "C:\Program Files (x86)\Wondershare\Free YouTube Downloader\FreeYouTubeDownloader.exe"
Imagebase:	0x400000
File size:	172'784 bytes
MD5 hash:	47399B65BC25F6E74E32ED5C658B2B08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	22:26:00
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fwww.wondershare.com%2Fguide%2Ffree-youtube-downloader.html%3Fact%3Dinstall
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	22:26:01
Start date:	25/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1832,i,1599047514705652765,13031441271017139671,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD9B8E000A Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1957919821.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8e0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3202d50580bfd4ee68403f817fa9084b7ea247feb7cfb5f00352a2c06153af58
Instruction ID: e865eb98b597ca8a82dcdf0b6a08266b2b62239531e720e1f37bf8884aa721a1
Opcode Fuzzy Hash: 3202d50580bfd4ee68403f817fa9084b7ea247feb7cfb5f00352a2c06153af58
Instruction Fuzzy Hash: AE510152A0E7CA1FD7579B7448765A03FB0AF57244B4A04EBD4A9CF1E3DA1C2E09C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E01FD Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1957919821.00007FFD9B8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8e0000_NFWCHK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bcdc16c821eefb09404361a422287c07f5b469e14d40d5134cc91d90fa4f2e
Instruction ID: 69e54c1c53c8d846720766159a49d31f0566a3d0286816b164e24d660a77f1f2
Opcode Fuzzy Hash: d8bcdc16c821eefb09404361a422287c07f5b469e14d40d5134cc91d90fa4f2e
Instruction Fuzzy Hash: D411B651B1D78A5FE74BAB3884725683BE1EF4A648B5104FAD019CB1E3CE182D089752

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Wondershare Helper Compact.exePID: 7972, Parent PID: 8104COMMON

Execution Graph

Execution Coverage:	23%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1500
Total number of Limit Nodes:	29

Executed Functions

Function 00409B08 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B1A
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B25
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409B66
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409B98
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409BA8

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 7af558caf9214b1ffc905ac10295ae15313c48f976b13830cabd187caed91fec
Instruction ID: 77b25fd1770a56ea432c22402e8e705fce68956b85bc5b66870c9d0fe5d52f3a
Opcode Fuzzy Hash: 7af558caf9214b1ffc905ac10295ae15313c48f976b13830cabd187caed91fec
Instruction Fuzzy Hash: 49219FB12003046BDA30EA599C85E57B7F8AB85370F04492AFA85E32C3D379FD44C669

Uniqueness

Uniqueness Score: -1.00%

Function 004051D4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,0040529F,?,00000000,0040537E), ref: 004051F2

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: be7cc8d34f467cf627e4f0a13923a1311ff0080240f5bfd55c0e160e575e3a07
Instruction ID: 69d9b64736de4715eeb7cbb6d303e2114b5c7679e66e461fa217f8d609c82f9f
Opcode Fuzzy Hash: be7cc8d34f467cf627e4f0a13923a1311ff0080240f5bfd55c0e160e575e3a07
Instruction Fuzzy Hash: B5E0D87170021827D710A9A99C86EFB725CDB9C310F0002BFB914E73C2EDB49E804AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040A0CC

Part of subcall function 00409620: GetLastError.KERNEL32(00000000,004096C3,?,0040B240,?,020D2880), ref: 00409644

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A109
SetWindowLongA.USER32(000204C4,000000FC,004098F0), ref: 0040A120

Part of subcall function 00406B54: GetCommandLineA.KERNEL32(00000000,00406B98,?,?,?,?,00000000,?,0040A191,?), ref: 00406B6C

Part of subcall function 0040997C: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68,00000000,00409A4F), ref: 004099EC
Part of subcall function 0040997C: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68,00000000), ref: 00409A00
Part of subcall function 0040997C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A19
Part of subcall function 0040997C: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A2B
Part of subcall function 0040997C: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68), ref: 00409A34

RemoveDirectoryA.KERNEL32(00000000,0040A25F,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A20C
73A25CF0.USER32(000204C4,0040A25F,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A220

Strings

InnoSetupLdrWindow, xrefs: 0040A0FD
/SL5="$%x,%d,%d,, xrefs: 0040A160
STATIC, xrefs: 0040A102

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcessWindow$CodeCommandDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3438005906-3001827809
Opcode ID: 82ea3f65868a7fc35517ffd3b00d0faccc64800910088765ef421502eb7a75b0
Instruction ID: f53e61771edf38aee078511e926c03575119a135ecdc43b76d793b756d8fb091
Opcode Fuzzy Hash: 82ea3f65868a7fc35517ffd3b00d0faccc64800910088765ef421502eb7a75b0
Instruction Fuzzy Hash: D341F870A00205DFD710EBA9EE86B997BA5EB84304F10427BF510B73E2DB789845DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040907C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409115,?,?,?,?,00000000,?,00409C4C), ref: 0040909C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090A2
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409115,?,?,?,?,00000000,?,00409C4C), ref: 004090B6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090BC

Strings

Wow64DisableWow64FsRedirection, xrefs: 00409092
kernel32.dll, xrefs: 00409097, 004090B1
shell32.dll, xrefs: 004090E8
Wow64RevertWow64FsRedirection, xrefs: 004090AC

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 94075723c8fc2a482caac1cde2f730534f58b05307c5555a8722b7be9fa8d048
Instruction ID: 88bc304fd83d4713772702a109e3d5ffa4488b1fbb23ea048bed5bab67655cff
Opcode Fuzzy Hash: 94075723c8fc2a482caac1cde2f730534f58b05307c5555a8722b7be9fa8d048
Instruction Fuzzy Hash: EF017C70208342EEFB10BB62DC4BB163AA8D785718F60447BB508BA2D3DA7C5C04CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0AD Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A109
SetWindowLongA.USER32(000204C4,000000FC,004098F0), ref: 0040A120

Part of subcall function 00406B54: GetCommandLineA.KERNEL32(00000000,00406B98,?,?,?,?,00000000,?,0040A191,?), ref: 00406B6C

Part of subcall function 0040997C: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68,00000000,00409A4F), ref: 004099EC
Part of subcall function 0040997C: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68,00000000), ref: 00409A00
Part of subcall function 0040997C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A19
Part of subcall function 0040997C: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A2B
Part of subcall function 0040997C: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68), ref: 00409A34

RemoveDirectoryA.KERNEL32(00000000,0040A25F,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A20C
73A25CF0.USER32(000204C4,0040A25F,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A220

Strings

InnoSetupLdrWindow, xrefs: 0040A0FD
/SL5="$%x,%d,%d,, xrefs: 0040A160
STATIC, xrefs: 0040A102

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 978128352-3001827809
Opcode ID: 4ab88d8c6353bbfd7b98d0f688a4316c6cf5062df9c9579f3b13b1076451e611
Instruction ID: 8ec41598f4426bcb2878005aaf66d82a47ad9f31ec8bfd5f50b1c2167765569b
Opcode Fuzzy Hash: 4ab88d8c6353bbfd7b98d0f688a4316c6cf5062df9c9579f3b13b1076451e611
Instruction Fuzzy Hash: 3F410670600204DFD710EBA9EE85B9A7BA5EB88304F10827BF510B73E1DB789845CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040997C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68,00000000,00409A4F), ref: 004099EC
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68,00000000), ref: 00409A00
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A19
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A2B
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A74,020D2880,00409A68), ref: 00409A34

Part of subcall function 00409620: GetLastError.KERNEL32(00000000,004096C3,?,0040B240,?,020D2880), ref: 00409644

Strings

D, xrefs: 004099C6

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 236e1cbb77f6dd5ccff7f36973946bafd6119ff77f15eec21927737d1565786b
Instruction ID: 6eb948507c4ec5679b074c1bd2c95f4bb48359ca2bbaaf6d619a7146313ed34b
Opcode Fuzzy Hash: 236e1cbb77f6dd5ccff7f36973946bafd6119ff77f15eec21927737d1565786b
Instruction Fuzzy Hash: 691142B1A002486EDB10EBE68C52F9EB7ACEF48714F50113BB604F72C6DA785D048A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Error, xrefs: 00403D91
Runtime error at 00000000, xrefs: 00403D96, 00403DA9

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00409308 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,004093F7,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040934E
GetLastError.KERNEL32(00000000,00000000,?,00000000,004093F7,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409357

Strings

.tmp, xrefs: 00409337

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 6b2e7232e07e9fc2c26c6f96631df12cd00f241c8ec2fd1505b5088953cd09fc
Instruction ID: 2d5729db6454da3e1ba77009eea48eca063b4dc7eb7983fd21563a30db86577b
Opcode Fuzzy Hash: 6b2e7232e07e9fc2c26c6f96631df12cd00f241c8ec2fd1505b5088953cd09fc
Instruction Fuzzy Hash: 03216774A002099BDB00FFA1C9529DFB7B8EF88304F10457BE901B73C2DA7C9E059AA5

Uniqueness

Uniqueness Score: -1.00%

Function 004094B0 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A1F8,000000FA,00000032,0040A25F), ref: 004094CF
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A1F8,000000FA,00000032,0040A25F), ref: 004094DF
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A1F8,000000FA,00000032,0040A25F), ref: 004094F2
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A1F8,000000FA,00000032,0040A25F), ref: 004094FC

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: f4429a3050b32010c80a8013038ca14275e5e5820772cdc126414ab3e7bd32e2
Instruction ID: e27fa5b601cfdba55910e94f28c51cb2e9f1bd57835f1bb38e531f5656028c14
Opcode Fuzzy Hash: f4429a3050b32010c80a8013038ca14275e5e5820772cdc126414ab3e7bd32e2
Instruction Fuzzy Hash: 39F0967760421477CB35A9AF9D85A6F734DDAD1358710413BE904F7283D438CD4242A9

Uniqueness

Uniqueness Score: -1.00%

Function 00409E1F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409E83

Strings

.tmp, xrefs: 00409EC9

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Message
String ID: .tmp
API String ID: 2030045667-2986845003
Opcode ID: 57a9efdba9b43464d57cdc6827c101bef64e26d0652db7f1e53f771b22dc316b
Instruction ID: 970b058b2921c9d07775ffc554eea41c98c3cd3b09bb8e74c3f7a47f57a22b4b
Opcode Fuzzy Hash: 57a9efdba9b43464d57cdc6827c101bef64e26d0652db7f1e53f771b22dc316b
Instruction Fuzzy Hash: 23419F30604201DFC715EF29DE92A5A7BA6FB49304B10453AF800B73E2CB79AC41DAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409E3A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409E83

Strings

.tmp, xrefs: 00409EC9

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Message
String ID: .tmp
API String ID: 2030045667-2986845003
Opcode ID: 2eb67a5b9d741b707a7904614084c565494b3536ed3c117917ce0de2f63c934a
Instruction ID: b12dedc7aec541d20a2050c4a09f31dfcbc24605b4d9b3369922fb205b4dfd05
Opcode Fuzzy Hash: 2eb67a5b9d741b707a7904614084c565494b3536ed3c117917ce0de2f63c934a
Instruction Fuzzy Hash: 2E416D30600201DFC715EF29DED2A5A7BA6FB49704B10453AF801B73E2CA79AC41DBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00408F94 Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(00000000,00000000,00408FF1,?,0000000D,00000000), ref: 00408FCB
GetLastError.KERNEL32(00000000,00000000,00408FF1,?,0000000D,00000000), ref: 00408FD3

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 486d5fe44f70020a4dd07c112c1ecb1f1a02d0fe2caacd69a5ab5c79924fdc84
Instruction ID: b1aac6b2d26ab0892cc0f9e4d92da460b71e8916038044c8d167ee50180c64ed
Opcode Fuzzy Hash: 486d5fe44f70020a4dd07c112c1ecb1f1a02d0fe2caacd69a5ab5c79924fdc84
Instruction Fuzzy Hash: 5EF0C271A04609ABCB01DFB59D4149EB3E8EB8835475149BBF814F33C2EE3D5E00959C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A25A Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryA.KERNEL32(00000000,0040A25F,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A20C
73A25CF0.USER32(000204C4,0040A25F,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A220

Part of subcall function 004094B0: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A1F8,000000FA,00000032,0040A25F), ref: 004094CF
Part of subcall function 004094B0: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A1F8,000000FA,00000032,0040A25F), ref: 004094F2
Part of subcall function 004094B0: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A1F8,000000FA,00000032,0040A25F), ref: 004094FC

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast$DirectoryRemoveSleep
String ID:
API String ID: 936953547-0
Opcode ID: f4ad5c726656b522891260f221d2d144982ddaf612aaa34d31a554fac5f9b1f8
Instruction ID: 9623e569a849d4e308069b9b649f3c7b83443d72ecb83dbbfa9b32499e00005d
Opcode Fuzzy Hash: f4ad5c726656b522891260f221d2d144982ddaf612aaa34d31a554fac5f9b1f8
Instruction Fuzzy Hash: 07F0EC70650241DBD725EB69EEC9B1537A6AB84309F10863FA110BB3F1CB7D9881DB4E

Uniqueness

Uniqueness Score: -1.00%

Function 00406F78 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406F82
LoadLibraryA.KERNEL32(00000000,00000000,00406FCC,?,00000000,00406FEA,?,00008000), ref: 00406FB1

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9bb444f821fc15403207f038a36a1fd1391ece75305d117941faeb9d6251d2ec
Instruction ID: c6221f459327d28178afdea4356dfb93fe24e72ffe2b5c3e7aea950e8dfec0bf
Opcode Fuzzy Hash: 9bb444f821fc15403207f038a36a1fd1391ece75305d117941faeb9d6251d2ec
Instruction Fuzzy Hash: 7AF0E270614704BFCB029FB28C6282BBBACE74DB0435348B6F900A26C2E63C48208528

Uniqueness

Uniqueness Score: -1.00%

Function 00407644 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00407663
GetLastError.KERNEL32(?,?,?,00000000), ref: 0040766B

Part of subcall function 00407464: GetLastError.KERNEL32(00407364,00407502,?,?,020D03AC,?,00409CA6,00000001,00000000,00000002,00000000,0040A29D,?,00000000,0040A2D4), ref: 00407467

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 2362fb57c069a59edc6b07115e076c9201da44b81893de96415453d21e10638e
Instruction ID: 8a8614724b44ad3f1e1b06f94ae6b85d41b661bfaae6cadd9acd70ad5f9ea5ce
Opcode Fuzzy Hash: 2362fb57c069a59edc6b07115e076c9201da44b81893de96415453d21e10638e
Instruction Fuzzy Hash: 97E092B66086006BD600D66DC881F9B37DCDFC53A4F044536B658EB2D2D675AC00C766

Uniqueness

Uniqueness Score: -1.00%

Function 00407604 Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040761B
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 0040762A

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 970ca03e414f5fabc88d15e585bd5f2e7efa6c5b9f6a2932836872060c4b8460
Instruction ID: f966e59564675df6868c8d067e4a22cf49cc9de2649a5773e26732f77c666011
Opcode Fuzzy Hash: 970ca03e414f5fabc88d15e585bd5f2e7efa6c5b9f6a2932836872060c4b8460
Instruction Fuzzy Hash: D6E092A16081506ADB20D65E9DC4F676BDCCBC5324F0444BBF548DB282C678DC05C7B7

Uniqueness

Uniqueness Score: -1.00%

Function 0040759C Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075B3
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075BF

Part of subcall function 00407464: GetLastError.KERNEL32(00407364,00407502,?,?,020D03AC,?,00409CA6,00000001,00000000,00000002,00000000,0040A29D,?,00000000,0040A2D4), ref: 00407467

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 303708fb520390c6cfb9d66ea44111f78cc0aab6dfaabb1055785f2f195422a2
Instruction ID: 14d735e5778efeb65a9a9c8f659c0be67b135111fa97660ec34a7a50301ecc70
Opcode Fuzzy Hash: 303708fb520390c6cfb9d66ea44111f78cc0aab6dfaabb1055785f2f195422a2
Instruction Fuzzy Hash: BBE04FB2600210AFDB10EEB98881B9276D99F44364F0485B6E614DF2C6D274DC008766

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405248 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040537E), ref: 00405267

Part of subcall function 00404CA4: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CC1

Part of subcall function 004051D4: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,0040529F,?,00000000,0040537E), ref: 004051F2

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: bd08203dfd1e2cdc566f3cc36cb051c66b6c2af4478d84cde9e996adfea6d84e
Instruction ID: ef0034ac11dd00fa4fa4dd94400052267809670aea2942909165ae0b11bbb078
Opcode Fuzzy Hash: bd08203dfd1e2cdc566f3cc36cb051c66b6c2af4478d84cde9e996adfea6d84e
Instruction Fuzzy Hash: 78316971E00109ABCF00EB95C8C09EEB379FF84304F1185B7E815BB285E779AA018B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040754E Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407590

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 645ed33e658d4287fce7fe865531fecfa66d392abaaba43dd083ce1d414f9237
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: 645ed33e658d4287fce7fe865531fecfa66d392abaaba43dd083ce1d414f9237
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 00407550 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407590

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 99841a43b356e7c3a1e18c67bc8ed173c0be6e5724788e49e9a2555951b2a148
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 99841a43b356e7c3a1e18c67bc8ed173c0be6e5724788e49e9a2555951b2a148
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004069B4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004069FC,?,?,?,?,00000000,?,00406A11,00406D3F,00000000,00406D84,?,?,?), ref: 004069DF

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ba6dbf82dd4c80ab043ad377b2faacfe4bb2f10186a0eb9e11a5006d2e6a37ff
Instruction ID: 50023cacb829c756930c8ef42afa3de09d822a78ec84947b2b11458b6e0430c1
Opcode Fuzzy Hash: ba6dbf82dd4c80ab043ad377b2faacfe4bb2f10186a0eb9e11a5006d2e6a37ff
Instruction Fuzzy Hash: 40E09271304308BFD701FFB2DC52E5ABBECDB8A704BA2447AB501F7A82D6795E109568

Uniqueness

Uniqueness Score: -1.00%

Function 004076A0 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076B7

Part of subcall function 00407464: GetLastError.KERNEL32(00407364,00407502,?,?,020D03AC,?,00409CA6,00000001,00000000,00000002,00000000,0040A29D,?,00000000,0040A2D4), ref: 00407467

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 7f31a413d1896cd5fed01bc8c2157059cd98d3e6cfd99fe15611152cc6dccc47
Instruction ID: c943d9696eca60b6ecc810771e4453eebef42da74a5a65bbeabf8eb76ebd2830
Opcode Fuzzy Hash: 7f31a413d1896cd5fed01bc8c2157059cd98d3e6cfd99fe15611152cc6dccc47
Instruction Fuzzy Hash: 3CE092727181106BDB10E65ED880E6B6BDCCFC5324F00447BB904EB291C574AC008776

Uniqueness

Uniqueness Score: -1.00%

Function 0040725C Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004090FF,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0040727B

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: c112a03637410c92fe36c401061c47e0c7c748e750cf07d78af355dd169ef217
Instruction ID: 091b45cfadf5df2f8fe10cfe00dc09419b5d053a53548cda031b8ca89236cc59
Opcode Fuzzy Hash: c112a03637410c92fe36c401061c47e0c7c748e750cf07d78af355dd169ef217
Instruction Fuzzy Hash: 35E09AA0B8830126F26518945C87B7A124AA380B04F24407E7A40AD2C2CABEAA0A429B

Uniqueness

Uniqueness Score: -1.00%

Function 00407684 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,020E7FF4,0040A064,00000000), ref: 0040768B

Part of subcall function 00407464: GetLastError.KERNEL32(00407364,00407502,?,?,020D03AC,?,00409CA6,00000001,00000000,00000002,00000000,0040A29D,?,00000000,0040A2D4), ref: 00407467

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: a18361aca8c8cd19854c497da1c5df8c22eb068a4ed76aaa05032ecb41bf3def
Instruction ID: 0100484668eb2ec673971f2c2002f2d1f8e9036c79683c125d960c49dcf0e200
Opcode Fuzzy Hash: a18361aca8c8cd19854c497da1c5df8c22eb068a4ed76aaa05032ecb41bf3def
Instruction Fuzzy Hash: F8C04CA160460047CF40AABE96C5A0667DC5A4831830485B6B509DB287D679E8004616

Uniqueness

Uniqueness Score: -1.00%

Function 00406FD3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406FF1), ref: 00406FE4

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c51111e1e25d99d17199c414182c944520f619d1a36a2f89f90ff994ae3c25f4
Instruction ID: abcfd38a1ab0ef0a252bae7b45195bf0e82d725524646c77674a47b54488078b
Opcode Fuzzy Hash: c51111e1e25d99d17199c414182c944520f619d1a36a2f89f90ff994ae3c25f4
Instruction Fuzzy Hash: 7AB09B7661C2415DE715D7D5745153863D4D7C47103A1457BF504D25C0D93C94144518

Uniqueness

Uniqueness Score: -1.00%

Function 00406FEF Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406FF1), ref: 00406FE4

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9ff9caf4870ff00b0a4af28e5f3a84e7cd7d27b11fceb0bd6f572c2a938499ea
Instruction ID: 1ca7c60e997b8a15276a6c32a34fb71a107bb08a88b74019f3f5bffcc9320a10
Opcode Fuzzy Hash: 9ff9caf4870ff00b0a4af28e5f3a84e7cd7d27b11fceb0bd6f572c2a938499ea
Instruction Fuzzy Hash: D6A022A8C00002B2CE00E2E08080E3C23282A883003C00AA2320EB2080C83CC020020A

Uniqueness

Uniqueness Score: -1.00%

Function 00406948 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00406944,?,00406621,?,?,00406D5F,00000000,00406D84,?,?,?,?,00000000,00000000), ref: 0040694A

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 7e177b4939afc4c66bc13d9e004dc105461eb321a55963552d83522ad7025e46
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 7e177b4939afc4c66bc13d9e004dc105461eb321a55963552d83522ad7025e46
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00407EE8 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407F78

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f5ee04043d141bc93b2e19712bdcaa3e638a4e758214685487fe43678a6b7974
Instruction ID: 27211e820de311bc0538d5cae21252111a70d63bd272b26bebf0cdf4235cabc1
Opcode Fuzzy Hash: f5ee04043d141bc93b2e19712bdcaa3e638a4e758214685487fe43678a6b7974
Instruction Fuzzy Hash: 97117F71A042059BDB00FF59C881B5B3794EF84359F05847AFD59AB2C6DA38EC448BAB

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 00407520 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407530

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a2389ee9af51d513acc6a320286ed4051c53adf15b73d93af9aca7eb2ec49a3e
Instruction ID: 5a159c3d01a9820a18767da314715944201262ed19b4247e75628cbb53a0a2b5
Opcode Fuzzy Hash: a2389ee9af51d513acc6a320286ed4051c53adf15b73d93af9aca7eb2ec49a3e
Instruction Fuzzy Hash: 7DD05E82B00A6017D215E6BF5D8968792D85F88649B08943BF644E77D1D67CEC018389

Uniqueness

Uniqueness Score: -1.00%

Function 00407E90 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E75), ref: 00407EA7

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: de36b70e41bd06f87498fd740324f0b0b6f6b894c85e6a566519709c031c7ca8
Instruction ID: ca962a925045da2dfad8f37957b07a4422411a8b4a2e8e6c1baa8f4d738a0fe6
Opcode Fuzzy Hash: de36b70e41bd06f87498fd740324f0b0b6f6b894c85e6a566519709c031c7ca8
Instruction Fuzzy Hash: 2CD0E9B1B553045BDB90EEB98CC1B073BD87B48610F5044B66D04EB296E674E8009624

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409420 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040942F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409435
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0040944E
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 00409475
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040947A
ExitWindowsEx.USER32(00000002,00000000), ref: 0040948B

Strings

SeShutdownPrivilege, xrefs: 00409447

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: f3cc37a1b4d9e5a2598b2c7913c69b94567c892d5ed28c5b10f7773e08e168bb
Instruction ID: 1fc3554a8dc1f29b0292fabda2083ca89024c973c65bb30774c19f74add59f7f
Opcode Fuzzy Hash: f3cc37a1b4d9e5a2598b2c7913c69b94567c892d5ed28c5b10f7773e08e168bb
Instruction Fuzzy Hash: 9CF012B068830275E620EAB58C07F6B62985BC4B58F50493EBA55FA1C3D7BCD805466F

Uniqueness

Uniqueness Score: -1.00%

Function 00409BC4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409BCE
SizeofResource.KERNEL32(00000000,00000000,?,00409CBE,00000000,0040A255,?,00000001,00000000,00000002,00000000,0040A29D,?,00000000,0040A2D4), ref: 00409BE1
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409CBE,00000000,0040A255,?,00000001,00000000,00000002,00000000,0040A29D,?,00000000), ref: 00409BF3
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409CBE,00000000,0040A255,?,00000001,00000000,00000002,00000000,0040A29D), ref: 00409C04

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 2cdda8eab16d5b4496744ca62c04feacbae1ad7bb305a55acc901784ed733a80
Instruction ID: 1e58386bb316d19176e05016790693ee75a85c5c0d7d9a3d31869649b270ac48
Opcode Fuzzy Hash: 2cdda8eab16d5b4496744ca62c04feacbae1ad7bb305a55acc901784ed733a80
Instruction Fuzzy Hash: 11E05A80B8974225FA6076FA1CDBB7A60485BA575EF00013BB701792D3EDACCC44462E

Uniqueness

Uniqueness Score: -1.00%

Function 00405220 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00405422,?,?,?,00000000,004055D4), ref: 00405233

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2a77f73eaf4decfe1d3c6d9e0d09371ffd2471663f192bd5980b59e05319332a
Instruction ID: c1568b9747b496de9f49d7e0966a014651e68b21b5db7c9347b601c8a39b330c
Opcode Fuzzy Hash: 2a77f73eaf4decfe1d3c6d9e0d09371ffd2471663f192bd5980b59e05319332a
Instruction Fuzzy Hash: 38D05EB630E2502AE210919A2D85EBB5A9CCEC57A4F14447EBA48D7242D2248C069BB6

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Uniqueness

Uniqueness Score: -1.00%

Function 00405CBC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,004065B8,00000000,004065C6,?,?,?,?,?,00409C3D), ref: 00405CCA

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 2ab3f3637bfc435a5a36f1299b851b4585cd8587848ded99d3738cdcc25c881a
Instruction ID: 17575d513037fabffbf9d99d41b13844c3ba0cd5a0a0786c0aabd179b5f610b8
Opcode Fuzzy Hash: 2ab3f3637bfc435a5a36f1299b851b4585cd8587848ded99d3738cdcc25c881a
Instruction Fuzzy Hash: E6C012604047018AE3105B319C02B1A72D4A744310F4405396DA8D13C2E73C84028A6E

Uniqueness

Uniqueness Score: -1.00%

Function 004083E4 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: dd5bcfe43659cf13d339026f7ad3ea52b8e70fb20ee6bb96b4ba17e57606c0dd
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 8532F875E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFC Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407101,?,00000000,004098A8), ref: 00407025
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040702B
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407101,?,00000000,004098A8), ref: 00407079

Strings

.DEFAULT\Control Panel\International, xrefs: 00407050
Control Panel\Desktop\ResourceLocale, xrefs: 00407088
kernel32.dll, xrefs: 00407020
Locale, xrefs: 00407068
GetUserDefaultUILanguage, xrefs: 0040701B

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: e4cdd608a86d815a926e6585fdd4183a948931fd5e92426b53b2d27eb304baec
Instruction ID: 0122c662096f947522fbf27c68d7ba2278f12f4f8055e3519ce207c1ef0c72e4
Opcode Fuzzy Hash: e4cdd608a86d815a926e6585fdd4183a948931fd5e92426b53b2d27eb304baec
Instruction Fuzzy Hash: 64215330E44209ABDB10EBE5CC52B9F77A9EB44304F50457BA510F72C1EB7CAA058B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040538C Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004055D4,?,?,?,?,00000000,00000000,00000000,?,004065B3,00000000,004065C6), ref: 004053A6

Part of subcall function 004051D4: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,0040529F,?,00000000,0040537E), ref: 004051F2

Part of subcall function 00405220: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00405422,?,?,?,00000000,004055D4), ref: 00405233

Strings

AMPM, xrefs: 00405571
m/d/yy, xrefs: 00405475
:mm:ss, xrefs: 004055A2
:mm, xrefs: 00405588
mmmm d, yyyy, xrefs: 00405497

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 47320c1691e2d5830df5a1e9df4f03a140e2f23ae2973b8188fbf3949c00dbe8
Instruction ID: a3045b163c376a24327c8e5b5e6236da3fb850d103bdf6bcd60558380790f3b8
Opcode Fuzzy Hash: 47320c1691e2d5830df5a1e9df4f03a140e2f23ae2973b8188fbf3949c00dbe8
Instruction Fuzzy Hash: 6B513034B00548ABDB04EBA59C91B9F776ADB88304F60947BB505BF3C6CA7DDA058B1C

Uniqueness

Uniqueness Score: -1.00%

Function 0040457C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00409C38), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5

Strings

SetSearchPathMode, xrefs: 0040459F
kernel32.dll, xrefs: 0040457D
SetDllDirectoryW, xrefs: 00404589

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDllDirectoryW$SetSearchPathMode$kernel32.dll
API String ID: 667068680-4185904062
Opcode ID: 20fd7be1ddc5b2b7e69c087b54f40fcb0d9e6e77690675e6c8211a15a2c91a2e
Instruction ID: 14447e1b91707bce7465e548d4c01d4f3efad5e13c9f9f0bfe0ce832c1803e18
Opcode Fuzzy Hash: 20fd7be1ddc5b2b7e69c087b54f40fcb0d9e6e77690675e6c8211a15a2c91a2e
Instruction Fuzzy Hash: 87D0C2D13903157BEA5532F21D83B2A208C4AC4B4972514377F15B51C3EDBD9A10496E

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: f753f32a0b9fdaf77e4d1ff69d55e7ba9e6a50d72f0fd6d7043043658b36e69e
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: f753f32a0b9fdaf77e4d1ff69d55e7ba9e6a50d72f0fd6d7043043658b36e69e
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00402CCC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

RtlUnwind.KERNEL32(?,00402DA8,?,00000000,0000000F,?,?,?,?), ref: 00402DA3

Strings

X[@, xrefs: 00402CEA
l[@, xrefs: 00402D70

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Unwind
String ID: X[@$l[@
API String ID: 3419175465-4074903537
Opcode ID: 1920712a56283e80004dcffa5df4ec479a5e5f95026c54e2668d0ecfa7077412
Instruction ID: 50eb130d5fb4603cf8097dc46a2f616e61d8bf2d7403d17dc3e89407b4d822bd
Opcode Fuzzy Hash: 1920712a56283e80004dcffa5df4ec479a5e5f95026c54e2668d0ecfa7077412
Instruction Fuzzy Hash: B83160742042019FC714DF05CA88A27B7E5FF88714F1585BAE948AB3E1C775EC42DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403018 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

RtlUnwind.KERNEL32(?,0040303C,00000000,00000000), ref: 00403037

Strings

`\@, xrefs: 00403070
l[@, xrefs: 0040304E

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Unwind
String ID: `\@$l[@
API String ID: 3419175465-1953221756
Opcode ID: 2d68c056a1e518bf1b1fbd876ab29b135f4c94a5f8cbe72f46fd212611e06d35
Instruction ID: d211256fe70af1804ec1dc0944e24e8884d8246c6077b2d6fd46780a93fe9351
Opcode Fuzzy Hash: 2d68c056a1e518bf1b1fbd876ab29b135f4c94a5f8cbe72f46fd212611e06d35
Instruction Fuzzy Hash: 6E1182352042029BD724DF18CA89B2777B5AB44744F24C13AA404AB3DAC77CDC81E769

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409C2E), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409C2E), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000032.00000002.2562845085.0000000000401000.00000020.00000001.01000000.00000016.sdmp, Offset: 00400000, based on PE: true

Associated: 00000032.00000002.2562820776.0000000000400000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562869785.000000000040B000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000032.00000002.2562892908.0000000000411000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Wondershare Helper Compact.tmpPID: 7992, Parent PID: 7972COMMON

Execution Graph

Execution Coverage:	17.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	107

Executed Functions

Function 0046F304 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 956COMMON

Download Yara Rule

Strings

Version of existing file: (none), xrefs: 0046F956
Same time stamp. Skipping., xrefs: 0046F9B1
Skipping due to "onlyifdoesntexist" flag., xrefs: 0046F62A
Installing into GAC, xrefs: 00470349
Non-default bitness: 64-bit, xrefs: 0046F50B
Version of existing file: %u.%u.%u.%u, xrefs: 0046F7D8
Non-default bitness: 32-bit, xrefs: 0046F517
, xrefs: 0046F82B, 0046F9FC, 0046FA7A
Dest filename: %s, xrefs: 0046F4F0
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 0046F920
Will register the file (a DLL/OCX) later., xrefs: 00470154
User opted not to overwrite the existing file. Skipping., xrefs: 0046FAA9
Dest file is protected by Windows File Protection., xrefs: 0046F549
Version of our file: (none), xrefs: 0046F758
Existing file is protected by Windows File Protection. Skipping., xrefs: 0046FA48
InUn, xrefs: 0046FDA1
Same version. Skipping., xrefs: 0046F941
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0046FAF2
-- File entry --, xrefs: 0046F357
Version of our file: %u.%u.%u.%u, xrefs: 0046F74C
Installing the file., xrefs: 0046FB65
Time stamp of our file: (failed to read), xrefs: 0046F603
Skipping due to "onlyifdestfileexists" flag., xrefs: 0046FB56
.tmp, xrefs: 0046FC13
Existing file has a later time stamp. Skipping., xrefs: 0046FA2B
Incrementing shared file count (32-bit)., xrefs: 004701DA
Failed to strip read-only attribute., xrefs: 0046FB2F
Will register the file (a type library) later., xrefs: 00470148
@, xrefs: 0046F40C
Existing file is a newer version. Skipping., xrefs: 0046F85E
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 0046F911
Couldn't read time stamp. Skipping., xrefs: 0046F991
Dest file exists., xrefs: 0046F617
Time stamp of existing file: (failed to read), xrefs: 0046F693
Uninstaller requires administrator: %s, xrefs: 0046FDD1
Time stamp of existing file: %s, xrefs: 0046F687
Incrementing shared file count (64-bit)., xrefs: 004701C1
Time stamp of our file: %s, xrefs: 0046F5F7
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 0046F92C
Stripped read-only attribute., xrefs: 0046FB23

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-4021121268
Opcode ID: c49249ff726204e428715d0a461dd97647d9aece47086d48f6b24d4473e3ab8c
Instruction ID: d6e35b5438cfa1292ec32bb890ff301da22716cbfac3a23e2a369b8a13cdcbbe
Opcode Fuzzy Hash: c49249ff726204e428715d0a461dd97647d9aece47086d48f6b24d4473e3ab8c
Instruction Fuzzy Hash: D3928330A0429CDFCB11DFA5D445BDDBBB1AF05304F5480ABE844AB392D7789E49CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0045BF5C Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 0045BF76
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045BF96
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045BFA3
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045BFB0
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045BFBE

Part of subcall function 0045BE64: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045BF03,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045BEDD

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045C1B1,?,?,00000000), ref: 0045C077
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045C1B1,?,?,00000000), ref: 0045C080

Strings

GetNamedSecurityInfoW, xrefs: 0045BF9D
W, xrefs: 0045C08E
advapi32.dll, xrefs: 0045BF91
SetEntriesInAclW, xrefs: 0045BFB8
SetNamedSecurityInfoW, xrefs: 0045BFAA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 5fd7c32ae9c38b6fbf0cd5533e61b4e16f899d5169a0c6f4d54c9881e3902e5f
Instruction ID: fd9bf91de0e054e3a90f1110b6562d13d30b585534f8bc7d41cc9f09cb3f38ce
Opcode Fuzzy Hash: 5fd7c32ae9c38b6fbf0cd5533e61b4e16f899d5169a0c6f4d54c9881e3902e5f
Instruction Fuzzy Hash: 495186B1900704EFDB10DF99C881BEEB7B9EB08715F14806AF915F7282C6789944CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00423BF4 Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c027e6f9e93f62d8c9952cf8bbccefce77cd8dc1e8b516e854391c8b8e208a
Instruction ID: 46fa227836fc2d50815e942e6fe969caa4d2e3f2e188e2df11c4aae96532221a
Opcode Fuzzy Hash: c5c027e6f9e93f62d8c9952cf8bbccefce77cd8dc1e8b516e854391c8b8e208a
Instruction Fuzzy Hash: 8CE19230700124DFD710DF69E989A6EBBB0EF54315F9580AAE4459B392C73CEE92DB09

Uniqueness

Uniqueness Score: -1.00%

Function 00466728 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1653windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00493B60: GetWindowRect.USER32(00000000), ref: 00493B76

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00466AF7

Part of subcall function 0041D698: GetObjectA.GDI32(?,00000018,00466B11), ref: 0041D6C3

Part of subcall function 00466504: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004665A7
Part of subcall function 00466504: ExtractIconA.SHELL32(00400000,00000000,?), ref: 004665CD
Part of subcall function 00466504: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00466624

Part of subcall function 00493DE4: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00493DEE

Part of subcall function 00493AB0: 73A1A570.USER32(00000000,?,?,?), ref: 00493AD2
Part of subcall function 00493AB0: SelectObject.GDI32(?,00000000), ref: 00493AF8
Part of subcall function 00493AB0: 73A1A480.USER32(00000000,?,00493B56,00493B4F,?,00000000,?,?,?), ref: 00493B49

Part of subcall function 00493DD4: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00493DDE

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00467795
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 004677A6
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 004677BE

Part of subcall function 0042A044: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A05A

Strings

STOPIMAGE, xrefs: 00466AEC
, xrefs: 00466BB9
(Default), xrefs: 00467DA9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$A480A570BitmapFileInfoLoadMessageRectSelectSendSystemWindow
String ID: $(Default)$STOPIMAGE
API String ID: 1847958195-770201673
Opcode ID: 2fd9d9d6ea17357b7956dea6dd017955e4d4be405f50d5e60f55d1bf3d32f2f8
Instruction ID: 4560e714cf4c2fa6a19d0b525ac7dbb589a680ec0160af26a7e9c07dde457078
Opcode Fuzzy Hash: 2fd9d9d6ea17357b7956dea6dd017955e4d4be405f50d5e60f55d1bf3d32f2f8
Instruction Fuzzy Hash: 42F2D5786015148FCB00EB69D5D9F9A73F1FF49308F1542B6E5049B36AD738AC4ACB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00473B80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00473CEA,?,?,0049B16C,00000000), ref: 00473BD9
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00473CEA,?,?,0049B16C,00000000), ref: 00473CB6
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00473CEA,?,?,0049B16C,00000000), ref: 00473CC4

Strings

unins, xrefs: 00473C2C
unins???.*, xrefs: 00473BC3

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 6dadffdb6a389de5b21b4ba8dc425d4ddea31e761ef6024f2990d8c796bc4db4
Instruction ID: cbacc5ba4142c5cf1ff9b290486cf2f1d2b25b3d7f8411f1116340df876b7a01
Opcode Fuzzy Hash: 6dadffdb6a389de5b21b4ba8dc425d4ddea31e761ef6024f2990d8c796bc4db4
Instruction Fuzzy Hash: D93152716001089FCB21EF66C881ADEB7B8DF44305F5480B6B848AB3A2DB38DF459B58

Uniqueness

Uniqueness Score: -1.00%

Function 00447B64 Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00447D41), ref: 00447C84
GetProcAddress.KERNEL32(00000000,00000000), ref: 00447D05

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 36346360bf4f8b250e98d45d9346e8cb56e90ff3adbdc7eb605ce40e5b470e63
Instruction ID: 32d370de00f3db9b4751d0777135750d25d471aeb5f44f032bbb0c7da9d63cf3
Opcode Fuzzy Hash: 36346360bf4f8b250e98d45d9346e8cb56e90ff3adbdc7eb605ce40e5b470e63
Instruction Fuzzy Hash: F15166B0E04145AFDB00EF95C481AAEB7F9EF45314F10817AE814BB391DB389E058B59

Uniqueness

Uniqueness Score: -1.00%

Function 00451DC0 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00451E23,?,?,-00000001,00000000), ref: 00451DFD
GetLastError.KERNEL32(00000000,?,00000000,00451E23,?,?,-00000001,00000000), ref: 00451E05

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: a6c7456738630cd73771075d39f8c2391f7562d7aa9429d5def774ea4d0ab84f
Instruction ID: 23c732d90e8bf7fb5554148fdd74b7d8c495ca1fa808cb6329eaea7bb9c4b149
Opcode Fuzzy Hash: a6c7456738630cd73771075d39f8c2391f7562d7aa9429d5def774ea4d0ab84f
Instruction Fuzzy Hash: 6FF07D31A04204ABCB10DF7AAC0299EF7FCDB8573572046BBFC14D3292EA384E048458

Uniqueness

Uniqueness Score: -1.00%

Function 00408548 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049A4C0,00000001,?,00408613,?,00000000,004086F2), ref: 00408566

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1b80cc3fd0b7e72cb7fb5671384292bf6d2c40730a334b313e24bd91b7bc9a38
Instruction ID: 1314cde9ae44d735cc76a3c4c713e691c40fd14dc10f296433f9f6820e98487d
Opcode Fuzzy Hash: 1b80cc3fd0b7e72cb7fb5671384292bf6d2c40730a334b313e24bd91b7bc9a38
Instruction Fuzzy Hash: E4E02271700218A2C311A91A8C869F6B34C9718310F00427FBD08EB3C2EDB89E4046E9

Uniqueness

Uniqueness Score: -1.00%

Function 00423B6C Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424139,?,00000000,00424144), ref: 00423B96

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 14b87a452627f16e960b33ebbefb468ca8b3524091d2b1e585c0be6c597e0429
Instruction ID: 62037174fb3a4e63d39f4d80a9d1e591ad15120c94b51c82d4663250cb3dbf53
Opcode Fuzzy Hash: 14b87a452627f16e960b33ebbefb468ca8b3524091d2b1e585c0be6c597e0429
Instruction Fuzzy Hash: A0F0C579205608AFCB40DF9DC588D4AFBE8FB4C260B158295B988CB321C234FE808F94

Uniqueness

Uniqueness Score: -1.00%

Function 004547B8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 004547CE

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 80bf5ddaf148eaaef6fc889b5fbec2eb268055f7665b9268d68cbe33f7328bb0
Instruction ID: 3c23b56c855bc6d7d86c737aef60ab85cedc27dd6e4fc0ee06301d897b8feba6
Opcode Fuzzy Hash: 80bf5ddaf148eaaef6fc889b5fbec2eb268055f7665b9268d68cbe33f7328bb0
Instruction Fuzzy Hash: 87D01D7570420067D700AA699C82596758D4784315F00453F7CC5DA3C3E6BDD6985656

Uniqueness

Uniqueness Score: -1.00%

Function 0042F178 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F194

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 7a5fa4d7d2329fa01ca55977667307e26d278e108d61fe7d10643c626aa98b45
Instruction ID: f5cb62dd4479e9cc6ef3c843e292de59d81b4739e20d4e06d93fad05e466a6e5
Opcode Fuzzy Hash: 7a5fa4d7d2329fa01ca55977667307e26d278e108d61fe7d10643c626aa98b45
Instruction Fuzzy Hash: 81D09EB125010DABDB00DE99E840C6B33ADAB88710BE08926F559C7245D634ED6197A9

Uniqueness

Uniqueness Score: -1.00%

Function 0046DCF8 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 480
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046DAE4: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,CLG,0049B16C,?,0046DDFB,?,00000000,0046E352,?,_is1), ref: 0046DB07

RegCloseKey.ADVAPI32(?,0046E359,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046E3A4,?,?,0049B16C,00000000), ref: 0046E34C

Strings

InstallDate, xrefs: 0046E1DD
NoRepair, xrefs: 0046E1BE
Inno Setup: Language, xrefs: 0046DF97
Inno Setup: App Path, xrefs: 0046DE1E
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046DD4E
Inno Setup: Selected Tasks, xrefs: 0046DF0F
RegisterPreviousData, xrefs: 0046E302
Inno Setup: User Info: Name, xrefs: 0046DF46
Inno Setup: Selected Components, xrefs: 0046DEC8
Inno Setup: Icon Group, xrefs: 0046DE4D
UninstallString, xrefs: 0046E037
HelpLink, xrefs: 0046E102
DisplayIcon, xrefs: 0046DFFD
MinorVersion, xrefs: 0046E21B
DisplayVersion, xrefs: 0046E08E
Inno Setup: Setup Type, xrefs: 0046DEA9
DisplayName, xrefs: 0046DFE0
HelpTelephone, xrefs: 0046E0E5
URLInfoAbout, xrefs: 0046E0C8
Inno Setup: User Info: Serial, xrefs: 0046DF70
Inno Setup: User Info: Organization, xrefs: 0046DF5B
NoModify, xrefs: 0046E1AA
QuietUninstallString, xrefs: 0046E071
EstimatedSize, xrefs: 0046E2C9
Readme, xrefs: 0046E13C
Inno Setup: Setup Version, xrefs: 0046DDE9
" /SILENT, xrefs: 0046E064
Contact, xrefs: 0046E159
URLUpdateInfo, xrefs: 0046E11F
Inno Setup: Deselected Tasks, xrefs: 0046DF2E
InstallLocation, xrefs: 0046DE3E
Publisher, xrefs: 0046E0AB
ModifyPath, xrefs: 0046E196
Inno Setup: User, xrefs: 0046DE8A
_is1, xrefs: 0046DD54
Inno Setup: No Icons, xrefs: 0046DE6B
Comments, xrefs: 0046E176
Inno Setup: Deselected Components, xrefs: 0046DEE7
5.3.11 (a), xrefs: 0046DDEE
MajorVersion, xrefs: 0046E209

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.3.11 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3132538880-3404088248
Opcode ID: 813bf28da90c4fec8a44b76a2f2fa4df1c95e70b0de882e81b3eac84e36af927
Instruction ID: 1a8995928857b61d5b707f5e71a78f763695e8feb1bd7aed965315b889cd918b
Opcode Fuzzy Hash: 813bf28da90c4fec8a44b76a2f2fa4df1c95e70b0de882e81b3eac84e36af927
Instruction Fuzzy Hash: 78123234E001089FDB04DB96E981ADE73F9EB48304F60857BE8056B395FB79AD41CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00490A54 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,00490F49,?,?,?,?,00000000,00000000,00000000), ref: 00490A94
FindWindowA.USER32(00000000,00000000), ref: 00490AC5

Strings

LOADDLL, xrefs: 00490D57
SLEEP, xrefs: 00490A7E
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00490D03
SENDBROADCASTMESSAGE, xrefs: 00490C61
CHARTOOEMBUFF, xrefs: 00490EEA
FINDWINDOWBYWINDOWNAME, xrefs: 00490ADD
FREEDLL, xrefs: 00490E40
CREATEMUTEX, xrefs: 00490E75
SENDMESSAGE, xrefs: 00490B19
FINDWINDOWBYCLASSNAME, xrefs: 00490AA1
CALLDLLPROC, xrefs: 00490DB9
OEMTOCHARBUFF, xrefs: 00490EA7
POSTMESSAGE, xrefs: 00490B6F
REGISTERWINDOWMESSAGE, xrefs: 00490C27
POSTBROADCASTMESSAGE, xrefs: 00490CAF
SENDNOTIFYMESSAGE, xrefs: 00490BCB

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 8698df031e37ce3076ec1cdd1c0e5f276b60de545f6e0010272a79c88a32a44d
Instruction ID: 94243f457067d3c55b7586398a2c7c315ae52e177f30388f962aed21f228438e
Opcode Fuzzy Hash: 8698df031e37ce3076ec1cdd1c0e5f276b60de545f6e0010272a79c88a32a44d
Instruction Fuzzy Hash: 91C1C560B002116BDB14BF7E9C4251E6A999F88708B22D93FB446DB78ECD7CDD06439E

Uniqueness

Uniqueness Score: -1.00%

Function 0042DF9C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00498788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DFD6
GetVersion.KERNEL32(00000000,0042E180,?,00498788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DFF3
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E180,?,00498788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E00C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E012
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E180,?,00498788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E027
FreeSid.ADVAPI32(00000000,0042E187,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E17A

Strings

CheckTokenMembership, xrefs: 0042E002
advapi32.dll, xrefs: 0042E007

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: ee991278581fb71f4f407b944d638164dc01d1b63bc74503e7fcca8b120cb6b0
Instruction ID: 3b3aaf8f48684ababcaef7448b894cf2b51b75b84e8a6532a92d9fcf74061779
Opcode Fuzzy Hash: ee991278581fb71f4f407b944d638164dc01d1b63bc74503e7fcca8b120cb6b0
Instruction Fuzzy Hash: 8D51C371B44215AEEB10EAEA9C42BBF77ACEB09704F94047BB500F7282C57CD9158B69

Uniqueness

Uniqueness Score: -1.00%

Function 004819B8 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004819C9
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 004819D6
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004819E4
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 004819EC
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004819F8
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00481A19
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00481A2C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00481A32
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00481A49

Strings

GetNativeSystemInfo, xrefs: 004819D0
kernel32.dll, xrefs: 004819C4
GetSystemWow64DirectoryA, xrefs: 00481A13
IsWow64Process, xrefs: 004819E6
RegDeleteKeyExA, xrefs: 00481A22
advapi32.dll, xrefs: 00481A27

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 876f0f96911b2155ec2c637b7095e85613407d3f2e07980d36d1cfcd4d2b8784
Instruction ID: 4b6e60da2e63d5ee5466c30daea27ccdf7ca07a74b6e8e0bcf11b47dc41d32c9
Opcode Fuzzy Hash: 876f0f96911b2155ec2c637b7095e85613407d3f2e07980d36d1cfcd4d2b8784
Instruction Fuzzy Hash: A5118E91207741A5DA29B3B5DD86B7F254C8B01758F080D3BA881A62B3DB7C8887976E

Uniqueness

Uniqueness Score: -1.00%

Function 00472380 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 585
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,00472979,?,?,?,?,00000000,00472AD3,?,?,0049B16C), ref: 00472508
RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,00472979,?,?,?,?,00000000,00472AD3,?,?), ref: 00472511

Part of subcall function 004721D4: GetLastError.KERNEL32(00000000,00000000,00000000,004722A8,?,?,0049B16C,00000000), ref: 00472261

RegDeleteValueA.ADVAPI32(?,00000000,00000000,00472968,?,?,00000000,00472979,?,?,?,?,00000000,00472AD3,?,?), ref: 0047262F

Part of subcall function 0042DCE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DD10

Part of subcall function 004721D4: GetLastError.KERNEL32(00000000,00000000,00000000,004722A8,?,?,0049B16C,00000000), ref: 00472277

Strings

{olddata}, xrefs: 004726C7, 0047275E
olddata, xrefs: 00472732, 00472791
break, xrefs: 0047279F
Cannot access 64-bit registry keys on this version of Windows, xrefs: 0047245E
Failed to parse "qword" value, xrefs: 004728BB

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DeleteErrorLastValue$CloseCreate
String ID: Cannot access 64-bit registry keys on this version of Windows$Failed to parse "qword" value$break$olddata${olddata}
API String ID: 2638610037-3092547568
Opcode ID: f8f812166bd6fd62da5b0cfee2c03e63c76d41e3b10cfc295460139204214ca6
Instruction ID: 27c79641fa4eddf4eb41488c432c0e465e3f7215784bc0563013ca6374d5fae6
Opcode Fuzzy Hash: f8f812166bd6fd62da5b0cfee2c03e63c76d41e3b10cfc295460139204214ca6
Instruction Fuzzy Hash: 97320C74E00248AFDB14DBA9D581BDEBBF4AF08304F448066F914BB3A2DB789D45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00468124 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegCloseKey.ADVAPI32(?,0046833E,?,?,00000001,00000000,00000000,00468359,?,00000000,00000000,?), ref: 00468327

Strings

Inno Setup: App Path, xrefs: 004681E6
Inno Setup: User Info: Serial, xrefs: 00468309
Inno Setup: Selected Tasks, xrefs: 00468293
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468183
Inno Setup: Deselected Components, xrefs: 00468268
%s\%s_is1, xrefs: 004681A1
Inno Setup: Deselected Tasks, xrefs: 004682B5
Inno Setup: Setup Type, xrefs: 00468236
Inno Setup: Icon Group, xrefs: 00468202
Inno Setup: No Icons, xrefs: 0046820F
Inno Setup: Selected Components, xrefs: 00468246
Inno Setup: User Info: Name, xrefs: 004682E3
Inno Setup: User Info: Organization, xrefs: 004682F6

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 0ce3fab056b6725435d177769cd05c2afc43a6d329bbecae6a04e664139654c2
Instruction ID: 780feb3c2bf2a07cedd5398940266cdb5b5b10f1b13eacb4be7f2e028df3ed8d
Opcode Fuzzy Hash: 0ce3fab056b6725435d177769cd05c2afc43a6d329bbecae6a04e664139654c2
Instruction Fuzzy Hash: D651C330A006489BCB14DB65D951BDEB7F4EF48304F9081AEE844A7395EF78AE01CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042385C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3AC: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED8C,?,00423877,00423BF4,0041ED8C), ref: 0041F3CA

GetClassInfoA.USER32(00400000,00423664), ref: 00423887
RegisterClassA.USER32(00498630), ref: 0042389F
GetSystemMetrics.USER32(00000000), ref: 004238C1
GetSystemMetrics.USER32(00000001), ref: 004238D0
SetWindowLongA.USER32(00410638,000000FC,00423674), ref: 0042392C
SendMessageA.USER32(00410638,00000080,00000001,00000000), ref: 0042394D
GetSystemMenu.USER32(00410638,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF4,0041ED8C), ref: 00423958
DeleteMenu.USER32(00000000,0000F030,00000000,00410638,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF4,0041ED8C), ref: 00423967
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410638,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423974
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410638,00000000,00000000,00400000,00000000,00000000,00000000), ref: 0042398A

Strings

d6B, xrefs: 0042387B, 004238FC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: d6B
API String ID: 183575631-2706443047
Opcode ID: cebd7e49bbe263acbd1706edc9487156b4cee1492153435321a92eed5af3c932
Instruction ID: cb7d742b039766248efa62eeae83ada6c81bf6affbfd7cdfcdae993939f2db78
Opcode Fuzzy Hash: cebd7e49bbe263acbd1706edc9487156b4cee1492153435321a92eed5af3c932
Instruction Fuzzy Hash: AF3173B17402106AFB10BF659C86F6B36A8AB15708F10017BFA41EE2D7CABDED44476D

Uniqueness

Uniqueness Score: -1.00%

Function 0047B4A0 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047B5A2

Strings

Failed to get version numbers of _shfoldr.dll, xrefs: 0047B4F8
shell32.dll, xrefs: 0047B54D
SHGetFolderPathA, xrefs: 0047B597
SHFOLDERDLL, xrefs: 0047B4DF
Failed to get address of SHGetFolderPath function, xrefs: 0047B5B3
_isetup\_shfoldr.dll, xrefs: 0047B4D2
shfolder.dll, xrefs: 0047B505, 0047B53E
Failed to load DLL "%s", xrefs: 0047B585

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-1343262939
Opcode ID: 8e0308cfa25b368c63260f1a0e1665ef18aa563d5564f12ab9c14ad511b4f7f7
Instruction ID: 2beef7cb76df1c2f8f4163d0aee4f597e84d188aed78b709f669c7c3d938f928
Opcode Fuzzy Hash: 8e0308cfa25b368c63260f1a0e1665ef18aa563d5564f12ab9c14ad511b4f7f7
Instruction Fuzzy Hash: 8231DF70A00149EBCB00EBA5D981ADEB7B5EB58308F508577E504E7351D7389E05DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0047F9E4 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 170
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000), ref: 0047FB8C
FreeLibrary.KERNEL32(00000000), ref: 0047FBA0
SendNotifyMessageA.USER32(000204C4,00000496,00002710,00000000), ref: 0047FC12

Strings

DeinitializeSetup, xrefs: 0047FA9D
Not restarting Windows because Setup is being run from the debugger., xrefs: 0047FBC1
Deinitializing Setup., xrefs: 0047FA02
Restarting Windows., xrefs: 0047FBED
GetCustomSetupExitCode, xrefs: 0047FA41

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: db39a9060174310fe315937216d4d57df5cef7cce4c9e606139eabe0740bd123
Instruction ID: 9ffe1a3aa36bc1da07962e74fbe0428a8ad47268e51de0cdffd592ca9caa3035
Opcode Fuzzy Hash: db39a9060174310fe315937216d4d57df5cef7cce4c9e606139eabe0740bd123
Instruction Fuzzy Hash: 5451AF30600204DFD721DF69E985B9A77E4FB59714F50807BEC08C73A1DB38A849CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0047B174 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047B2E7,?,?,00000000,0049A628,00000000,00000000,?,00496835,00000000,004969DE,?,00000000), ref: 0047B207
GetLastError.KERNEL32(00000000,00000000,00000000,0047B2E7,?,?,00000000,0049A628,00000000,00000000,?,00496835,00000000,004969DE,?,00000000), ref: 0047B210

Strings

\_setup64.tmp, xrefs: 0047B29F
_isetup, xrefs: 0047B1F2
%nI, xrefs: 0047B21B, 0047B228
REGDLL_EXE, xrefs: 0047B284
Created temporary directory: , xrefs: 0047B1A9
\_RegDLL.tmp, xrefs: 0047B274

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: %nI$Created temporary directory: $REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup
API String ID: 1375471231-710936655
Opcode ID: 3619a39d7fda8914c3d06cdfec5e17a5147e1e8152a4e0ed72c1458c84847c5a
Instruction ID: ded73d098ab4dab0e3cdb8880457fd2625b5a67b96b2fecb6f849cb42c7586f3
Opcode Fuzzy Hash: 3619a39d7fda8914c3d06cdfec5e17a5147e1e8152a4e0ed72c1458c84847c5a
Instruction Fuzzy Hash: 78412974A0020D9BCB01EF95D856ADEB7B9EF48305F50857BE81077392DB38AE05CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042F1B8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042F1E7
GetFocus.USER32 ref: 0042F1EF
RegisterClassA.USER32(004987AC), ref: 0042F210
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F2E4,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F24E
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F294
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F2A5
SetFocus.USER32(00000000,00000000,0042F2C7,?,?,?,00000001,00000000,?,004576A2,00000000,0049A628), ref: 0042F2AC

Strings

TWindowDisabler-Window, xrefs: 0042F247, 0042F28D

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: ffe2ffd30b4a5f750cb555bc04aad1cb884832cfea774a24078151c1f469c623
Instruction ID: f4f81eae499b84a337a61a59bddcd6ba639cb96b2e333524252cf2adc60773cb
Opcode Fuzzy Hash: ffe2ffd30b4a5f750cb555bc04aad1cb884832cfea774a24078151c1f469c623
Instruction Fuzzy Hash: 0021A174780710FAE210EB65DC03F1A76A8EB05B04FA1417BF540AB2D1DABDAD14C6EE

Uniqueness

Uniqueness Score: -1.00%

Function 00452550 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004525E9,?,?,?,?,00000000,?,00496EFD), ref: 00452570
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00452576
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004525E9,?,?,?,?,00000000,?,00496EFD), ref: 0045258A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00452590

Strings

Wow64DisableWow64FsRedirection, xrefs: 00452566
shell32.dll, xrefs: 004525BC
kernel32.dll, xrefs: 0045256B, 00452585
Wow64RevertWow64FsRedirection, xrefs: 00452580

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: e18cd7cb1d092ea3be367e08a53de1b363d9d423846078c0c97ce3a6de157d78
Instruction ID: 5ea4ccb5783b51a00fe515fa9b09f0943108d713fb5d55adfa6b5f385c998aa6
Opcode Fuzzy Hash: e18cd7cb1d092ea3be367e08a53de1b363d9d423846078c0c97ce3a6de157d78
Instruction Fuzzy Hash: 8B01ACB0201704FED702EB729E13B163A58E75671AF604437F80066183E6FC5908DDBE

Uniqueness

Uniqueness Score: -1.00%

Function 00466504 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004665A7
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004665CD

Part of subcall function 00466444: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 004664DC
Part of subcall function 00466444: DestroyCursor.USER32(00000000), ref: 004664F2

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00466624
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00466685
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004666AB

Strings

c:\directory, xrefs: 004665A2
shell32.dll, xrefs: 00466608

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 3376378930-1375355148
Opcode ID: 6b95454be9c61405fb8ccbed1c3933e5c9392edd6600f71802376583cb1798b1
Instruction ID: db26cb531e6b14f407810b20cd0d515ef24d000dd8986a1aa395d033f7d2f398
Opcode Fuzzy Hash: 6b95454be9c61405fb8ccbed1c3933e5c9392edd6600f71802376583cb1798b1
Instruction Fuzzy Hash: 7F516EB0600248AFDB20DF55DD8AFDBB7E8EB48304F5141B7F90897351DA399E81CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00430598 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 004305A0
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 004305AF
GetCurrentThreadId.KERNEL32 ref: 004305C9
GlobalAddAtomA.KERNEL32(00000000), ref: 004305EA

Strings

commdlg_help, xrefs: 0043059B
WndProcPtr%.8X%.8X, xrefs: 004305DB
commdlg_FindReplace, xrefs: 004305AA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 8ee73fdb1fe827424ccf1e94ffddc580aaa2b1737a99f9e00092c58a7ff271e7
Instruction ID: f059336bb748b0bf38c669d149687d19fef2dbcbecef34365b6a0a8e4ef37772
Opcode Fuzzy Hash: 8ee73fdb1fe827424ccf1e94ffddc580aaa2b1737a99f9e00092c58a7ff271e7
Instruction Fuzzy Hash: 1DF082B04483409AE300EF25C8027197BE4AB98308F44463FF498A62E1E73E9510CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 0045422C Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,DFqG,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00454448,00454448,?,00454448,00000000), ref: 004543D6
CloseHandle.KERNEL32(?,?,DFqG,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00454448,00454448,?,00454448), ref: 004543E3

Part of subcall function 00454198: WaitForInputIdle.USER32(?,00000032), ref: 004541C4
Part of subcall function 00454198: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004541E6
Part of subcall function 00454198: GetExitCodeProcess.KERNEL32(?,?), ref: 004541F5
Part of subcall function 00454198: CloseHandle.KERNEL32(?,00454222,0045421B,?,?,?,00000000,?,?,004543F7,?,?,?,DFqG,00000000,00000000), ref: 00454215

Strings

.cmd, xrefs: 004542D7
.bat, xrefs: 004542BC
DFqG, xrefs: 004543AE, 004543B1
cmd.exe" /C ", xrefs: 00454309
COMMAND.COM" /C , xrefs: 00454340

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $DFqG$cmd.exe" /C "
API String ID: 854858120-4004990480
Opcode ID: a79fc61136a56f68c9fa57edad7eb931dbb836afb08e7db108499debf35d9c77
Instruction ID: d1ba8077eb5a089916e8a4371357b0499bb0f263c7e834c27fe6988169414fdd
Opcode Fuzzy Hash: a79fc61136a56f68c9fa57edad7eb931dbb836afb08e7db108499debf35d9c77
Instruction Fuzzy Hash: BD514A34B403499BCB11EF95C841BDDBBB9AF8530DF50443BBC04AB292D77C99498759

Uniqueness

Uniqueness Score: -1.00%

Function 00423674 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 00423704
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCE,00000000,?,?,?,00000001), ref: 00423731
OemToCharA.USER32(?,?), ref: 00423744
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCE,00000000,?,?,?,00000001), ref: 00423784

Strings

MAINICON, xrefs: 004236F9
2, xrefs: 004236D2

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: 88fbd26443f82d8cc7783084aca3caf08c13c16c31fc68fb49b81886230862cb
Instruction ID: 15c2da7a63879c6dda256f6669c188d4e6ef7711e9be9b2e9bc7f6829eb0e824
Opcode Fuzzy Hash: 88fbd26443f82d8cc7783084aca3caf08c13c16c31fc68fb49b81886230862cb
Instruction Fuzzy Hash: 4F31C5B0A042459BDB10EF69D8C57C63BE8AF14308F4441BAE844DB393D7BED988CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0049379C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000), ref: 004937AD

Part of subcall function 0041A1D0: CreateFontIndirectA.GDI32(?), ref: 0041A28F

SelectObject.GDI32(00000000,00000000), ref: 004937CF
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00493D4D), ref: 004937E3
GetTextMetricsA.GDI32(00000000,?), ref: 00493805
73A1A480.USER32(00000000,00000000,0049382F,00493828,?,00000000,?,?,00000000), ref: 00493822

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 004937DA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Text$A480A570CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1435929781-222967699
Opcode ID: 8461727ccacdfea1df1a901815be96565a1c00da7cdafb8fae174f5bde628484
Instruction ID: dd40f6f40881701da2d52a3e9ff9f2cabee02c50412c364729264e1edb3e3874
Opcode Fuzzy Hash: 8461727ccacdfea1df1a901815be96565a1c00da7cdafb8fae174f5bde628484
Instruction Fuzzy Hash: D2018875A04604BFDB00EFE5CC41F5EB7ECDB49704F514476B504E7281D678AE009B68

Uniqueness

Uniqueness Score: -1.00%

Function 00418F20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F25
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F46
GetCurrentThreadId.KERNEL32 ref: 00418F61
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F82

Part of subcall function 004230B0: 73A1A570.USER32(00000000,?,?,00000000,?,00418FBB,00000000,?,?,?,00000001), ref: 00423106
Part of subcall function 004230B0: EnumFontsA.GDI32(00000000,00000000,00423050,00410638,00000000,?,?,00000000,?,00418FBB,00000000,?,?,?,00000001), ref: 00423119
Part of subcall function 004230B0: 73A24620.GDI32(00000000,0000005A,00000000,00000000,00423050,00410638,00000000,?,?,00000000,?,00418FBB,00000000), ref: 00423121
Part of subcall function 004230B0: 73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00423050,00410638,00000000,?,?,00000000,?,00418FBB,00000000), ref: 0042312C

Part of subcall function 00423674: LoadIconA.USER32(00400000,MAINICON), ref: 00423704
Part of subcall function 00423674: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCE,00000000,?,?,?,00000001), ref: 00423731
Part of subcall function 00423674: OemToCharA.USER32(?,?), ref: 00423744
Part of subcall function 00423674: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FCE,00000000,?,?,?,00000001), ref: 00423784

Part of subcall function 0041F100: GetVersion.KERNEL32(?,00418FD8,00000000,?,?,?,00000001), ref: 0041F10E
Part of subcall function 0041F100: SetErrorMode.KERNEL32(00008000,?,00418FD8,00000000,?,?,?,00000001), ref: 0041F12A
Part of subcall function 0041F100: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FD8,00000000,?,?,?,00000001), ref: 0041F136
Part of subcall function 0041F100: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FD8,00000000,?,?,?,00000001), ref: 0041F144
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F174
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F19D
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1B2
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1C7
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1DC
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F1F1
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F206
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F21B
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F230
Part of subcall function 0041F100: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F245

Strings

Delphi%.8X, xrefs: 00418F37
ControlOfs%.8X%.8X, xrefs: 00418F73

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$A24620A480A570EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 3864787166-2767913252
Opcode ID: 826db4222df8d08eafbaf34ba611b876800f42895f0eabbafa8aa2df7a584a82
Instruction ID: f60795be8e24d2359d783261ed98843fb923e895910ebc189cdb843b9ded4107
Opcode Fuzzy Hash: 826db4222df8d08eafbaf34ba611b876800f42895f0eabbafa8aa2df7a584a82
Instruction Fuzzy Hash: 53113D706182409AC700FF66984678A7AE0EBA430CF44853FF848EB3A1DB3D9954CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 0045C3E8 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045C4B4,?,?,?,?,00000000), ref: 0045C453
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045C520,?,00000000,0045C4B4,?,?,?,?,00000000), ref: 0045C492

Strings

MACHINE, xrefs: 0045C436
CLASSES_ROOT, xrefs: 0045C418
USERS, xrefs: 0045C445
CURRENT_USER, xrefs: 0045C427

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 769a95a04c3cab330e4d6e90b3a7104ca163033451f3160f6ddc02e8bbf0b10e
Instruction ID: 7980c35c9e830c342080bd626fcf40887ced656d0f190447a49c1bd9b9b8492d
Opcode Fuzzy Hash: 769a95a04c3cab330e4d6e90b3a7104ca163033451f3160f6ddc02e8bbf0b10e
Instruction Fuzzy Hash: 0911D830204308BFDB11DE95C9E1FBE76ACD789306F6080776D0066283E67C5F0A956A

Uniqueness

Uniqueness Score: -1.00%

Function 00413624 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 0041364C
GetWindowLongA.USER32(?,000000F0), ref: 00413657
GetWindowLongA.USER32(?,000000F4), ref: 00413669
SetWindowLongA.USER32(?,000000F4,?), ref: 0041367C
SetPropA.USER32(?,00000000,00000000), ref: 00413693
SetPropA.USER32(?,00000000,00000000), ref: 004136AA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: e076ad714177ce8322845bf76c5a6a112f9cb2616a25e616592a5f0040cf25c6
Instruction ID: 0779cf8e73b7d0765732b6a5dc8b8604ed1f48a9427957ca6adda61974668b82
Opcode Fuzzy Hash: e076ad714177ce8322845bf76c5a6a112f9cb2616a25e616592a5f0040cf25c6
Instruction Fuzzy Hash: C011CC75500244BFDF00DF9DDC84E9A3BE8AB19364F11466AF918DB2A1D738D9908B94

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049A420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049A420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049A420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 129a086d14f06e85949d9ce6c11842cbaac0837872500e74c5770b3ac3f1f746
Instruction ID: 4ef907ce7de5879ae286245a644ba6b68361dc01c28fd2a698a6758b772d8c96
Opcode Fuzzy Hash: 129a086d14f06e85949d9ce6c11842cbaac0837872500e74c5770b3ac3f1f746
Instruction Fuzzy Hash: C9114270A403405AEB15AB659C89B263BE597A570CF54407BF80067AF2D7BC5860C7EF

Uniqueness

Uniqueness Score: -1.00%

Function 004548F4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00454A8B,?,00000000,00454ACB), ref: 004549D1

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454954
PendingFileRenameOperations2, xrefs: 004549A0
WININIT.INI, xrefs: 00454A00
PendingFileRenameOperations, xrefs: 00454970

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: d314e34af34ca3f1ffc8ed6abeb212b3f260a563e5a3b4e44fe77c79e7713e00
Instruction ID: c8614a43b3fdf1ca99845ba706fb83f427c4a6f3b6def5a4700fbed36f33a6e0
Opcode Fuzzy Hash: d314e34af34ca3f1ffc8ed6abeb212b3f260a563e5a3b4e44fe77c79e7713e00
Instruction Fuzzy Hash: 0D518E70E042089FDB10DF61DC51ADEB7B9EF84309F50857BE804AB692D778AE45CA5C

Uniqueness

Uniqueness Score: -1.00%

Function 00452D84 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00452E73,?,?,00000000,0049A628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452DCA
GetLastError.KERNEL32(00000000,00000000,?,00000000,00452E73,?,?,00000000,0049A628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00452DD3

Strings

\nI, xrefs: 00452E19
%nI, xrefs: 00452E58, 00452E09, 00452E13
.tmp, xrefs: 00452DB3

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: %nI$.tmp$\nI
API String ID: 1375471231-1136394443
Opcode ID: 97bbbf2da9bd34b09db601ecf0f280ac09a7da54906fcadebe0e3a8adddd166c
Instruction ID: 03b0018369c728da033398bc18c7d62568b8f2dcd92537a7a12183c171906ceb
Opcode Fuzzy Hash: 97bbbf2da9bd34b09db601ecf0f280ac09a7da54906fcadebe0e3a8adddd166c
Instruction Fuzzy Hash: 38213575A00208ABDB05EFA1C9529DEB7BDEF49305F50447BEC01B7342DB7CAE058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00423A6C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A04), ref: 00423A90
GetWindow.USER32(?,00000003), ref: 00423AA5
GetWindowLongA.USER32(?,000000EC), ref: 00423AB4
SetWindowPos.USER32(00000000,DAB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,00424193,?,?,00423D5B), ref: 00423AEA

Strings

DAB, xrefs: 00423ADA, 00423ADE

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: DAB
API String ID: 4191631535-4183991030
Opcode ID: b89371ce55fee71a81f56c0fb58a51ef6d14575590898134acdf293b48a15296
Instruction ID: 902e4707086c559fd181394619265fa26bf84509a1fee1099fec8f6fc81e9ab6
Opcode Fuzzy Hash: b89371ce55fee71a81f56c0fb58a51ef6d14575590898134acdf293b48a15296
Instruction Fuzzy Hash: BF115E70700610ABDB10DF28D885F5677E4EB08725F10067AF9949B2E2C3B89D40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DD50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DEEB,00000000,0042DF03,?,?,?,?,00000006,?,00000000,00495AFB), ref: 0042DD6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DD71

Strings

advapi32.dll, xrefs: 0042DD66
RegDeleteKeyExA, xrefs: 0042DD61

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 6ba33c0c3f2a9b2a2f11b0a68c52ddfa7e29286ec7fe51218607e016af5f805d
Instruction ID: 8849bbb900f41b2762779cca63578ff987da71f18731b786730cc0d50ecce640
Opcode Fuzzy Hash: 6ba33c0c3f2a9b2a2f11b0a68c52ddfa7e29286ec7fe51218607e016af5f805d
Instruction Fuzzy Hash: 7DE0EDF0B50A30AAD72022657C8ABA32728CB65326FA8A437F044A9191C2BC0C40CE9C

Uniqueness

Uniqueness Score: -1.00%

Function 004721D4 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045C3E8: SetLastError.KERNEL32(00000057,00000000,0045C4B4,?,?,?,?,00000000), ref: 0045C453

GetLastError.KERNEL32(00000000,00000000,00000000,004722A8,?,?,0049B16C,00000000), ref: 00472261
GetLastError.KERNEL32(00000000,00000000,00000000,004722A8,?,?,0049B16C,00000000), ref: 00472277

Strings

Failed to set permissions on registry key (%d)., xrefs: 00472288
Could not set permissions on the registry key because it currently does not exist., xrefs: 0047226B
Setting permissions on registry key: %s\%s, xrefs: 00472226

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 5ffe4915ef0b184d08f693b1b200ca5568aff1971bc7f6ea53270cd9dcf18fbc
Instruction ID: d47a70203f190fd58beeafa22ec928943bdfb9c892880def146f4847ff09200b
Opcode Fuzzy Hash: 5ffe4915ef0b184d08f693b1b200ca5568aff1971bc7f6ea53270cd9dcf18fbc
Instruction Fuzzy Hash: B421C870A046449FCB10DBAAD9816EEBBF8EF49314F50817BE408E7393D7B89905C769

Uniqueness

Uniqueness Score: -1.00%

Function 00481034 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00481349,?,?,00000001,?), ref: 00481145
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 004811BA

Strings

, xrefs: 00481277
Need to restart Windows? %s, xrefs: 004811F7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: eeab33cf4efbe8ee2a6b11493e7c063f743692da377c950d7602edf68b7f2914
Instruction ID: b7518ae6c24e12b434ec98debcafbd5afd06e75a53ee4342f5f4b68eb4a2c3c1
Opcode Fuzzy Hash: eeab33cf4efbe8ee2a6b11493e7c063f743692da377c950d7602edf68b7f2914
Instruction Fuzzy Hash: E89184306042448FDB10FB69E985B9E77E5EF59308F1484BBE8009B362DB78A905CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0046E738 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C7A8: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C7CC

GetLastError.KERNEL32(00000000,0046E935,?,?,0049B16C,00000000), ref: 0046E812
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046E88C
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046E8B1

Strings

Creating directory: %s, xrefs: 0046E7FA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: f3b819ba8015d82634b191823553c0d946a3d62732a0e05f666b3f8f043fb4a6
Instruction ID: 4ee510699ab3891379a8d4aa2ce95a2023a24a897400e35ef917b5abcdeb6947
Opcode Fuzzy Hash: f3b819ba8015d82634b191823553c0d946a3d62732a0e05f666b3f8f043fb4a6
Instruction Fuzzy Hash: 54513674E00248ABDB11DFA6C586BDEB7F5AF49304F50816AE840B7382D7785E04DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00453FF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 0045409E
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454164), ref: 00454108

Strings

sfc.dll, xrefs: 00454060
SfcIsFileProtected, xrefs: 00454098

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: 80ea0f9c1ef16fc2e305e2824c6c547855aab8fc8e2d96e11feaf7447c016dcb
Instruction ID: 90d309ceba18d338d04f95da4ca9752badc644df74883720a6d250ff35c3934d
Opcode Fuzzy Hash: 80ea0f9c1ef16fc2e305e2824c6c547855aab8fc8e2d96e11feaf7447c016dcb
Instruction Fuzzy Hash: 9941A970A007149FEB20DB55DC85B9E77B8AF54309F5041B7A908A7292E7389F88CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Error, xrefs: 00404DB9
Runtime error at 00000000, xrefs: 00404DBE, 00404DD1

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 65f8ed0532075a2792cd4408a2c9e4abcf3b0691aeac86d53ce49d1bb586f2e2
Instruction ID: 7c754c0b660761a5bc1c63aadfae0e1dd2c0c13e95eab211716155318e46cc07
Opcode Fuzzy Hash: 65f8ed0532075a2792cd4408a2c9e4abcf3b0691aeac86d53ce49d1bb586f2e2
Instruction Fuzzy Hash: E421CB606442514ADB11AB799C857163B9197E534CF04817BE700B73F2CA7D9C64C7EF

Uniqueness

Uniqueness Score: -1.00%

Function 00454C2C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegCloseKey.ADVAPI32(?,00454C97,?,00000001,00000000), ref: 00454C8A

Strings

PendingFileRenameOperations, xrefs: 00454C5C
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454C38
PendingFileRenameOperations2, xrefs: 00454C6B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: de5c5a186c0f72f9ea332df7e2fc4e45ab9f597a021cfdbcf1a60e9d25ac79f4
Instruction ID: b3a4d9f2827480872f5e18d1b9ef055898de5938c65bba9e4ca707b6db82d622
Opcode Fuzzy Hash: de5c5a186c0f72f9ea332df7e2fc4e45ab9f597a021cfdbcf1a60e9d25ac79f4
Instruction Fuzzy Hash: C2F09631705208BFD706DAA6EC12F1A77ACD7C4719FB24467F8008B582DA79FD44951C

Uniqueness

Uniqueness Score: -1.00%

Function 00470D8C Relevance: 6.3, APIs: 4, Instructions: 263fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00470F5D,?,00000000,?,0049B16C,00000000,0047112B,?,00000000,?,00000000,?,004712F9), ref: 00470F39
FindClose.KERNEL32(000000FF,00470F64,00470F5D,?,00000000,?,0049B16C,00000000,0047112B,?,00000000,?,00000000,?,004712F9,?), ref: 00470F57
FindNextFileA.KERNEL32(000000FF,?,00000000,0047107F,?,00000000,?,0049B16C,00000000,0047112B,?,00000000,?,00000000,?,004712F9), ref: 0047105B
FindClose.KERNEL32(000000FF,00471086,0047107F,?,00000000,?,0049B16C,00000000,0047112B,?,00000000,?,00000000,?,004712F9,?), ref: 00471079

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 6abc27be7c20da72d636c3299a1994f56bfb4404fdfe54c1b6ef53c2d864a30c
Instruction ID: 3617a0173937a19299d8dd4a745a69bb76cc4f671c917c72f52ff549fa862770
Opcode Fuzzy Hash: 6abc27be7c20da72d636c3299a1994f56bfb4404fdfe54c1b6ef53c2d864a30c
Instruction Fuzzy Hash: AFB11B3490424D9FCF11DFA9C881ADEBBB9FF4D304F5085AAE808A7261D739AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0047DF14 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047E10D,?,00000000,00000000,?,?,0047F32A,?,?,00000000), ref: 0047DFBA
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047E10D,?,00000000,00000000,?,?,0047F32A,?,?), ref: 0047DFC7
FindNextFileA.KERNEL32(000000FF,?,00000000,0047E0E0,?,?,?,?,00000000,0047E10D,?,00000000,00000000,?,?,0047F32A), ref: 0047E0BC
FindClose.KERNEL32(000000FF,0047E0E7,0047E0E0,?,?,?,?,00000000,0047E10D,?,00000000,00000000,?,?,0047F32A,?), ref: 0047E0DA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: b78d82dbb07a147907b9983e33b5ab6ed3b3aa7ef8a3a02aa5ab8bb391eb59b4
Instruction ID: e56434d36b3415fcee24497c3a19a3776a0bd12063483664dd205c6200899d48
Opcode Fuzzy Hash: b78d82dbb07a147907b9983e33b5ab6ed3b3aa7ef8a3a02aa5ab8bb391eb59b4
Instruction Fuzzy Hash: 15515E70A006589FCB10EF66CC45ADEB7B8EF88314F5085AAA408E7351D6389F49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0042125C Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421349
SetMenu.USER32(00000000,00000000), ref: 00421366
SetMenu.USER32(00000000,00000000), ref: 0042139B
SetMenu.USER32(00000000,00000000), ref: 004213B7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 1d76e81dd35833b205a42ae4c8d8c5c0cc9283ad9c75a6bad2d47680ff6232b5
Instruction ID: da84ef4eea115e10014a82914d39e849cc0aceb07374f445b9d33d4f60a66388
Opcode Fuzzy Hash: 1d76e81dd35833b205a42ae4c8d8c5c0cc9283ad9c75a6bad2d47680ff6232b5
Instruction Fuzzy Hash: 8D41B0307002544BEB20AB3AA88579A36A65F65308F4801BFFC45DF3A7CA7DCC4583AC

Uniqueness

Uniqueness Score: -1.00%

Function 00416B2A Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B6C
SetTextColor.GDI32(?,00000000), ref: 00416B86
SetBkColor.GDI32(?,00000000), ref: 00416BA0
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BC8

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: f20cd3be3cdf58c42dacb56aa931ab3c0945fd2833529498dd667d9a963f36ae
Instruction ID: 4462f2ee7d68fb1bbba42d62c0b2006c3a0d49416eee88ca84ec8b0dcaf29f05
Opcode Fuzzy Hash: f20cd3be3cdf58c42dacb56aa931ab3c0945fd2833529498dd667d9a963f36ae
Instruction Fuzzy Hash: 661121B1204614AFC710EE6ECDC4E9777ECEF49314715882AB59ADB612C63CF8418B29

Uniqueness

Uniqueness Score: -1.00%

Function 00454198 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 004541C4
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004541E6
GetExitCodeProcess.KERNEL32(?,?), ref: 004541F5
CloseHandle.KERNEL32(?,00454222,0045421B,?,?,?,00000000,?,?,004543F7,?,?,?,DFqG,00000000,00000000), ref: 00454215

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: c0d5fa3aae9ee7aa12c16833348d9ed296b9ef03498ebe631b53db86b82891a0
Instruction ID: 060a917c31cca01e8b25c628b59ac47db955e72b40a527d2195dabff2c9b3676
Opcode Fuzzy Hash: c0d5fa3aae9ee7aa12c16833348d9ed296b9ef03498ebe631b53db86b82891a0
Instruction Fuzzy Hash: 5301B9706406187EEB2097A58C06F6B7AACDB85774F510567F904DB2C2D5B85D808668

Uniqueness

Uniqueness Score: -1.00%

Function 004230B0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000,?,00418FBB,00000000,?,?,?,00000001), ref: 00423106
EnumFontsA.GDI32(00000000,00000000,00423050,00410638,00000000,?,?,00000000,?,00418FBB,00000000,?,?,?,00000001), ref: 00423119
73A24620.GDI32(00000000,0000005A,00000000,00000000,00423050,00410638,00000000,?,?,00000000,?,00418FBB,00000000), ref: 00423121
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00423050,00410638,00000000,?,?,00000000,?,00418FBB,00000000), ref: 0042312C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A24620A480A570EnumFonts
String ID:
API String ID: 2630238358-0
Opcode ID: 98e25c02094b5e3f8430ac4857ce61280ad712df715513848160ae8bd7b9be60
Instruction ID: d0be27f232cf473cc1fd57093da599a9f3ea566e55ca634533e7c5a0987df9fd
Opcode Fuzzy Hash: 98e25c02094b5e3f8430ac4857ce61280ad712df715513848160ae8bd7b9be60
Instruction Fuzzy Hash: EC01DE717043006AE710BFAA5C86B9B3BA49F01718F50027BF808AF3C6D6BE9805476E

Uniqueness

Uniqueness Score: -1.00%

Function 0047B374 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047B395
GetLastError.KERNEL32 ref: 0047B39F
GetTickCount.KERNEL32 ref: 0047B3A9
Sleep.KERNEL32(00000032), ref: 0047B3B9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 51442c71ce6d86b8699e4c64246ffd8a3bfa7112cf38e93610a175f610d87a92
Instruction ID: 8bf1b0c6a29e74397e498c90e44f40b2af047c46d630712a340a284ff5036f8c
Opcode Fuzzy Hash: 51442c71ce6d86b8699e4c64246ffd8a3bfa7112cf38e93610a175f610d87a92
Instruction Fuzzy Hash: 2EE02B3130998495CA2235FE18C67BF458CCF86364F14653FF88CDA2C2C51C4C4985AE

Uniqueness

Uniqueness Score: -1.00%

Function 0045B600 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0044FC8C: SetEndOfFile.KERNEL32(?,?,0045B6DE,00000000,0045B869,?,00000000,00000002,00000002), ref: 0044FC93

FlushFileBuffers.KERNEL32(?), ref: 0045B835

Strings

EndOffset range exceeded, xrefs: 0045B769
NumRecs range exceeded, xrefs: 0045B732

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 6e57869437ceace4a01de1b59f26442bbf7ee0bddc9ed8b74090d0b420f789be
Instruction ID: b1d3936b68a7f15f8cbb91b6e5f37db014e452a99e8ace7c5cdc1966dd3dd048
Opcode Fuzzy Hash: 6e57869437ceace4a01de1b59f26442bbf7ee0bddc9ed8b74090d0b420f789be
Instruction Fuzzy Hash: 47615434A002588BDB25DF25C881AD9B7B5EF49305F0084EAED8D9B352DB74AEC9CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00496EA4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00496EB2), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00496EB2), ref: 00403356

Part of subcall function 00406334: GetModuleHandleA.KERNEL32(kernel32.dll,?,00496EBC), ref: 0040633A
Part of subcall function 00406334: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00406347
Part of subcall function 00406334: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 0040635D

Part of subcall function 00409B60: 6F571CD0.COMCTL32(00496EC6), ref: 00409B60

Part of subcall function 0041093C: GetCurrentThreadId.KERNEL32 ref: 0041098A

Part of subcall function 00419028: GetVersion.KERNEL32(00496EDA), ref: 00419028

Part of subcall function 0044ED7C: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00496EEE), ref: 0044EDB7
Part of subcall function 0044ED7C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044EDBD

Part of subcall function 0044F160: GetVersionExA.KERNEL32(0049A788,00496EF3), ref: 0044F16F

Part of subcall function 00452550: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004525E9,?,?,?,?,00000000,?,00496EFD), ref: 00452570
Part of subcall function 00452550: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00452576
Part of subcall function 00452550: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004525E9,?,?,?,?,00000000,?,00496EFD), ref: 0045258A
Part of subcall function 00452550: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00452590

Part of subcall function 00455EF8: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00455F1C

Part of subcall function 00463998: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00496F11), ref: 004639A7
Part of subcall function 00463998: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 004639AD

Part of subcall function 0046BAA4: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046BAB9

Part of subcall function 00477340: GetModuleHandleA.KERNEL32(kernel32.dll,?,00496F1B), ref: 00477346
Part of subcall function 00477340: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00477353
Part of subcall function 00477340: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00477363

Part of subcall function 00493E48: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00493E61

SetErrorMode.KERNEL32(00000001,00000000,00496F63), ref: 00496F35

Part of subcall function 00496C64: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00496F3F,00000001,00000000,00496F63), ref: 00496C6E
Part of subcall function 00496C64: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00496C74

Part of subcall function 004244BC: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244DB

Part of subcall function 004242AC: SetWindowTextA.USER32(?,00000000), ref: 004242C4

ShowWindow.USER32(?,00000005,00000000,00496F63), ref: 00496F96

Part of subcall function 00480744: SetActiveWindow.USER32(?), ref: 004807F2

Strings

Setup, xrefs: 00496F7C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF571FormatLibraryLineLoadMessageModeRegisterSendShowTextThread
String ID: Setup
API String ID: 4109318208-3839654196
Opcode ID: 900fd1c84efe23903bec7581b943f2a9bdc3ba25327b8f7de090c37ff2e419f3
Instruction ID: 6d0fc44b7975fa4b91f5bbb953351e2f3151c2457cc47be2ae498005ac358bba
Opcode Fuzzy Hash: 900fd1c84efe23903bec7581b943f2a9bdc3ba25327b8f7de090c37ff2e419f3
Instruction Fuzzy Hash: 4C31F5712186449ED601BBB7EC1391D3B94EB8971CB52447FF80486593DE3D58118ABE

Uniqueness

Uniqueness Score: -1.00%

Function 00481500 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00481688,?,00000000,004816C9,?,?,00000001,?,00000000,00000000,00000000,?,0046AC04), ref: 00481537
SetActiveWindow.USER32(?,00000000,00481688,?,00000000,004816C9,?,?,00000001,?,00000000,00000000,00000000,?,0046AC04), ref: 00481549

Strings

Will not restart Windows automatically., xrefs: 00481668

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 83c5907e916742bfc1ae213c26b43d8a734814ecd2b04bc678bc14a1fec7c667
Instruction ID: 254dfa7ac69c38db29eebec8b42d51047f3deaee97367967ade6519332545e1e
Opcode Fuzzy Hash: 83c5907e916742bfc1ae213c26b43d8a734814ecd2b04bc678bc14a1fec7c667
Instruction Fuzzy Hash: F141F430604240EFD711EB64E942BAD3BEEE764304F1808B7E84567372E37C98468B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DC78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DCB8

Strings

Inno Setup: No Icons, xrefs: 0042DC76

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: eef023ef8b8ad88b989db02ce622d9f7228f62d4069834f518e35816baea4434
Instruction ID: 115871814a4797d1b76f0c181da6381ec586657a8a684a64479c03ba9ebf50e8
Opcode Fuzzy Hash: eef023ef8b8ad88b989db02ce622d9f7228f62d4069834f518e35816baea4434
Instruction Fuzzy Hash: 69012B71B8537179F73045136D01F7B57889B82B60F65013BF942EA2C0DAD89C04E36E

Uniqueness

Uniqueness Score: -1.00%

Function 0047AC84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047AF0A,00000000,0047AF20,?,?,?,?,00000000), ref: 0047ACE6

Strings

RegisteredOrganization, xrefs: 0047ACD5
RegisteredOwner, xrefs: 0047ACC3

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 5b1624e0d0a26370ad87dfaa62c64d4df9973d747b83543c7d8c6e65497b8bc9
Instruction ID: b9eacae86494219c9247879311a17811a387abae95f33f841a50e1cc0b921638
Opcode Fuzzy Hash: 5b1624e0d0a26370ad87dfaa62c64d4df9973d747b83543c7d8c6e65497b8bc9
Instruction Fuzzy Hash: ECF09071704244BFDB05DA65FE92B9F339AE781304F20803BE5059B292D7789E01975D

Uniqueness

Uniqueness Score: -1.00%

Function 0046DAE4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,CLG,0049B16C,?,0046DDFB,?,00000000,0046E352,?,_is1), ref: 0046DB07

Strings

CLG, xrefs: 0046DAE8
Inno Setup: Setup Version, xrefs: 0046DB05

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Value
String ID: CLG$Inno Setup: Setup Version
API String ID: 3702945584-2051458772
Opcode ID: ac59f1734136ff9b31f552cfb0c730bd18925f5441a7aae95a2c9bb8e9e8bd20
Instruction ID: 63f1866591e0cfe6b0df424f345f824daa48978019e59ff859285ae1a5716b57
Opcode Fuzzy Hash: ac59f1734136ff9b31f552cfb0c730bd18925f5441a7aae95a2c9bb8e9e8bd20
Instruction Fuzzy Hash: 6BE06DB17012043FD710AA2A9C85F6BBADCDF98765F10403AB908DB392D578DD0081A8

Uniqueness

Uniqueness Score: -1.00%

Function 00473E44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047407B), ref: 00473E69
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047407B), ref: 00473E80

Part of subcall function 004527FC: GetLastError.KERNEL32(00000000,0045326D,00000005,00000000,004532A2,?,?,00000000,0049A628,00000004,00000000,00000000,00000000,?,004966A1,00000000), ref: 004527FF

Strings

CreateFile, xrefs: 00473E75

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 6e1e6dd59de84e1610d1fae5968a7dc4b8fcfba8eb0a6e29607e31f7e7f0bfbb
Instruction ID: 4841faf599e7bc621e79a9eb559aeb390f00cccbb334f8fc222e39aaa6a1ffd8
Opcode Fuzzy Hash: 6e1e6dd59de84e1610d1fae5968a7dc4b8fcfba8eb0a6e29607e31f7e7f0bfbb
Instruction Fuzzy Hash: 74E065342403447BDA10FA65CCC6F4977889B14728F108156F9446F3E2C5B5EC408618

Uniqueness

Uniqueness Score: -1.00%

Function 00455EF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00455E88: CoInitialize.OLE32(00000000), ref: 00455E8E

Part of subcall function 0042E294: SetErrorMode.KERNEL32(00008000), ref: 0042E29E
Part of subcall function 0042E294: LoadLibraryA.KERNEL32(00000000,00000000,0042E2E8,?,00000000,0042E306,?,00008000), ref: 0042E2CD

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00455F1C

Strings

SHCreateItemFromParsingName, xrefs: 00455F07
shell32.dll, xrefs: 00455F11

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 378ff3c3cad201b1a507828d88c32ecd3d9794aa842a99f409d8679426ba3c20
Instruction ID: 086cb54cd4a6b743611040c34fa54cac9677e4986cde9c94649046165b75af72
Opcode Fuzzy Hash: 378ff3c3cad201b1a507828d88c32ecd3d9794aa842a99f409d8679426ba3c20
Instruction Fuzzy Hash: 7DC04CE1740B109ACA0077FA786362F25049B9171FB60947FB944BA5C7DE7C84485B6E

Uniqueness

Uniqueness Score: -1.00%

Function 0046BAA4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E294: SetErrorMode.KERNEL32(00008000), ref: 0042E29E
Part of subcall function 0042E294: LoadLibraryA.KERNEL32(00000000,00000000,0042E2E8,?,00000000,0042E306,?,00008000), ref: 0042E2CD

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046BAB9

Strings

SHPathPrepareForWriteA, xrefs: 0046BAA4
shell32.dll, xrefs: 0046BAAE

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 948b90149d54e18bd261352400ddc51825f4a6410e897a91b91800c131cd32d8
Instruction ID: 7c64519ac477b0256fe014147c0aca13071f4397c6298e198afe032025d1c874
Opcode Fuzzy Hash: 948b90149d54e18bd261352400ddc51825f4a6410e897a91b91800c131cd32d8
Instruction Fuzzy Hash: 9BB092D060178086CE00A7F3694260B2608DB80708B24C47B7144EA689EF7C84499BAE

Uniqueness

Uniqueness Score: -1.00%

Function 0047FDF8 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,0047FF30), ref: 0047FEC8
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0047FED9
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0047FEF1

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 12ee954d9dd57dda4ba813c1b71bbe3f2e612506f98f431c06baef398d025041
Instruction ID: e16edd8279fa0a324c16101bba16bc4487502bc1dd233096facc5133766486c5
Opcode Fuzzy Hash: 12ee954d9dd57dda4ba813c1b71bbe3f2e612506f98f431c06baef398d025041
Instruction Fuzzy Hash: 3631B2307043445AD710EB36AD86BAA3B949F5531CF54847FF844AB3E3CA7C9D09869D

Uniqueness

Uniqueness Score: -1.00%

Function 00451870 Relevance: 4.6, APIs: 3, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,00495B9E), ref: 00451890
74D41500.VERSION(00000000,?,00000000,?,00000000,0045190B,?,00000000,?,?,?,00495B9E), ref: 004518BD
74D41540.VERSION(?,00451934,?,?,00000000,?,00000000,?,00000000,0045190B,?,00000000,?,?,?,00495B9E), ref: 004518D7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: D41500D41520D41540
String ID:
API String ID: 2153611984-0
Opcode ID: 32dc0c669be3dba59a96a2e0946022db037f7dc6cc067028efd4bc0faef57719
Instruction ID: 20ed6491ed2f954116a3f796feedc986cd8e94f36f8aa14e941763638c823977
Opcode Fuzzy Hash: 32dc0c669be3dba59a96a2e0946022db037f7dc6cc067028efd4bc0faef57719
Instruction Fuzzy Hash: 91219275A00248AFDB01DAA98C51EBFB7FCEB49301F55447AF800E3392D6799E04CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0044A9C4 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00000000,00000000,0044AAC5,?,0048075F,?,?), ref: 0044AA39
SelectObject.GDI32(?,00000000), ref: 0044AA5C
73A1A480.USER32(00000000,?,0044AA9C,00000000,0044AA95,?,00000000,?,00000000,00000000,0044AAC5,?,0048075F,?,?), ref: 0044AA8F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A480A570ObjectSelect
String ID:
API String ID: 1230475511-0
Opcode ID: 94ae97a5c47de24bdc6f41602c12bbd9a6ff14d9c194c102f97edad2c912b674
Instruction ID: e97a7db0b19018eccb7bdd8e2b97057aa5629700143653f2dba4605955584dd2
Opcode Fuzzy Hash: 94ae97a5c47de24bdc6f41602c12bbd9a6ff14d9c194c102f97edad2c912b674
Instruction Fuzzy Hash: 53218670E44248AFEB11DFA5C845B9EBBB8DB48304F5184BAF404F7681D77C9950CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 0044A6F8 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044A784,?,0048075F,?,?), ref: 0044A756
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044A769
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044A79D

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: 2dcda40591ff521ad6db5f3284d7b2faf7f574eefcdf5e80e57f7bca479d4d22
Instruction ID: bd85c15016dfe3738246438113b79509544e0e6eba2a2d8cf9ec02ddf5800e7c
Opcode Fuzzy Hash: 2dcda40591ff521ad6db5f3284d7b2faf7f574eefcdf5e80e57f7bca479d4d22
Instruction Fuzzy Hash: B611B6B67446047FE710DAAA9C81D6FB7ECEB89724F10417AF504E7290D5389E018669

Uniqueness

Uniqueness Score: -1.00%

Function 004243E4 Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004243FA
TranslateMessage.USER32(?), ref: 00424477
DispatchMessageA.USER32(?), ref: 00424481

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d9ded229c8590facaadff37e87cda2a0a723e8e84bd3d085b18450e606e049c6
Instruction ID: b1c2fd2e30bb76e6d5953017732656b938df3ffbbb3663dbc38eebda5daa6e77
Opcode Fuzzy Hash: d9ded229c8590facaadff37e87cda2a0a723e8e84bd3d085b18450e606e049c6
Instruction Fuzzy Hash: 021194303043105ADA20F6A4BD4179B73D8DFC1754F80481EF98997382D7BD9E49879B

Uniqueness

Uniqueness Score: -1.00%

Function 0046E96C Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000), ref: 0046E9C6

Strings

Setting permissions on directory: %s, xrefs: 0046E98C
Failed to set permissions on directory (%d)., xrefs: 0046E9D7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set permissions on directory (%d).$Setting permissions on directory: %s
API String ID: 1452528299-3781482204
Opcode ID: 230c13ff4928c0636b8650e0cabb6ad91d3403bd99112fb2cc6b9eb4a768d6b0
Instruction ID: 02fbd42a4ef657e7e5df15ca93671c86d812d10d66c7fb32e73661cd37b48955
Opcode Fuzzy Hash: 230c13ff4928c0636b8650e0cabb6ad91d3403bd99112fb2cc6b9eb4a768d6b0
Instruction Fuzzy Hash: 3C018470B042445BCB14D7AE94816ADB7E8DF09314F50C2BBB519D7393EA781D08C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0041662C Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 00416652
SetPropA.USER32(00000000,00000000), ref: 00416667
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 0041668E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 0b96c1f9cf6543fecbd6a35da17f5b9789cac81f925d8901db294d131d5f654f
Instruction ID: a7b427a21d9d01d3c7a7c114323539e34fe023f16d3a8bdcb738946a3bd27d2d
Opcode Fuzzy Hash: 0b96c1f9cf6543fecbd6a35da17f5b9789cac81f925d8901db294d131d5f654f
Instruction Fuzzy Hash: 0DF0BD71701220BFEB10AF599C85FA672DCAB09715F16017ABE08EF286C678DD50C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE3C Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE4C
IsWindowEnabled.USER32(?), ref: 0041EE56
EnableWindow.USER32(?,00000000), ref: 0041EE7C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 661549f8b05640278d55d214ebbfaedd3da1a8ea22d29ad18d3c04624f406fe7
Instruction ID: 1fb41f107dd9a6daf7672a0d73ff1e5ecff59270ff5cebb6154dc259c05fed95
Opcode Fuzzy Hash: 661549f8b05640278d55d214ebbfaedd3da1a8ea22d29ad18d3c04624f406fe7
Instruction Fuzzy Hash: 21E0EDB45403046AE750AB2BDCC1E5B779CBB15314F45843BAC059B293DA3DD8468A78

Uniqueness

Uniqueness Score: -1.00%

Function 00480744 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 004807F2

Strings

InitializeWizard, xrefs: 0048078B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: e8bc45221c1ced8f3db4892f10cabcf3a6b5d1e5d7a0d6448074b32574130fc3
Instruction ID: a98c25ee96c3713022c78f3a8178700cde703ade30f50db9fd66bd4b04694ffd
Opcode Fuzzy Hash: e8bc45221c1ced8f3db4892f10cabcf3a6b5d1e5d7a0d6448074b32574130fc3
Instruction Fuzzy Hash: 8A1160306143049FD750FB29FD42B1A37E9E715358F10483BE414872A2E7796C88CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0047B3C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047B410

Strings

Failed to remove temporary directory: , xrefs: 0047B429

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 510afcadc0a5fc7b7d3d84faec4b5b99668a7f0be4a309f1e293efdcde24be5f
Instruction ID: d5551030ee247e8b42897c464a68d0ab1bc95df683c94e8c28c72e80b79209cb
Opcode Fuzzy Hash: 510afcadc0a5fc7b7d3d84faec4b5b99668a7f0be4a309f1e293efdcde24be5f
Instruction Fuzzy Hash: BB019230600204AADB11EB72DC4BBDB77A8DB08709F618477BC04971A3D77CAD04C59C

Uniqueness

Uniqueness Score: -1.00%

Function 0047ABA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047ADE6,00000000,0047AF20), ref: 0047ABE5

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047ABB5

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 9ac6e1f31baab47cc840eed161da4f1d1b3b77d667a3817b355e56b81b48cd77
Instruction ID: 821e3aeabc459c5987cecf181ed5c98e845f64ee8cd5da46ed9d30c4ebd54980
Opcode Fuzzy Hash: 9ac6e1f31baab47cc840eed161da4f1d1b3b77d667a3817b355e56b81b48cd77
Instruction Fuzzy Hash: FCF0AE3170411467D704A55E5D42B9FA6DDDBC5718F20407BF608DB342D9BDED0243AD

Uniqueness

Uniqueness Score: -1.00%

Function 0046DB54 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046E1BC,?,?,00000000,0046E352,?,_is1,?), ref: 0046DB67

Strings

NoModify, xrefs: 0046DB65

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 43aef99d7e2f06beab36c31299af3bbfd23a75f06b1ba768888fa23f3b16b0df
Instruction ID: e90b3bda476c512b32f7b2d243e68df7f996b7772bf02e53f7434a578a6abb48
Opcode Fuzzy Hash: 43aef99d7e2f06beab36c31299af3bbfd23a75f06b1ba768888fa23f3b16b0df
Instruction Fuzzy Hash: DCE04FB0A40308BFEB04DB55DD4AF6A77ACDB48724F104059BA04DB281E674FE00C668

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DD36

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: dc0859697dd59c0a2e250410b90aaf10cd4a65a049fe44066cf05cc0df631d6b
Instruction ID: c14f98e10822ea0f36fe4910291e55874a20af8805c50e0619ea9c3326161129
Opcode Fuzzy Hash: dc0859697dd59c0a2e250410b90aaf10cd4a65a049fe44066cf05cc0df631d6b
Instruction Fuzzy Hash: 5BD09E72910128BBEB009A89DC81DF7775DDB15760F44401BF90497141C5B4AC5197E4

Uniqueness

Uniqueness Score: -1.00%

Function 0045333C Relevance: 3.2, APIs: 2, Instructions: 190fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0045356F,?,00000000,004535D9,?,?,-00000001,00000000,?,0047B425,00000000,0047B374,00000000), ref: 0045354B
FindClose.KERNEL32(000000FF,00453576,0045356F,?,00000000,004535D9,?,?,-00000001,00000000,?,0047B425,00000000,0047B374,00000000,00000001), ref: 00453569

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 8734a7e58f3b733a7da4560476d655b76757e4d8c1c9c3b614eb8c60a134e9ba
Instruction ID: f8467c2d710418c647605d30fb4acdd42618da7945ce8e57f28085a7cdc9fa6d
Opcode Fuzzy Hash: 8734a7e58f3b733a7da4560476d655b76757e4d8c1c9c3b614eb8c60a134e9ba
Instruction Fuzzy Hash: 49816130A0424DAFCF11DF55C8457EFBBB4AF49346F1080AAE85467392E7399B4ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0047C570 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047C84F,?,-0000001A,0047E7AE,-00000010,?,00000004,0000001A,00000000,0047EAFB,?,0045CF04), ref: 0047C5E6

Part of subcall function 0042E21C: 73A1A570.USER32(00000000,00000000,0047EB62,?,?,00000001,00000000,00000002,00000000,0047F4AB,?,?,?,?,?,00496FD2), ref: 0042E22B
Part of subcall function 0042E21C: EnumFontsA.GDI32(?,00000000,0042E208,00000000,00000000,0042E274,?,00000000,00000000,0047EB62,?,?,00000001,00000000,00000002,00000000), ref: 0042E256
Part of subcall function 0042E21C: 73A1A480.USER32(00000000,?,0042E27B,00000000,00000000,0042E274,?,00000000,00000000,0047EB62,?,?,00000001,00000000,00000002,00000000), ref: 0042E26E

SendNotifyMessageA.USER32(000204C4,00000496,00002711,-00000001), ref: 0047C7B6

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A480A570EnumFontsMessageNotifySend
String ID:
API String ID: 2685184028-0
Opcode ID: 197c8981259148e54bb0a07dac90ff0cb3275dda38bfca97d7a3ecd20483d5d5
Instruction ID: 3152a9e13b81b0b5460fd10549f24f80d72af0acc03c8ee3388a5baaa57f31f4
Opcode Fuzzy Hash: 197c8981259148e54bb0a07dac90ff0cb3275dda38bfca97d7a3ecd20483d5d5
Instruction Fuzzy Hash: 545150746001058BCB20FF26E9C1A9B37D9EB54709B50C53FA8489B366CB3CDD468B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0042DB00 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DC38), ref: 0042DB3C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DC38), ref: 0042DBAC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7db11f5e848f54ab45960ad4a331e9941b33df6e03846baf119b41bd5d3ae497
Instruction ID: 91e3d4c21a9af377e9973101783565063810c8d1f91dc5a268d0837cd0fd02c9
Opcode Fuzzy Hash: 7db11f5e848f54ab45960ad4a331e9941b33df6e03846baf119b41bd5d3ae497
Instruction Fuzzy Hash: 01414F71E00129AFDB11DF96D991BAFBBB8AB04704F91856AE810F7240D778AE40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0042DDC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DED6,?,?,00000008,00000000,00000000,0042DF03), ref: 0042DE6C
RegCloseKey.ADVAPI32(?,0042DEDD,?,00000000,00000000,00000000,00000000,00000000,0042DED6,?,?,00000008,00000000,00000000,0042DF03), ref: 0042DED0

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: cb98cc3ae80dacffce083ce26f8b711a4019fc3e0b95e09fc8e794454e1b8392
Instruction ID: e7d19d48aa7e0d86dc945916bf2bb8546aa8c3ec23a2ebc9bd60cf0b03d82033
Opcode Fuzzy Hash: cb98cc3ae80dacffce083ce26f8b711a4019fc3e0b95e09fc8e794454e1b8392
Instruction Fuzzy Hash: 7931A270F04648AFDB11DFA6DC42BAFB7B9EB45304F91447BE500E7281D6785A01CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00474E00 Relevance: 3.1, APIs: 2, Instructions: 89timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00474EF7,?,00000000,00474F08,?,00000000,00474F51), ref: 00474EC8
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00474EF7,?,00000000,00474F08,?,00000000,00474F51), ref: 00474EDC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FileTime$Local
String ID:
API String ID: 791338737-0
Opcode ID: c218362c762e18f33971fe6a9ec624a3168f56318a08dd5feb7bc165dec33a33
Instruction ID: 2f9d1cb145c913e7d450fca3ea8fd4311702c73accf9ca5d03359ccb436d7420
Opcode Fuzzy Hash: c218362c762e18f33971fe6a9ec624a3168f56318a08dd5feb7bc165dec33a33
Instruction Fuzzy Hash: 1731C770A00249AFCB11DFA5C892FAFBBB8FB49704F41847AF904A7391D7799900CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD38 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CDAE
GetProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100), ref: 0042CDD9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ProfileString$Private
String ID:
API String ID: 254305602-0
Opcode ID: 2c2328743ddda00c7d15350ace420bdc602ffeb957af8c2cdfbdc2551cbd5def
Instruction ID: e78d44e9e962ba9c02c312fbfe594ed117808a3556f2a20f25debd043e60578e
Opcode Fuzzy Hash: 2c2328743ddda00c7d15350ace420bdc602ffeb957af8c2cdfbdc2551cbd5def
Instruction Fuzzy Hash: 4F2110F0B00154BBCB11EF6ADCC2A5EBBECDB54709B50807BB404F7291DA3C9E059659

Uniqueness

Uniqueness Score: -1.00%

Function 00493D18 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0049379C: 73A1A570.USER32(00000000,?,?,00000000), ref: 004937AD
Part of subcall function 0049379C: SelectObject.GDI32(00000000,00000000), ref: 004937CF
Part of subcall function 0049379C: GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00493D4D), ref: 004937E3
Part of subcall function 0049379C: GetTextMetricsA.GDI32(00000000,?), ref: 00493805
Part of subcall function 0049379C: 73A1A480.USER32(00000000,00000000,0049382F,00493828,?,00000000,?,?,00000000), ref: 00493822

MulDiv.KERNEL32(?,?,00000006), ref: 00493D8F
MulDiv.KERNEL32(?,?,0000000D), ref: 00493DA4

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Text$A480A570ExtentMetricsObjectPointSelect
String ID:
API String ID: 2611416588-0
Opcode ID: 8d0c646c9a4e4b0d30fac1b7b85a689e764dc58dccd211803ff8241c429fd0a2
Instruction ID: 4cce8b766e98ee852df1ec4a8bae4de7f0429c54a28c063c64d7a89b8744eeb2
Opcode Fuzzy Hash: 8d0c646c9a4e4b0d30fac1b7b85a689e764dc58dccd211803ff8241c429fd0a2
Instruction Fuzzy Hash: 1D21EA713002009FDB40DF69C8C5EA637A5EB8A715F1446B9FD18CF39ADB25ED048BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00451B48 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,004570C0,00000000,004570A8,?,?,?,00000000,00451BC2,?,?,?,00000001), ref: 00451B9C
GetLastError.KERNEL32(00000000,00000000,?,?,004570C0,00000000,004570A8,?,?,?,00000000,00451BC2,?,?,?,00000001), ref: 00451BA4

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: 3c8082e2a01157f1419d6f228db75622c9fd29d04a9264d132d81f14a429efee
Instruction ID: b02d4c0ed9d20df4d5ab504750d90f14c4f2a017718fa5a0f45c46dfac375986
Opcode Fuzzy Hash: 3c8082e2a01157f1419d6f228db75622c9fd29d04a9264d132d81f14a429efee
Instruction Fuzzy Hash: F5117972A00248AF8B40CEA9DC41EDFB7ECEB4C314B1145A6BD18D3211E638AD148B64

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFB0 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AFCA
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B127,00000000,0040B13F,?,?,?,00000000), ref: 0040AFDB

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: a2510b5af39e6e578ad56d6826258cb27b8cd50f57c461be11b8cfda4e797ee0
Instruction ID: f5282dc9d2a05e173a7180cca0480f834172270a28f0af8e578ec16cf54e8ff1
Opcode Fuzzy Hash: a2510b5af39e6e578ad56d6826258cb27b8cd50f57c461be11b8cfda4e797ee0
Instruction Fuzzy Hash: BF01F2B1300700AFDB10EF69DC92E6A77EDDB4A7547118077F400AB2D0DA3EAC1096AE

Uniqueness

Uniqueness Score: -1.00%

Function 00451BE0 Relevance: 3.0, APIs: 2, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,?), ref: 00451C26
GetLastError.KERNEL32(00000000,00000000,?,00000000,00451C4C), ref: 00451C2E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CopyErrorFileLast
String ID:
API String ID: 374144340-0
Opcode ID: 9702c94ac9a5c9e3b3f758a58ee937396c11e24a48add80ecf8c8a078fc06ecc
Instruction ID: ad8646c6cd9c3d3bb2eba743f04f9c2c0bdb31dcc8e20efee2004e26d886e37b
Opcode Fuzzy Hash: 9702c94ac9a5c9e3b3f758a58ee937396c11e24a48add80ecf8c8a078fc06ecc
Instruction Fuzzy Hash: 2D01F775A04204BB8B02DF799C4199EB7ECDB483127114577F804E3252E6395E049558

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE8C Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EEDB
73A25940.USER32(00000000,0041EE3C,00000000,00000000,0041EEF8,?,00000000,0041EF2F,?,0042EB08,?,00000001), ref: 0041EEE1

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A25940CurrentThread
String ID:
API String ID: 2655091166-0
Opcode ID: 3e0c9b82023ef9eb735939eab937add120b80a23ec4c916cd8f99a387fd18bdf
Instruction ID: ba5542fd2547f781c6491df2dc5ebc178645ed083630ab8d364c76c0fa24d7b4
Opcode Fuzzy Hash: 3e0c9b82023ef9eb735939eab937add120b80a23ec4c916cd8f99a387fd18bdf
Instruction Fuzzy Hash: AF011B75A04708BFD715CF6ADC11956BBE8E78A720B22887BEC04D36A0FB345915DE18

Uniqueness

Uniqueness Score: -1.00%

Function 0042D03C Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042D072
WriteProfileStringA.KERNEL32(00000000,00000000,00000000), ref: 0042D098

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ProfileStringWrite$Private
String ID:
API String ID: 3244626871-0
Opcode ID: 560b4c749d9e6caa00ad2c869f77109ee9516ef3079630acf8306b3245416d64
Instruction ID: 1937ff8d9e90d3265ea5c422594ef8e03161c13a65df0893b3644543c22eaa13
Opcode Fuzzy Hash: 560b4c749d9e6caa00ad2c869f77109ee9516ef3079630acf8306b3245416d64
Instruction Fuzzy Hash: 8CF096F17851597AC700FE7E9CC2D2F6ADC8A7435A700413BB004FB282C93C9E05126A

Uniqueness

Uniqueness Score: -1.00%

Function 00451FE0 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452022
GetLastError.KERNEL32(00000000,00000000,00000000,00452048), ref: 0045202A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 1845678bfe1f7006c542e362d27ffbce14d005dd821da547dc8afd5dc54331c6
Instruction ID: b9eff51345b8b7871c1011999a0b636bec304ecd6ca236fc282542a6da5c4eb4
Opcode Fuzzy Hash: 1845678bfe1f7006c542e362d27ffbce14d005dd821da547dc8afd5dc54331c6
Instruction Fuzzy Hash: C3014971B01604BBCB01EF799D4149EB7ECDB89725360457BFD08E3283EA7C4E088598

Uniqueness

Uniqueness Score: -1.00%

Function 004521E8 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,?,00000000,00452249,?,?,-00000001,?), ref: 00452223
GetLastError.KERNEL32(00000000,?,00000000,00452249,?,?,-00000001,?), ref: 0045222B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 97ada69cbb6b99aed1965860b7d5fd9832febf36a441aa4bff7b70a4771449b7
Instruction ID: 84d9150d052e3f507253c74b3eff3568524431298f3121bd71b42332bd349af5
Opcode Fuzzy Hash: 97ada69cbb6b99aed1965860b7d5fd9832febf36a441aa4bff7b70a4771449b7
Instruction Fuzzy Hash: 09F04975B00204AB8B00DB76AC4149EB7ECDB8A32171045BBFC08E3242E6784E048498

Uniqueness

Uniqueness Score: -1.00%

Function 00451AD0 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00451B2F), ref: 00451B09
GetLastError.KERNEL32(00000000,00000000,00000000,00451B2F), ref: 00451B11

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 563f8bf67e9e20bb0afe1ab7f644b96e044f0cc51ef97c64e7cc1a2122d4c18e
Instruction ID: 81bbb39f5a38f401018786416ba8ff2287df4e0b761d8d795be4b0ce8710cbb4
Opcode Fuzzy Hash: 563f8bf67e9e20bb0afe1ab7f644b96e044f0cc51ef97c64e7cc1a2122d4c18e
Instruction Fuzzy Hash: 84F02871A00204ABCB01DF759C01A9EB7E8DB08315B1045BBFC04E3252F63D5E148598

Uniqueness

Uniqueness Score: -1.00%

Function 00452170 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,004521CD,?,-00000001,00000000), ref: 004521A7
GetLastError.KERNEL32(00000000,00000000,004521CD,?,-00000001,00000000), ref: 004521AF

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: daa5dfc73c0c2b2e2516e1d627057958e97f547831806bdb59258974a135422c
Instruction ID: 57644ae1d9cbb0d8e8488ac66f78f07a9b9349416bed7a7506f01afc667cc946
Opcode Fuzzy Hash: daa5dfc73c0c2b2e2516e1d627057958e97f547831806bdb59258974a135422c
Instruction Fuzzy Hash: 42F02871A00604ABCB01DFB59D4249EB3E8DB0935571049B7FC04E3242E6784E048558

Uniqueness

Uniqueness Score: -1.00%

Function 00451C68 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00451CC5,?,-00000001,?), ref: 00451C9F
GetLastError.KERNEL32(00000000,00000000,00451CC5,?,-00000001,?), ref: 00451CA7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: f5553c0eb1e35d3e9818b95ede10457d7a1f568759ff91ea1549cb38076d6b70
Instruction ID: 2f39902243e13cf3329fa8b1c962f904b5faca77b1327eb7bfcd5872de6aae06
Opcode Fuzzy Hash: f5553c0eb1e35d3e9818b95ede10457d7a1f568759ff91ea1549cb38076d6b70
Instruction Fuzzy Hash: F9F02271A04248ABCB02EFB5AC4169EB3E8DB4831576049B7FC04E3352E73A4E048998

Uniqueness

Uniqueness Score: -1.00%

Function 00451E40 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00451E9F,?,?,00000000), ref: 00451E79
GetLastError.KERNEL32(00000000,00000000,00451E9F,?,?,00000000), ref: 00451E81

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: ecbcbc4cc75cdf9b71a18080a864773a546e897040fb367ce93a2eb0c093d75f
Instruction ID: 049bf75c4411a2a97489e9f5834d8c8c03931e133fa5e343e78f30840e1224b5
Opcode Fuzzy Hash: ecbcbc4cc75cdf9b71a18080a864773a546e897040fb367ce93a2eb0c093d75f
Instruction Fuzzy Hash: 91F04C70E04708ABCB11DF759C425AEB3E8DB4972576047B7FC14E3292E73C4E048588

Uniqueness

Uniqueness Score: -1.00%

Function 00423224 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423231
LoadCursorA.USER32(00000000,00000000), ref: 0042325B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 78cca4750e793ac7adf5cb8bf8fd85fa5cfcf53a15d90ff592724969511865a5
Instruction ID: 3e67275c8bdd7dfa88ab74454ff6d801d359b6300bed2acf0724d9ae45bacfb2
Opcode Fuzzy Hash: 78cca4750e793ac7adf5cb8bf8fd85fa5cfcf53a15d90ff592724969511865a5
Instruction Fuzzy Hash: D5F0A71174011066D6505D3E6CC1A6A72689BC2775B71037BFB3FD72D1CA2E6E4141BD

Uniqueness

Uniqueness Score: -1.00%

Function 0042E294 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E29E
LoadLibraryA.KERNEL32(00000000,00000000,0042E2E8,?,00000000,0042E306,?,00008000), ref: 0042E2CD

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 8d85eb380502a5283e1fc0206abe0acada7dea1f2e8d8d03aeef51df10394832
Instruction ID: 1eef3f08b3603f4b9bcb28d695b022b75d39dfbbdd59c9d79d79570b9304c5b2
Opcode Fuzzy Hash: 8d85eb380502a5283e1fc0206abe0acada7dea1f2e8d8d03aeef51df10394832
Instruction Fuzzy Hash: 0AF08270B14744BFDB119F779C6282BBBECE74DB1079249B6F800A3A91E63C5910C938

Uniqueness

Uniqueness Score: -1.00%

Function 004162B2 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004162C9
GetClassInfoA.USER32(00000000,?,?), ref: 004162D9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: d429aef6ea4eea9c35804ce5609d83cca1e84f5bf9d9157b3563b74df447d877
Instruction ID: a64a2d3efa17df1144ab3aea37866fc4dc7d928b9fa9eac647d3d1d98e8338c5
Opcode Fuzzy Hash: d429aef6ea4eea9c35804ce5609d83cca1e84f5bf9d9157b3563b74df447d877
Instruction Fuzzy Hash: 81E01AB26016206AEB10DFA99D81EE32BDCDB08310B1201B3BE04CB286D7A4DD104BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044FC58 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046EDA5,?,00000000), ref: 0044FC6E
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046EDA5,?,00000000), ref: 0044FC76

Part of subcall function 0044FA14: GetLastError.KERNEL32(0044F830,0044FAD6,?,00000000,?,00496128,00000001,00000000,00000002,00000000,00496289,?,?,00000005,00000000,004962BD), ref: 0044FA17

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 69a82938775a7cc58e39884cd4278003b8488c1f5b492a3041655513dd7201f5
Instruction ID: e0edb2410980d5740b82e74ec1d1a3a58f61ffe58ec814ff12274e4ce374728a
Opcode Fuzzy Hash: 69a82938775a7cc58e39884cd4278003b8488c1f5b492a3041655513dd7201f5
Instruction Fuzzy Hash: 6EE012B13056055BFB00EAA599C1F3B22D8EB48315F00487AB948DF182E674CC059B65

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 86d3033056ee1eeb69ed56595d455cb9815cc57517e3e671329daeadf9e1ec36
Instruction ID: b33c25bc9d44e5855224c25112d8485d4e2e4d0ac397fdc44bd3a0d1e7be2c31
Opcode Fuzzy Hash: 86d3033056ee1eeb69ed56595d455cb9815cc57517e3e671329daeadf9e1ec36
Instruction Fuzzy Hash: 3BF08272A0063067EB60596A4C85B5359C49BC5794F154076FD09FF3E9D6B98C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 004085BC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004086F2), ref: 004085DB

Part of subcall function 00406DCC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406DE9

Part of subcall function 00408548: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049A4C0,00000001,?,00408613,?,00000000,004086F2), ref: 00408566

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: a525cbd3d240e40b9a8e61725c1d0d5fb3ff0f7f2fe451f1bb0595dfe248f2f1
Instruction ID: 800c816fdee51ba3b703f3c65523d0dbbfe6500425a376066ce8a62c5dc1c991
Opcode Fuzzy Hash: a525cbd3d240e40b9a8e61725c1d0d5fb3ff0f7f2fe451f1bb0595dfe248f2f1
Instruction Fuzzy Hash: 7C318435E0011AABCB01DF55C8809DEB779FF84318F518577E815BB386EB38AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB84 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC21

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 6fa65a4ba40a25fdb461d21021e26bda7efdb10b8330298da01b036f4386a8c7
Instruction ID: ad1b1eea4229ece2b5e5a0dfcbebc4532a380c29954d1d5d1310598ff1b3e549
Opcode Fuzzy Hash: 6fa65a4ba40a25fdb461d21021e26bda7efdb10b8330298da01b036f4386a8c7
Instruction Fuzzy Hash: 982130B16087456FC340DF29D4406A7BBE4BB48314F14493EE498C3341E774E996CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0046B148 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EE8C: GetCurrentThreadId.KERNEL32 ref: 0041EEDB
Part of subcall function 0041EE8C: 73A25940.USER32(00000000,0041EE3C,00000000,00000000,0041EEF8,?,00000000,0041EF2F,?,0042EB08,?,00000001), ref: 0041EEE1

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046B1A6,?,00000000,?,?,0046B3B3,?,00000000,0046B3F2), ref: 0046B18A

Part of subcall function 0041EF40: IsWindow.USER32(?), ref: 0041EF4E
Part of subcall function 0041EF40: EnableWindow.USER32(?,00000001), ref: 0041EF5D

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$A25940CurrentEnablePathPrepareThreadWrite
String ID:
API String ID: 390483697-0
Opcode ID: c586ef2b68a2f3ca709d70337fcdf558dd0630a6df95e79d1a260488e11470b5
Instruction ID: d67aa88dd1cb62bed10c3e7390585935628f2d1eca88a458147ecccec626e26d
Opcode Fuzzy Hash: c586ef2b68a2f3ca709d70337fcdf558dd0630a6df95e79d1a260488e11470b5
Instruction Fuzzy Hash: F4F05230288300BFF3049B72ED26B9A77E8E30AB84F50043BF800C6580E3BD6880C49E

Uniqueness

Uniqueness Score: -1.00%

Function 00416538 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 0041656D

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0059820fa5c2718545f9c1a7ab2c0a69f326d16047ab787ccf5aecd7b7ff452a
Instruction ID: 13f77f5b12b5d4dba0df04b824f9bbdcdbf9abdef4ba7f4078844aaa66f06397
Opcode Fuzzy Hash: 0059820fa5c2718545f9c1a7ab2c0a69f326d16047ab787ccf5aecd7b7ff452a
Instruction Fuzzy Hash: C3F013B2200510AFDB84CF9CD9C0F9373ECEB0C210B0881A6FA08CF24AD225EC108BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041499C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149D7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC70 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CCB8,?,00000001,?,?,00000000,?,0042CD0A,00000000,00451D85,00000000,00451DA6,?,00000000), ref: 0042CC9B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 36984f0c153e8d7ef2d5d47dbcebac8cc2aa99dffbc3dcb1463206b76abeae5a
Instruction ID: b73eb5a154f649d2809be99405b53361cafe154161c2f228d12b6df1401c81d6
Opcode Fuzzy Hash: 36984f0c153e8d7ef2d5d47dbcebac8cc2aa99dffbc3dcb1463206b76abeae5a
Instruction Fuzzy Hash: DBE06571304704BFD701EBA2DC92A5EBBACDB45B14BA14476F40097681D5795E008418

Uniqueness

Uniqueness Score: -1.00%

Function 0044FB24 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0044FB64

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6b6c2f6427671c92fc35653d049b776986c206ad1ec0349123f02e2bdec0d0d0
Instruction ID: e92c98a8af308b3432749b2dbea91310ced2c99b4e9e22dcf80a84a4ab028b75
Opcode Fuzzy Hash: 6b6c2f6427671c92fc35653d049b776986c206ad1ec0349123f02e2bdec0d0d0
Instruction Fuzzy Hash: C9E092A13501083ED340EEAC7C42FA33BCC931A718F008037F988C7242C8619D148BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042E714 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004525D3,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E733

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 3d4028b123c82e6846fd1d4644c1ebc4dbb36778e7c4a41470860cb2316b366c
Instruction ID: 6d19f9eaba7e0b366cd3630fd3a6006c9e2ab04ede14182dfca9d4daa20a0eaf
Opcode Fuzzy Hash: 3d4028b123c82e6846fd1d4644c1ebc4dbb36778e7c4a41470860cb2316b366c
Instruction Fuzzy Hash: BAE0D86178431115F2251415AC53B7B520E83C0708F94803ABB509D3C2C6AE9D0A425E

Uniqueness

Uniqueness Score: -1.00%

Function 00406300 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00423664,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF4), ref: 00406329

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9fe79a92e10620011824defd5e810c08c8dc52875c3fb3ec0cb06ffc5b1ed454
Instruction ID: 1d12608fc0467a25e6c73015cc4d191371d7057fe5102c86e19c90aa3d4ae925
Opcode Fuzzy Hash: 9fe79a92e10620011824defd5e810c08c8dc52875c3fb3ec0cb06ffc5b1ed454
Instruction Fuzzy Hash: 4CE002B2204309BFDB00DE8ADDC1DABB7ACFB4C654F844105BB1C972428275AD608BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0042DCE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DD10

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fd09e7af01654870662ecab1a6ae9466cbd6b938ad0164d162c3093db90d5ced
Instruction ID: 7f79a2e4d97a4a645d07b35156213e15a338719dce2f9e63d3d3475997e8d9d9
Opcode Fuzzy Hash: fd09e7af01654870662ecab1a6ae9466cbd6b938ad0164d162c3093db90d5ced
Instruction Fuzzy Hash: 2EE07EB2610119AF9B50DE8DDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00453E14 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0046F5C8,00000000,004703B7,?,00000000,00470400,?,00000000,00470539,?,00000000,?,00000000), ref: 00453E2A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 0744d0a5b3427e78a69e20d3f9f4ae96fc5b43796bd866d4b61263ac2905f8d2
Instruction ID: 149b646abace05dd99a849fafeb154bdc285a77ddc55ae8383a2978a47a99b95
Opcode Fuzzy Hash: 0744d0a5b3427e78a69e20d3f9f4ae96fc5b43796bd866d4b61263ac2905f8d2
Instruction Fuzzy Hash: 33E09B709046008BCB14DF3A88C131A76D15F89361F04C96AEC5CCB3D7E63CD5495617

Uniqueness

Uniqueness Score: -1.00%

Function 00414664 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00493C7A,?,00493C9C,?,?,00000000,00493C7A,?,?), ref: 00414683

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406EF0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F04

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 40425b31f0ec640c18ddcb78be3e55b822cb08b158dc6e4ae361f559f5ed5b54
Instruction ID: ed594690980f0b5f749549f30e626d7cb87cd300e09a0a62f3fcac7d4de2953c
Opcode Fuzzy Hash: 40425b31f0ec640c18ddcb78be3e55b822cb08b158dc6e4ae361f559f5ed5b54
Instruction Fuzzy Hash: 5ED05B723081517AD620965B6C44DA76BDCCBC5770F11063EB558C71C1D7309C01C675

Uniqueness

Uniqueness Score: -1.00%

Function 00423634 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235E0: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 004235F5

ShowWindow.USER32(00410638,00000009,?,00000000,0041ED8C,00423922,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF4), ref: 0042364F

Part of subcall function 00423610: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 0042362C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 0d90630d2143e46b18c8a60820b4ab49d7b429b2eaff1a7007acf1abc1a248b7
Instruction ID: 3eb7055ac12859cbecf3d9f3790dfcfbd6e4d25ea45e4068840f1ef7bf75342a
Opcode Fuzzy Hash: 0d90630d2143e46b18c8a60820b4ab49d7b429b2eaff1a7007acf1abc1a248b7
Instruction Fuzzy Hash: 5CD0A7127412303147303EB73845A8B42BC8DD22E7388083BB594DB303E95E8E2160BC

Uniqueness

Uniqueness Score: -1.00%

Function 004242AC Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242C4

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 44f4bf60a6268f42869e724316491ef1b3dbbdca32bc4fa16397d996f2648b9e
Instruction ID: 42294534ecb032ec94791ea22e974ca5a67e3c3b36f223f16e8b1d4149264d5b
Opcode Fuzzy Hash: 44f4bf60a6268f42869e724316491ef1b3dbbdca32bc4fa16397d996f2648b9e
Instruction Fuzzy Hash: FED05EE27011302BCB01BAEE94C4AC677CC8F8825AB1940BBF904EF257C638CE408398

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD10 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00451FB5,00000000,00451FCE,?,-00000001,00000000), ref: 0042CD1B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 00cd4d526169162714089faf3c2d31c52375fef6ef97b921d872ec83065b5ae4
Instruction ID: 85c903b9819389447db47cabe598ea32cd43c08ec1317ecb8d8aeb462e0124e3
Opcode Fuzzy Hash: 00cd4d526169162714089faf3c2d31c52375fef6ef97b921d872ec83065b5ae4
Instruction Fuzzy Hash: 0BD022E032124006EB1058BC28C430F06888B00336F940F33B9A4E72E3E63D8C032409

Uniqueness

Uniqueness Score: -1.00%

Function 0042CCC8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0045092B,00000000), ref: 0042CCD3

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 02c553454b8990baccb1f9e4a7e0e27d7b8954f3fd4444bea42a88bd657d8c57
Instruction ID: 382e2b35769c07ef442e7795505b4c9c9e78e60a45378568269011419efd8913
Opcode Fuzzy Hash: 02c553454b8990baccb1f9e4a7e0e27d7b8954f3fd4444bea42a88bd657d8c57
Instruction Fuzzy Hash: 95C08CE13022005A9A1469BE2CC510F02C8991623A3A41F37F42EE33D3D23E88266018

Uniqueness

Uniqueness Score: -1.00%

Function 00406EA0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A8AC,0040CE58,?,00000000,?), ref: 00406EBD

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 39ed601fec6ab7f73062d47eae4b79688b207d415561d85b0c36b11bf5f2fc16
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: 39ed601fec6ab7f73062d47eae4b79688b207d415561d85b0c36b11bf5f2fc16
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Uniqueness

Uniqueness Score: -1.00%

Function 00407288 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,004960B6,00000000,00496289,?,?,00000005,00000000,004962BD,?,?,00000000), ref: 00407293

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: ed1ea361e46f82de3300f70bff64bec8ccf886368909cfc5f5d620eac69d27dc
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: ed1ea361e46f82de3300f70bff64bec8ccf886368909cfc5f5d620eac69d27dc
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Uniqueness

Uniqueness Score: -1.00%

Function 0044FC8C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045B6DE,00000000,0045B869,?,00000000,00000002,00000002), ref: 0044FC93

Part of subcall function 0044FA14: GetLastError.KERNEL32(0044F830,0044FAD6,?,00000000,?,00496128,00000001,00000000,00000002,00000000,00496289,?,?,00000005,00000000,004962BD), ref: 0044FA17

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: e3cf67ab4b6e40e7819944c2f6f380abdb95ad3600b9c69ef1af1eeb7ca1aef4
Instruction ID: 7cad1cb3ee1d8c7f2b9b2e251431728f1ca512253c074887a732f5b9ba6e5bcc
Opcode Fuzzy Hash: e3cf67ab4b6e40e7819944c2f6f380abdb95ad3600b9c69ef1af1eeb7ca1aef4
Instruction Fuzzy Hash: 98C04CA1700500479F00EABE95C1A0763D86E492093154076B908DF206D7A9D8044A64

Uniqueness

Uniqueness Score: -1.00%

Function 0042E2EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E30D), ref: 0042E300

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c4c75b97e794bf3e7428fda086cab8c8c6a3d736d300e5b7c1b12c9a84fa82a5
Instruction ID: 5e1f02edd2daef0d1c6838a3ccb2c9194eea22d206507ab6d3fb1b5250f91bea
Opcode Fuzzy Hash: c4c75b97e794bf3e7428fda086cab8c8c6a3d736d300e5b7c1b12c9a84fa82a5
Instruction Fuzzy Hash: F4B09B7670C6005EF705D695B45552D63D4D7C57203E14577F450D3580D53D58004D18

Uniqueness

Uniqueness Score: -1.00%

Function 0047B6F4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,0047FBAA), ref: 0047B70A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 28451687c9f344d0a6a3171dca05091381570a9474716c83e7901274477f7d0f
Instruction ID: d155bc4f7bfe153fd99757916dc65dc3267ba95aede6d2fa87ac874fe3ade3de
Opcode Fuzzy Hash: 28451687c9f344d0a6a3171dca05091381570a9474716c83e7901274477f7d0f
Instruction Fuzzy Hash: AFC0EAB15602048AC744AB79BA4876636E4E768205F04893BA404C6263E7388448FF9C

Uniqueness

Uniqueness Score: -1.00%

Function 0047FDE8 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 0047FDF0

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8bbcd2fbf22ae0b83bb4c9f326133e0f8d9324876a54d3bbebc81ad4b08b1697
Instruction ID: 99d67813a2b21335afc3d4281e01727494b67aba3c321737ecd4854f4d206f17
Opcode Fuzzy Hash: 8bbcd2fbf22ae0b83bb4c9f326133e0f8d9324876a54d3bbebc81ad4b08b1697
Instruction Fuzzy Hash: 5EA002343D530570F470A2514D03F5400001744F15EE1405573093D0C304D92428201E

Uniqueness

Uniqueness Score: -1.00%

Function 004165D4 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

73A25CF0.USER32(?), ref: 004165DB

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3740241d42578bd3f9979c0d2458c5210b3601efafd06d73e389bf829649dc9e
Instruction ID: 444a78761fbc6a727879d8c4239369b0bde5fc0390465f01f64749401816922a
Opcode Fuzzy Hash: 3740241d42578bd3f9979c0d2458c5210b3601efafd06d73e389bf829649dc9e
Instruction Fuzzy Hash: CDA002756015049ADE04A7A5C849F662298BB44204FC915F971449B092C53C99008E58

Uniqueness

Uniqueness Score: -1.00%

Function 00447D60 Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a47d6100684c7dce2f17ce202cdcfac6cb4578d4ba2f54fd3f2db530ddf0775
Instruction ID: 6c155f0bab6c330936d6c04dbdbc89a39021285a810b44ae9db73128b74bc4e5
Opcode Fuzzy Hash: 7a47d6100684c7dce2f17ce202cdcfac6cb4578d4ba2f54fd3f2db530ddf0775
Instruction Fuzzy Hash: 8751A774E042459FDB01EFA9C482AAEBBF5EF49304F6041BAE504E7351D7389D46CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0045C334 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 0042C7A8: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C7CC

SetLastError.KERNEL32(00000000,00000000,?,?,00000000,0045C3D4), ref: 0045C3AD

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorFullLastNamePath
String ID:
API String ID: 2157422313-0
Opcode ID: 9b43e45fb6d9d0259774c609c9012f49878f93435d0a2f404fdd771661355698
Instruction ID: 179d5045fa77ac57d8bdea70a70b4a7da7f0c4c47cb5f93157dbf598602a03a0
Opcode Fuzzy Hash: 9b43e45fb6d9d0259774c609c9012f49878f93435d0a2f404fdd771661355698
Instruction Fuzzy Hash: 02117370704308AFDB00DEB5C8C19AEB7ADDB89319F60857ABC04E7782D6789F059655

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3AC Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED8C,?,00423877,00423BF4,0041ED8C), ref: 0041F3CA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c353852e02813b7d23fb318ffadc6e7b05784c4f0baf16d7202792417fe2c6e1
Instruction ID: 062ef65fd22a162953b0f92c10ce6b15da8806ec6157442b2226c44539e8a6c2
Opcode Fuzzy Hash: c353852e02813b7d23fb318ffadc6e7b05784c4f0baf16d7202792417fe2c6e1
Instruction Fuzzy Hash: C0111C742403059BD710DF19C881B86FBE5EF98350B14C53BE9A88B385D374E959CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00452324 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045238D), ref: 0045236F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1bd9aba7eae3ea747001b5beb64755777936e061a820bd5cd2ee0a64b3f9739e
Instruction ID: 5c1c835d6c8d6233c25c25fd279844ad9956aa32c1227f0d88fcdaa3ae4b5161
Opcode Fuzzy Hash: 1bd9aba7eae3ea747001b5beb64755777936e061a820bd5cd2ee0a64b3f9739e
Instruction Fuzzy Hash: 9E0170356046486F8B11DF799C014EEF7E8DB4B32072082B7FC24C3742D6784D059664

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 827a1b883538dfed4e56bd6d9186317dde9c02c408e4bc47c040c509ac29fb8c
Instruction ID: 2f1b12c935ae24389c3dd8db424781fbbcf1746defe36878ea7ad6421184be39
Opcode Fuzzy Hash: 827a1b883538dfed4e56bd6d9186317dde9c02c408e4bc47c040c509ac29fb8c
Instruction Fuzzy Hash: 0C0170766043108FC3109F29DCC4E2677E8D780378F05413EDA84673A0D37A6C0187D9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0044AC90 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044AC3C: GetVersionExA.KERNEL32(00000094), ref: 0044AC59

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044EDAD,00496EEE), ref: 0044ACB7
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044ACCF
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044ACE1
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044ACF3
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044AD05
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044AD17
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044AD29
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044AD3B
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044AD4D
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044AD5F
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044AD71
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044AD83
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044AD95
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044ADA7
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044ADB9
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044ADCB
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044ADDD
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044ADEF
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044AE01
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044AE13
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044AE25
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044AE37
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044AE49
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044AE5B
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044AE6D
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044AE7F
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044AE91
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044AEA3
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044AEB5
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044AEC7
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044AED9
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044AEEB
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044AEFD
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044AF0F
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044AF21
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044AF33
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044AF45
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044AF57
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044AF69
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044AF7B
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044AF8D
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044AF9F
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044AFB1
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044AFC3
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044AFD5
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044AFE7
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044AFF9
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B00B

Strings

SetThemeAppProperties, xrefs: 0044AFBB
EnableTheming, xrefs: 0044B003
GetThemeTextExtent, xrefs: 0044AD45
GetThemePropertyOrigin, xrefs: 0044AE9B
GetThemeSysString, xrefs: 0044AF2B
DrawThemeIcon, xrefs: 0044AD9F
GetThemeSysColorBrush, xrefs: 0044AEE3
IsThemeDialogTextureEnabled, xrefs: 0044AF97
GetThemeBackgroundContentRect, xrefs: 0044AD0F, 0044AD21
HitTestThemeBackground, xrefs: 0044AD7B
GetThemeString, xrefs: 0044ADF9
GetWindowTheme, xrefs: 0044AF73
DrawThemeEdge, xrefs: 0044AD8D
DrawThemeBackground, xrefs: 0044ACEB
uxtheme.dll, xrefs: 0044ACB2
GetThemeMargins, xrefs: 0044AE77
GetThemeSysBool, xrefs: 0044AEF5
IsThemePartDefined, xrefs: 0044ADB1
GetThemeEnumValue, xrefs: 0044AE2F
GetThemeFilename, xrefs: 0044AEBF
GetThemeSysColor, xrefs: 0044AED1
GetThemePartSize, xrefs: 0044AD33
GetThemeDocumentationProperty, xrefs: 0044AFDF
GetThemeColor, xrefs: 0044ADD5
GetThemeIntList, xrefs: 0044AE89
DrawThemeText, xrefs: 0044ACFD
GetThemeSysSize, xrefs: 0044AF07
CloseThemeData, xrefs: 0044ACD9
GetThemeSysFont, xrefs: 0044AF19
GetThemeFont, xrefs: 0044AE53
SetWindowTheme, xrefs: 0044AEAD
OpenThemeData, xrefs: 0044ACC7
IsThemeBackgroundPartiallyTransparent, xrefs: 0044ADC3
EnableThemeDialogTexture, xrefs: 0044AF85
GetThemeInt, xrefs: 0044AE1D
GetThemeRect, xrefs: 0044AE65
GetThemeMetric, xrefs: 0044ADE7
GetThemeBackgroundRegion, xrefs: 0044AD69
IsThemeActive, xrefs: 0044AF4F
GetThemeTextMetrics, xrefs: 0044AD57
GetThemeAppProperties, xrefs: 0044AFA9
GetThemeSysInt, xrefs: 0044AF3D
IsAppThemed, xrefs: 0044AF61
GetThemePosition, xrefs: 0044AE41
DrawThemeParentBackground, xrefs: 0044AFF1
GetThemeBool, xrefs: 0044AE0B
GetCurrentThemeName, xrefs: 0044AFCD

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 111ed31fbbed814d086d94ce9738d7a3fbd2a93d83e05be07ff6902d19647fb1
Instruction ID: e873c06371e544aec880cc9e7e253fc2a2b57b134205f7af049f3e6e3373eac0
Opcode Fuzzy Hash: 111ed31fbbed814d086d94ce9738d7a3fbd2a93d83e05be07ff6902d19647fb1
Instruction Fuzzy Hash: 0F91D7B0A40B50EBEF00EFF598C6A2636A8EB15B1471445BBB444EF295D778C8148F9E

Uniqueness

Uniqueness Score: -1.00%

Function 00457964 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004579CB
QueryPerformanceCounter.KERNEL32(00000000,00000000,00457C5E,?,?,00000000,00000000,?,0045835A,?,00000000,00000000), ref: 004579D4
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 004579DE
GetCurrentProcessId.KERNEL32(?,00000000,00000000,00457C5E,?,?,00000000,00000000,?,0045835A,?,00000000,00000000), ref: 004579E7
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00457A5D
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 00457A6B
CreateFileA.KERNEL32(00000000,C0000000,00000000,00498AF0,00000003,00000000,00000000,00000000,00457C1A), ref: 00457AB3
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00457C09,?,00000000,C0000000,00000000,00498AF0,00000003,00000000,00000000,00000000,00457C1A), ref: 00457AEC

Part of subcall function 0042D868: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D87B

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00457B95
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 00457BCB
CloseHandle.KERNEL32(000000FF,00457C10,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00457C03

Part of subcall function 004527FC: GetLastError.KERNEL32(00000000,0045326D,00000005,00000000,004532A2,?,?,00000000,0049A628,00000004,00000000,00000000,00000000,?,004966A1,00000000), ref: 004527FF

Strings

Helper process PID: %u, xrefs: 00457BE8
i, xrefs: 00457B48
helper %d 0x%x, xrefs: 00457B74
SetNamedPipeHandleState, xrefs: 00457AF5
Starting 64-bit helper process., xrefs: 00457999
CreateFile, xrefs: 00457AC1
CreateProcess, xrefs: 00457B9E
Cannot utilize 64-bit features on this version of Windows, xrefs: 004579AC
64-bit helper EXE wasn't extracted, xrefs: 004579BF
CreateNamedPipe, xrefs: 00457A7B
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00457A33
D, xrefs: 00457B0E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 3057b9778142a9d47e5776bd957cbb58752ce65e509059b258d6a9aca3cfe1b9
Instruction ID: cbc5723897a0f2a07f719688631d968a8430a29c6042ca87ccf4042f92a9acd7
Opcode Fuzzy Hash: 3057b9778142a9d47e5776bd957cbb58752ce65e509059b258d6a9aca3cfe1b9
Instruction Fuzzy Hash: F8713570A043449EDB11DB69DC45B9E7BF8EF05705F1084BAF908EB282D77859488F69

Uniqueness

Uniqueness Score: -1.00%

Function 00476C24 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00476A90: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02152C1C,?,?,?,02152C1C,00476C54,00000000,00476D72,?,?,-00000010,?), ref: 00476AA9
Part of subcall function 00476A90: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00476AAF
Part of subcall function 00476A90: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02152C1C,?,?,?,02152C1C,00476C54,00000000,00476D72,?,?,-00000010,?), ref: 00476AC2
Part of subcall function 00476A90: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02152C1C,?,?,?,02152C1C), ref: 00476AEC
Part of subcall function 00476A90: CloseHandle.KERNEL32(00000000,?,?,?,02152C1C,00476C54,00000000,00476D72,?,?,-00000010,?), ref: 00476B0A

Part of subcall function 00476B68: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00476BFA,?,?,?,02152C1C,?,00476C5C,00000000,00476D72,?,?,-00000010,?), ref: 00476B98

ShellExecuteEx.SHELL32(0000003C), ref: 00476CAC
GetLastError.KERNEL32(00000000,00476D72,?,?,-00000010,?), ref: 00476CB5
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00476D02
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00476D26
CloseHandle.KERNEL32(00000000,00476D57,00000000,00000000,000000FF,000000FF,00000000,00476D50,?,00000000,00476D72,?,?,-00000010,?), ref: 00476D4A

Strings

runas, xrefs: 00476C79
<, xrefs: 00476C6B
ShellExecuteEx returned hProcess=0, xrefs: 00476CD6
GetExitCodeProcess, xrefs: 00476D2F
MsgWaitForMultipleObjects, xrefs: 00476D0F
ShellExecuteEx, xrefs: 00476CC6

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 2b574eda821b69c0285d99beace6bd1ffa90e8a3a1b156e4ae3bb15aa3f5b924
Instruction ID: e9ac78ae47e2a1bfc0de8969dd6c35abcfabf79e25726a482db63fcde1fa084f
Opcode Fuzzy Hash: 2b574eda821b69c0285d99beace6bd1ffa90e8a3a1b156e4ae3bb15aa3f5b924
Instruction Fuzzy Hash: 34315670A10A04AFDB20EFAAC841ADEB6BAEF09314F51843FF518F7281D77C59058B59

Uniqueness

Uniqueness Score: -1.00%

Function 00422844 Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229DC
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BA6), ref: 004229EC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 1ecfac3ca97b0b4a949e47ba188603469d90dd7e7a86cdf445ee655ae4f958de
Instruction ID: fc67541ccd5e3f21e0a5e7c2d8678ac64681ee96f0cd53918d0111b08ac536aa
Opcode Fuzzy Hash: 1ecfac3ca97b0b4a949e47ba188603469d90dd7e7a86cdf445ee655ae4f958de
Instruction Fuzzy Hash: 2491A371B00214FFD710EFA9DA86F9D77F4AB14314F5500BAF904AB2A2C778AE509B48

Uniqueness

Uniqueness Score: -1.00%

Function 0041836C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041837B
GetWindowPlacement.USER32(?,0000002C), ref: 00418398
GetWindowRect.USER32(?), ref: 004183B4
GetWindowLongA.USER32(?,000000F0), ref: 004183C2
GetWindowLongA.USER32(?,000000F8), ref: 004183D7
ScreenToClient.USER32(00000000), ref: 004183E0
ScreenToClient.USER32(00000000,?), ref: 004183EB

Strings

,, xrefs: 00418384

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 4f621163f7cce10786236a9b2c87fbc668bc00eae7ed2980a59d20c9595f6243
Instruction ID: 8e00dd0e9fae7d00a70de0a9eb7d06473ca5d3657d946ea25b8c80b3eee2cba3
Opcode Fuzzy Hash: 4f621163f7cce10786236a9b2c87fbc668bc00eae7ed2980a59d20c9595f6243
Instruction Fuzzy Hash: 2F111971505201ABDB00DF69C885F9B77E8AF49314F18067EBD58DB286D739D900CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00454800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0045480F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00454815
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0045482E
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00454855
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045485A
ExitWindowsEx.USER32(00000002,00000000), ref: 0045486B

Strings

SeShutdownPrivilege, xrefs: 00454827

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 9f12b05955e9865352e5e16aac1b91cca1ef6bf1783eb5784e2c129517685510
Instruction ID: d22182a0dc1ba8f0c6642c383eecb50a1605a48a6cde18e86443e4a87f87f347
Opcode Fuzzy Hash: 9f12b05955e9865352e5e16aac1b91cca1ef6bf1783eb5784e2c129517685510
Instruction Fuzzy Hash: 96F0C234284742B5E610BA728C03F2B21C89B84B4DF40483ABE04EE1C3D7BDC48C8A6E

Uniqueness

Uniqueness Score: -1.00%

Function 004963A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004964DE,?,?,00000000,0049A628,?,00496668,00000000,004966BC,?,?,00000000,0049A628), ref: 004963F7
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049647A
FindNextFileA.KERNEL32(000000FF,?,00000000,004964B6,?,00000000,?,00000000,004964DE,?,?,00000000,0049A628,?,00496668,00000000), ref: 00496492
FindClose.KERNEL32(000000FF,004964BD,004964B6,?,00000000,?,00000000,004964DE,?,?,00000000,0049A628,?,00496668,00000000,004966BC), ref: 004964B0

Strings

isRS-, xrefs: 00496417
isRS-???.tmp, xrefs: 004963E1

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 7738e32335345fb7bbeb768ae5485bc4fd1f5e0e970c21979f7916f2e447ebda
Instruction ID: daa5b125c80c46eb5aeb9150060b7ac6d6724199db2123f663f7f6175ded04fd
Opcode Fuzzy Hash: 7738e32335345fb7bbeb768ae5485bc4fd1f5e0e970c21979f7916f2e447ebda
Instruction Fuzzy Hash: 7431A671900618AFDF10EFA5CC51ADEBBBCDB45304F5184FBA808A32A1DB3C9E458E58

Uniqueness

Uniqueness Score: -1.00%

Function 004563D8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00456455
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 0045647C
SetForegroundWindow.USER32(?), ref: 0045648D
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00456767,?,00000000,004567A3), ref: 00456752

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 004565D2

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 896b8276837c36a5a7ca6e6e3a564c6ec1eebcff49fe20f5ea153735f6c121fd
Instruction ID: cd98618036c15ebced57857b8283fe4cd0e8cc10ae145455f7924607e19dc4d8
Opcode Fuzzy Hash: 896b8276837c36a5a7ca6e6e3a564c6ec1eebcff49fe20f5ea153735f6c121fd
Instruction Fuzzy Hash: 2B910034204204EFD715CF65D961F5ABBF9EB89304F6280BAEC0897796C738AE14CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00455028 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,0045515C), ref: 00455058
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045505E

Strings

kernel32.dll, xrefs: 00455053
GetDiskFreeSpaceExA, xrefs: 0045504E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 5cf265212c98e08974fa2c9ffa44d5e56c15a6230db81482d5f218b41770483f
Instruction ID: 6cd16e2f3334a9298e1a0ee5254b0e49d2338a248bd2fb4c2a62f91a328bc87d
Opcode Fuzzy Hash: 5cf265212c98e08974fa2c9ffa44d5e56c15a6230db81482d5f218b41770483f
Instruction Fuzzy Hash: 49316271A04649AFCF01EFA5C892AEFBBB8EF49704F504566F800F7292D6785D09CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00417CB8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417CF7
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D15
GetWindowPlacement.USER32(?,0000002C), ref: 00417D4B
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D72

Strings

,, xrefs: 00417D39

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 313044823fb38f3fa02beead4641d87f4897e07155ed098977559df4b6b69d3c
Instruction ID: 4ba590ad5f6c0082faa53a539b4b44f7335d6320e6e7e16f5c0daa0b31dd7885
Opcode Fuzzy Hash: 313044823fb38f3fa02beead4641d87f4897e07155ed098977559df4b6b69d3c
Instruction Fuzzy Hash: B4214C716002089BCF00EF69D8C1AEA77B8AF48314F15456AFD18EF246D738E944CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00463080 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0046323D), ref: 004630B1
FindFirstFileA.KERNEL32(00000000,?,00000000,00463210,?,00000001,00000000,0046323D), ref: 00463140
FindNextFileA.KERNEL32(000000FF,?,00000000,004631F2,?,00000000,?,00000000,00463210,?,00000001,00000000,0046323D), ref: 004631D2
FindClose.KERNEL32(000000FF,004631F9,004631F2,?,00000000,?,00000000,00463210,?,00000001,00000000,0046323D), ref: 004631EC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 5df0d70be7091815c299656cc156062e5c17e5c48fb28ac685e6a925f5c91df9
Instruction ID: 51d011e3085209f7c5c020f5fea4c8b8a4008406e7ff7f86e47956500c51889f
Opcode Fuzzy Hash: 5df0d70be7091815c299656cc156062e5c17e5c48fb28ac685e6a925f5c91df9
Instruction Fuzzy Hash: 63418334A006589FCB11EFA5CC55ADEB7B8EB89705F4044BAF404AB351E63C9E488E19

Uniqueness

Uniqueness Score: -1.00%

Function 004634FC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,004636E3), ref: 00463571
FindFirstFileA.KERNEL32(00000000,?,00000000,004636AE,?,00000001,00000000,004636E3), ref: 004635B7
FindNextFileA.KERNEL32(000000FF,?,00000000,00463690,?,00000000,?,00000000,004636AE,?,00000001,00000000,004636E3), ref: 0046366C
FindClose.KERNEL32(000000FF,00463697,00463690,?,00000000,?,00000000,004636AE,?,00000001,00000000,004636E3), ref: 0046368A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: cf3317ff5f623fa91e385a3974b40ba0a72d840c00e9d7b4d35ba9997034062e
Instruction ID: e3e7d7d146f39441d275d713e2300d04520d9181d0f834714dcddbf087e38057
Opcode Fuzzy Hash: cf3317ff5f623fa91e385a3974b40ba0a72d840c00e9d7b4d35ba9997034062e
Instruction Fuzzy Hash: 31416334A00658AFCB10EF65CC859DEB7B9EB88315F4044AAF804E7351E6389F448E59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E780 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,0045229F,00000000,004522C0), ref: 0042E7A2
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E7CD
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,0045229F,00000000,004522C0), ref: 0042E7DA
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,0045229F,00000000,004522C0), ref: 0042E7E2
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,0045229F,00000000,004522C0), ref: 0042E7E8

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 2575b24a487bd9c60359ed98a2ddbf115c0fddf5915b768deb900ebedde3cc1d
Instruction ID: 65b738c2e8fcf112644c65c0370d7c2478d80d9d3fed66bb8c9c92dcd2a8bb58
Opcode Fuzzy Hash: 2575b24a487bd9c60359ed98a2ddbf115c0fddf5915b768deb900ebedde3cc1d
Instruction Fuzzy Hash: 66F090713917203AF620B17A6C87F7B418CC7C5B68F20823ABB04FF1C1D9A85D05566D

Uniqueness

Uniqueness Score: -1.00%

Function 00481878 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004818B6
GetWindowLongA.USER32(00000000,000000F0), ref: 004818D4
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049B048,00480FD2,00481006,00000000,00481026,?,?,00000001,0049B048), ref: 004818F6
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049B048,00480FD2,00481006,00000000,00481026,?,?,00000001,0049B048), ref: 0048190A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 067afcea2d6ac4c5c16c8fa3ffec3e60ae2b2dc2dfb0d1ed73204545109cf916
Instruction ID: 164b5435562b59e9214fd0687e1a2fb6042f3c4fdfd765628f65074261dbbca4
Opcode Fuzzy Hash: 067afcea2d6ac4c5c16c8fa3ffec3e60ae2b2dc2dfb0d1ed73204545109cf916
Instruction Fuzzy Hash: EB015E706443449BE610B7259D86B5B379AAB20355F08087BF8549B2B3DB2D8C86D74C

Uniqueness

Uniqueness Score: -1.00%

Function 00461AF4 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00461BC8), ref: 00461B4C
FindNextFileA.KERNEL32(000000FF,?,00000000,00461BA8,?,00000000,?,00000000,00461BC8), ref: 00461B88
FindClose.KERNEL32(000000FF,00461BAF,00461BA8,?,00000000,?,00000000,00461BC8), ref: 00461BA2

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 10ae389aa8eda6f9da4e8462ae9d62ec88210981052173b0d2e94525ae0ddab7
Instruction ID: 295f6414b0ac18d21f375fa046b740f49dd63bf5bdd88d17ec308823c3923ea1
Opcode Fuzzy Hash: 10ae389aa8eda6f9da4e8462ae9d62ec88210981052173b0d2e94525ae0ddab7
Instruction Fuzzy Hash: 1721D8719046486EDB11DB65CC41ADEBBBCDB49B04F5484F7E808E22B1F638AE44CA59

Uniqueness

Uniqueness Score: -1.00%

Function 004241C4 Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241CC
SetActiveWindow.USER32(?,?,?,0046BA06), ref: 004241D9

Part of subcall function 00423634: ShowWindow.USER32(00410638,00000009,?,00000000,0041ED8C,00423922,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF4), ref: 0042364F

Part of subcall function 00423AFC: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021525AC,004241F2,?,?,?,0046BA06), ref: 00423B37

SetFocus.USER32(00000000,?,?,?,0046BA06), ref: 00424206

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 0813d656e208765eb4577b429de9ff5a5822faad21b9b01c56935e206671145a
Instruction ID: 2e17e55d4d49f577383169e840a99395ce9ac4d02c6205d7e93ced2c410d8cb1
Opcode Fuzzy Hash: 0813d656e208765eb4577b429de9ff5a5822faad21b9b01c56935e206671145a
Instruction Fuzzy Hash: 1DF03071B0011087CB10EFBAA8C5B9662A8AF08305B5500BBBC04DF35BCABCDC018768

Uniqueness

Uniqueness Score: -1.00%

Function 00417CB6 Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417CF7
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D15
GetWindowPlacement.USER32(?,0000002C), ref: 00417D4B
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D72

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 1de80fc212659f48c3b882786dabb94969733f860b19e1fd336b33f5ef639fd7
Instruction ID: faa5eda2f2d0100deff86a1e04467dadc9dfb8972efa308103d054071ab7126a
Opcode Fuzzy Hash: 1de80fc212659f48c3b882786dabb94969733f860b19e1fd336b33f5ef639fd7
Instruction Fuzzy Hash: B6012131304108ABDB10EE69DCC1EEB77A8AF54364F254566FD09DF246E635DC8087A8

Uniqueness

Uniqueness Score: -1.00%

Function 00417580 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175AB
GetCapture.USER32 ref: 004175B4

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 9fa7ad8e735ab47da374aafe03c9a3e39808f5e3d417cf14708240a684c01214
Instruction ID: adf900500f1a92f4db3d9ed622088904c48d054dd6ffc893bbaea821dd9f99c1
Opcode Fuzzy Hash: 9fa7ad8e735ab47da374aafe03c9a3e39808f5e3d417cf14708240a684c01214
Instruction Fuzzy Hash: 2BF0447230460197D720972EC885AABA2F69F54358B14483FE419CBB65EF78DCC5C658

Uniqueness

Uniqueness Score: -1.00%

Function 0042417C Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424183

Part of subcall function 00423A6C: EnumWindows.USER32(00423A04), ref: 00423A90
Part of subcall function 00423A6C: GetWindow.USER32(?,00000003), ref: 00423AA5
Part of subcall function 00423A6C: GetWindowLongA.USER32(?,000000EC), ref: 00423AB4
Part of subcall function 00423A6C: SetWindowPos.USER32(00000000,DAB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,00424193,?,?,00423D5B), ref: 00423AEA

SetActiveWindow.USER32(?,?,?,00423D5B,00000000,00424144), ref: 00424197

Part of subcall function 00423634: ShowWindow.USER32(00410638,00000009,?,00000000,0041ED8C,00423922,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423BF4), ref: 0042364F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 78ece0345a7cd31a22b2d760cecbaad42da577f57e993de622359aa812c494f0
Instruction ID: f72361d06d6ff6bb4de0be6d743e001fb5ac554c06dcc4dcc480d84dbee30593
Opcode Fuzzy Hash: 78ece0345a7cd31a22b2d760cecbaad42da577f57e993de622359aa812c494f0
Instruction Fuzzy Hash: 21E01A6130110087EF00AF69DCC8B9672A8BF58304F55057ABC48CF24BD67CC8508B24

Uniqueness

Uniqueness Score: -1.00%

Function 004125C0 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127BD), ref: 004127AB

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 6a4d6f569406c754de17483a25dbf391754f82b0155115fc65b172beaa3d303a
Instruction ID: 297e1b5ad5723169633700e987f27ec23561a0b219fe5327fd799413d7829d4a
Opcode Fuzzy Hash: 6a4d6f569406c754de17483a25dbf391754f82b0155115fc65b172beaa3d303a
Instruction Fuzzy Hash: E1512631204245CFDB14DB6AD680A9BF3E1EF94314B2482BBD854C37A1D7B8EDA1C748

Uniqueness

Uniqueness Score: -1.00%

Function 004771E0 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0047732E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 00db6fdff46db94656172b0de1a0eb2c5b74125bd7b5d9b5ba8fecf8895d20cc
Instruction ID: 280af59a5ae85b10fa16546922e42e294d04fa874ca4da03d5a859b113da40c5
Opcode Fuzzy Hash: 00db6fdff46db94656172b0de1a0eb2c5b74125bd7b5d9b5ba8fecf8895d20cc
Instruction Fuzzy Hash: DF414A35608105DFDB10CF99D6848AAB7F5EB48314BB4C992F848DB702D338EE41EB98

Uniqueness

Uniqueness Score: -1.00%

Function 00457190 Relevance: 45.7, APIs: 11, Strings: 15, Instructions: 237filesynchronizationprocessCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00498AE4,00000001,00000000,00000000,004574C5,?,?,?,00000001,?,004576DF,00000000,004576F5,?,00000000,0049A628), ref: 004571DD
CreateFileMappingA.KERNEL32(000000FF,00498AE4,00000004,00000000,00002018,00000000), ref: 00457215
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00002018,00000000,0045749B,?,00498AE4,00000001,00000000,00000000,004574C5,?,?,?), ref: 0045723C
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00457349
ReleaseMutex.KERNEL32(00000000,00000000,00000002,00000000,00000000,00002018,00000000,0045749B,?,00498AE4,00000001,00000000,00000000,004574C5), ref: 004572A1

Part of subcall function 004527FC: GetLastError.KERNEL32(00000000,0045326D,00000005,00000000,004532A2,?,?,00000000,0049A628,00000004,00000000,00000000,00000000,?,004966A1,00000000), ref: 004527FF

CloseHandle.KERNEL32(004576DF,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00457360
WaitForSingleObject.KERNEL32(00000000,000000FF,004576DF,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00457399
GetLastError.KERNEL32(00000000,000000FF,004576DF,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004573AB
UnmapViewOfFile.KERNEL32(00000000,004574A2,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045747D
CloseHandle.KERNEL32(00000000,004574A2,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045748C
CloseHandle.KERNEL32(00000000,004574A2,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00457495

Strings

ReleaseMutex, xrefs: 004572AA
REGDLL mutex wait failed (%d, %d), xrefs: 004573BF
D, xrefs: 0045730A
CreateProcess, xrefs: 00457352
Spawning _RegDLL.tmp, xrefs: 004571BC
REGDLL returned unknown result code %d, xrefs: 0045745C
_RegDLL.tmp %u %u, xrefs: 004572F1
CreateMutex, xrefs: 004571EB
REGDLL failed with exit code 0x%x, xrefs: 00457389
_isetup\_RegDLL.tmp, xrefs: 004572C7
GetProcAddress, xrefs: 00457409
OleInitialize, xrefs: 004573E5
MapViewOfFile, xrefs: 0045724A
LoadLibrary, xrefs: 004573F7
CreateFileMapping, xrefs: 00457223

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseCreateFileHandle$ErrorLastMutexView$MappingObjectProcessReleaseSingleUnmapWait
String ID: CreateFileMapping$CreateMutex$CreateProcess$D$GetProcAddress$LoadLibrary$MapViewOfFile$OleInitialize$REGDLL failed with exit code 0x%x$REGDLL mutex wait failed (%d, %d)$REGDLL returned unknown result code %d$ReleaseMutex$Spawning _RegDLL.tmp$_RegDLL.tmp %u %u$_isetup\_RegDLL.tmp
API String ID: 4012871263-351310198
Opcode ID: 69f9d80aaefda94ec4048cb76ff889bb810db726632eeb7575c5da9e659d5a69
Instruction ID: 870ad647c48dc3efa25840664050ee9e4fa5cab4438307bec821336cb5c74a63
Opcode Fuzzy Hash: 69f9d80aaefda94ec4048cb76ff889bb810db726632eeb7575c5da9e659d5a69
Instruction Fuzzy Hash: 66917270A042199BDB10EBA9D845B9EBBB5FB09305F10857BF814EB383D7789908CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041F100 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FD8,00000000,?,?,?,00000001), ref: 0041F10E
SetErrorMode.KERNEL32(00008000,?,00418FD8,00000000,?,?,?,00000001), ref: 0041F12A
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FD8,00000000,?,?,?,00000001), ref: 0041F136
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FD8,00000000,?,?,?,00000001), ref: 0041F144
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F174
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F19D
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1B2
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1C7
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1DC
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F1F1
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F206
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F21B
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F230
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F245
FreeLibrary.KERNEL32(00000001,?,00418FD8,00000000,?,?,?,00000001), ref: 0041F257

Strings

Ctl3dUnregister, xrefs: 0041F192
Ctl3DColorChange, xrefs: 0041F225
Ctl3dSubclassCtl, xrefs: 0041F1A7
BtnWndProc3d, xrefs: 0041F23A
Ctl3dUnAutoSubclass, xrefs: 0041F210
Ctl3dAutoSubclass, xrefs: 0041F1FB
CTL3D32.DLL, xrefs: 0041F131
Ctl3dCtlColorEx, xrefs: 0041F1E6
Ctl3dDlgFramePaint, xrefs: 0041F1D1
Ctl3dSubclassDlgEx, xrefs: 0041F1BC
Ctl3dRegister, xrefs: 0041F169

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 09bcde8f8c14dc6a96cfe52cdaa2ec27e2ae249a5f895ff3cdc8ff0d6ba17e35
Instruction ID: e75ef8e9785ca8da0ec2f52b361472fa3148a28f62a6d5e7c99c44d7bde1c01c
Opcode Fuzzy Hash: 09bcde8f8c14dc6a96cfe52cdaa2ec27e2ae249a5f895ff3cdc8ff0d6ba17e35
Instruction Fuzzy Hash: 2E3130B0600700EBDF00EBB9AC86A653294F729724B45093FB644DB1A2DB7E485ECB1C

Uniqueness

Uniqueness Score: -1.00%

Function 0041C9F4 Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,0041A92C,?), ref: 0041CA28
73A24C40.GDI32(?,00000000,?,0041A92C,?), ref: 0041CA34
73A26180.GDI32(0041A92C,?,00000001,00000001,00000000,00000000,0041CC4A,?,?,00000000,?,0041A92C,?), ref: 0041CA58
73A24C00.GDI32(?,0041A92C,?,00000000,0041CC4A,?,?,00000000,?,0041A92C,?), ref: 0041CA68
SelectObject.GDI32(0041CE24,00000000), ref: 0041CA83
FillRect.USER32(0041CE24,?,?), ref: 0041CABE
SetTextColor.GDI32(0041CE24,00000000), ref: 0041CAD3
SetBkColor.GDI32(0041CE24,00000000), ref: 0041CAEA
PatBlt.GDI32(0041CE24,00000000,00000000,0041A92C,?,00FF0062), ref: 0041CB00
73A24C40.GDI32(?,00000000,0041CC03,?,0041CE24,00000000,?,0041A92C,?,00000000,0041CC4A,?,?,00000000,?,0041A92C), ref: 0041CB13
SelectObject.GDI32(00000000,00000000), ref: 0041CB44
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CBF2,?,?,00000000,0041CC03,?,0041CE24,00000000,?,0041A92C), ref: 0041CB5C
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBF2,?,?,00000000,0041CC03,?,0041CE24,00000000,?), ref: 0041CB65
73A18830.GDI32(0041CE24,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBF2,?,?,00000000,0041CC03), ref: 0041CB74
73A122A0.GDI32(0041CE24,0041CE24,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CBF2,?,?,00000000,0041CC03), ref: 0041CB7D
SetTextColor.GDI32(00000000,00000000), ref: 0041CB96
SetBkColor.GDI32(00000000,00000000), ref: 0041CBAD
73A24D40.GDI32(0041CE24,00000000,00000000,0041A92C,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CBF2,?,?,00000000), ref: 0041CBC9
SelectObject.GDI32(00000000,?), ref: 0041CBD6
DeleteDC.GDI32(00000000), ref: 0041CBEC

Part of subcall function 0041A040: GetSysColor.USER32(?), ref: 0041A04A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Color$ObjectSelect$A122A18830Text$A26180A570DeleteFillRect
String ID:
API String ID: 1381628555-0
Opcode ID: de79c7301e96d263e04f76b1d1fff43ddd2212d67a81a1b169251bf9af5b21e9
Instruction ID: 93eb53f71a61efd942bda77c34e7880863c2c581daf8b9aec5ac9681a14449cf
Opcode Fuzzy Hash: de79c7301e96d263e04f76b1d1fff43ddd2212d67a81a1b169251bf9af5b21e9
Instruction Fuzzy Hash: 2961E071A44604ABDF10EBE9DC86F9FB7B8EF48704F11446AF504F7281D67CA9408B69

Uniqueness

Uniqueness Score: -1.00%

Function 004966CC Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00496A64,?,?,00000000,?,00000000,00000000,?,00496E1B,00000000,00496E25,?,00000000), ref: 0049674F
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00496A64,?,?,00000000,?,00000000,00000000,?,00496E1B,00000000), ref: 00496762
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00496A64,?,?,00000000,?,00000000,00000000), ref: 00496772
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00496793
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00496A64,?,?,00000000,?,00000000), ref: 004967A3

Part of subcall function 0042D3F0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D47E,?,?,?,00000001,?,004551E6,00000000,0045524E), ref: 0042D425

Strings

/REGU, xrefs: 00496725
Inno-Setup-RegSvr-Mutex, xrefs: 00496759
.lst, xrefs: 004967E0
%nI, xrefs: 004966F1, 004966FE, 00496715, 00496722, 004967B6, 004967C0, 004967D0, 004967DA
/REG, xrefs: 00496701
Setup, xrefs: 0049673B
\nI, xrefs: 004967DD, 004967EA, 004969E5, 0049683B
.msg, xrefs: 004967C6

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: %nI$.lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup$\nI
API String ID: 2000705611-3190912533
Opcode ID: feb6d383c75c909080d42dff72f8ff305d9aa4da533b2c0cc3af33c9472a46d1
Instruction ID: 74d9bb5db5280eacafb3ef6f241a34103ccd942b60a8231a3b4c95495beefe54
Opcode Fuzzy Hash: feb6d383c75c909080d42dff72f8ff305d9aa4da533b2c0cc3af33c9472a46d1
Instruction Fuzzy Hash: 2B91B470A046049FDF11EBA5D852BAF7BA4EF49308F528477F800AB692D67C9C05CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00459A74 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459D30,?,?,?,?,?,00000006,?,00000000,00495AFB,?,00000000,00495B9E), ref: 00459BE2

Strings

.lnk, xrefs: 00459B4F
Failed to delete the file; it may be in use (%d)., xrefs: 00459CD1
Stripped read-only attribute., xrefs: 00459BBB
.chw, xrefs: 00459B29
The file appears to be in use (%d). Will delete on restart., xrefs: 00459C2B
Failed to strip read-only attribute., xrefs: 00459BC7
.chm, xrefs: 00459B10
.gid, xrefs: 00459AC4
.hlp, xrefs: 00459AAB
.fts, xrefs: 00459AE8
Deleting file: %s, xrefs: 00459B81

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: e14b8734a3e760922f7be060c6d7bb0b4ed99118bca300cc26ba1b2c144879d5
Instruction ID: a7ef1fd572b269396f22072ef044e080e7f1ac0323465004d8c0527ddd4a5c49
Opcode Fuzzy Hash: e14b8734a3e760922f7be060c6d7bb0b4ed99118bca300cc26ba1b2c144879d5
Instruction Fuzzy Hash: C8717B30B042589BDB11EB6988827AE7BB5AF48715F50846BFC019B383DB7C9E0DC759

Uniqueness

Uniqueness Score: -1.00%

Function 0041B394 Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

73A24C40.GDI32(00000000,?,00000000,?), ref: 0041B3AB
73A24C40.GDI32(00000000,00000000,?,00000000,?), ref: 0041B3B5
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3C7
73A26180.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3DE
73A1A570.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3EA
73A24C00.GDI32(00000000,0000000B,?,00000000,0041B443,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B417
73A1A480.USER32(00000000,00000000,0041B44A,00000000,0041B443,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B43D
SelectObject.GDI32(00000000,?), ref: 0041B458
SelectObject.GDI32(?,00000000), ref: 0041B467
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B493
SelectObject.GDI32(00000000,00000000), ref: 0041B4A1
SelectObject.GDI32(?,00000000), ref: 0041B4AF
DeleteDC.GDI32(00000000), ref: 0041B4B8
DeleteDC.GDI32(?), ref: 0041B4C1

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Object$Select$Delete$A26180A480A570Stretch
String ID:
API String ID: 359944910-0
Opcode ID: 1bf830e07b75d18764d985e51e738aabf01532d498e87c638eb730881828f2e3
Instruction ID: 05b4775bda51026ff0d73d385fe963fbf6f5b4dcd42c920338d43da4f55eec7b
Opcode Fuzzy Hash: 1bf830e07b75d18764d985e51e738aabf01532d498e87c638eb730881828f2e3
Instruction Fuzzy Hash: D441A071E40609AFDF10DAE9D846FEFB7BCEB08704F104466B614FB281D77969408BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00471760 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 333COMMON

Download Yara Rule

APIs

Part of subcall function 0042C7A8: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C7CC

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00471918
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00471A17
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00471A2D
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00471A52

Strings

.lnk, xrefs: 004717EC
{group}\, xrefs: 004717BA
.pif, xrefs: 0047180F, 0047199B
Desktop.ini, xrefs: 00471AD3
target.lnk, xrefs: 00471A9C
.url, xrefs: 00471832
Filename: %s, xrefs: 004718BA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 537772d8d4f5896cf67790cd453a74ee224455481ed69af869db8873f19363bb
Instruction ID: 0992ae993ba798985e24c5a6b7ea874dc362b29564f0bf6d942b769e2ef8478e
Opcode Fuzzy Hash: 537772d8d4f5896cf67790cd453a74ee224455481ed69af869db8873f19363bb
Instruction Fuzzy Hash: 64D11374A00149AFDB01EFA9D985BDDBBF5AF08304F50806AF804B7391D778AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00453A90 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegQueryValueExA.ADVAPI32(00459F06,00000000,00000000,?,00000000,?,00000000,00453D29,?,00459F06,00000003,00000000,00000000,00453D60), ref: 00453BA9

Part of subcall function 0042E714: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004525D3,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E733

RegQueryValueExA.ADVAPI32(00459F06,00000000,00000000,00000000,?,00000004,00000000,00453C73,?,00459F06,00000000,00000000,?,00000000,?,00000000), ref: 00453C2D
RegQueryValueExA.ADVAPI32(00459F06,00000000,00000000,00000000,?,00000004,00000000,00453C73,?,00459F06,00000000,00000000,?,00000000,?,00000000), ref: 00453C5C

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00453AC7
RegOpenKeyEx, xrefs: 00453B2C
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00453B00
, xrefs: 00453B1A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 8f9a3036713b40e01ff8f238fa8fbe2e221ff422afcd829eb7d55856f2699b7f
Instruction ID: a85c13ee8c1e40c871d21152284f25a34c1515a6952d09ef2720c3a63fe562ad
Opcode Fuzzy Hash: 8f9a3036713b40e01ff8f238fa8fbe2e221ff422afcd829eb7d55856f2699b7f
Instruction Fuzzy Hash: 4B913671A04208ABDB11DF99C945BDEB7F8EB08346F50406BF901F7282D6799F09CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004587F4 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00458700: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,0045883D,00000000,004589F5,?,00000000,00000000,00000000), ref: 0045874D

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004589F5,?,00000000,00000000,00000000), ref: 0045889B
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004589F5,?,00000000,00000000,00000000), ref: 00458905

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,004589F5,?,00000000,00000000,00000000), ref: 0045896C

Strings

SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 004588B8
v1.1.4322, xrefs: 0045895E
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 0045891F
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 0045884E
.NET Framework not found, xrefs: 004589B9
v4.0.30319, xrefs: 0045888D
.NET Framework version %s not found, xrefs: 004589A5
v2.0.50727, xrefs: 004588F7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: ae5b2de95357e92415c190aea35426584579c2de5f715865d6501eb2e45b7b44
Instruction ID: dc764d86b7292572b156a26407ef2df84fe17423a8d01080f67fb36ac38d1474
Opcode Fuzzy Hash: ae5b2de95357e92415c190aea35426584579c2de5f715865d6501eb2e45b7b44
Instruction Fuzzy Hash: A051C175A04144AFCB00DBA4C8A1BEE77A6EB49305F54447FE801E7382DF399A0ACB59

Uniqueness

Uniqueness Score: -1.00%

Function 00457DE0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00457E17
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00457E33
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00457E41
GetExitCodeProcess.KERNEL32(?), ref: 00457E52
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00457E99
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00457EB5

Strings

Helper process exited, but failed to get exit code., xrefs: 00457E8B
Helper isn't responding; killing it., xrefs: 00457E23
Stopping 64-bit helper process. (PID: %u), xrefs: 00457E09
Helper process exited with failure code: 0x%x, xrefs: 00457E7F
Helper process exited., xrefs: 00457E61

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 92a282b8b847d415886edc9b4dd8f7d233467eb188c175e05b1561391374d7c8
Instruction ID: 05a953fdd12f8ddcbd202f73b1070c517b89d081868d4b30a6641c1e9efdef7c
Opcode Fuzzy Hash: 92a282b8b847d415886edc9b4dd8f7d233467eb188c175e05b1561391374d7c8
Instruction Fuzzy Hash: 1D215C716087409AC720EB79D44675BB6D59F08305F00CD7FF99ACB283D778E8488B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00453744 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DCE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DD10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0045391B,?,00000000,004539DF), ref: 0045386B
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,0045391B,?,00000000,004539DF), ref: 004539A7

Part of subcall function 0042E714: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004525D3,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E733

Strings

, xrefs: 004537CD
RegCreateKeyEx, xrefs: 004537DF
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004537B3
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00453783

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 31bbca5e637d9b3b9b62fb4d1a50caf02588ee8f0ed2f623b3dd40b8b93a65db
Instruction ID: 0b89bf75a9c9687b20ed21eb038899f0cb25ce62a83679de71854117abc0a5a9
Opcode Fuzzy Hash: 31bbca5e637d9b3b9b62fb4d1a50caf02588ee8f0ed2f623b3dd40b8b93a65db
Instruction Fuzzy Hash: 3F81FEB5A00209ABDB01DFD5C981BDEB7B9EF48345F10452AF901F7282D778AF058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00494EE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00452C1C: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004950B1,\nI,?,00000000,00452D56), ref: 00452D0B
Part of subcall function 00452C1C: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004950B1,\nI,?,00000000,00452D56), ref: 00452D1B

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00494F5D
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,004950B1), ref: 00494F7E
CreateWindowExA.USER32(00000000,STATIC,004950C0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00494FA5
SetWindowLongA.USER32(?,000000FC,00494738), ref: 00494FB8
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00495084,?,?,000000FC,00494738,00000000,STATIC,004950C0), ref: 00494FE8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0049505C
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00495084,?,?,000000FC,00494738,00000000), ref: 00495068

Part of subcall function 00452F6C: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453053

73A25CF0.USER32(?,0049508B,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00495084,?,?,000000FC,00494738,00000000,STATIC), ref: 0049507E

Strings

STATIC, xrefs: 00494F9E
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00495017

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FileWindow$CloseCreateHandle$AttributesCopyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 170458502-2312673372
Opcode ID: 8a966c6fbd4a0d6fd1f21d2fbfe49e2d77ccb9991b36bf243f0034a19841eaef
Instruction ID: be9799695a634fd16342a498ff1c2bceea11db58a4a937bc99d2ba33e8a5f773
Opcode Fuzzy Hash: 8a966c6fbd4a0d6fd1f21d2fbfe49e2d77ccb9991b36bf243f0034a19841eaef
Instruction Fuzzy Hash: 41414271A00608AEDF01EBA5DC42F9E7BF8EB49714F614576F500FB291D6799E008B98

Uniqueness

Uniqueness Score: -1.00%

Function 0042EDE0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042EDEC
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042EE00
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042EE0D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042EE1A
GetWindowRect.USER32(?,00000000), ref: 0042EE66
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042EEA4

Strings

GetMonitorInfoA, xrefs: 0042EE14
(, xrefs: 0042EE45
user32.dll, xrefs: 0042EDFB
MonitorFromWindow, xrefs: 0042EE07

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 11c5073dfdaa9037ed7ee8ee0033142e90f41fafdebd04e55e7902a8f04116da
Instruction ID: 81b88a7ab1ceae721b8aeb91463505c39b24ef06fee82e2a457cdd2782b0c03c
Opcode Fuzzy Hash: 11c5073dfdaa9037ed7ee8ee0033142e90f41fafdebd04e55e7902a8f04116da
Instruction Fuzzy Hash: E021C272301724AFD310D669DC81F3B3298EB84714F0A452EF944DB381DA78DC008A99

Uniqueness

Uniqueness Score: -1.00%

Function 00461D94 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00461DA0
GetModuleHandleA.KERNEL32(user32.dll), ref: 00461DB4
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00461DC1
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00461DCE
GetWindowRect.USER32(?,00000000), ref: 00461E1A
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00461E58

Strings

MonitorFromWindow, xrefs: 00461DBB
user32.dll, xrefs: 00461DAF
GetMonitorInfoA, xrefs: 00461DC8
(, xrefs: 00461DF9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: e92b9d5c7068c4ad65174a98f8279c3bd8cee61227202439de3f3f07641de1ce
Instruction ID: ac50aa85d20f27128dd8c3642a774edf16143193052780fb3ca3c770c826b634
Opcode Fuzzy Hash: e92b9d5c7068c4ad65174a98f8279c3bd8cee61227202439de3f3f07641de1ce
Instruction Fuzzy Hash: 912195757017046BD3109664CC41F3B3795DB84B14F0C452AFD44DB392E67EDC008A9A

Uniqueness

Uniqueness Score: -1.00%

Function 004556CC Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 243COMMON

Download Yara Rule

APIs

756FE550.OLE32(00498A68,00000000,00000001,00498774,?,00000000,0045598E), ref: 0045570E
756FE550.OLE32(00498764,00000000,00000001,00498774,?,00000000,0045598E), ref: 00455734
SysFreeString.OLEAUT32(?), ref: 00455893

Strings

IPersistFile::Save, xrefs: 00455915
IPropertyStore::SetValue, xrefs: 00455813, 0045585F
IPropertyStore::Commit, xrefs: 00455878
IShellLink::QueryInterface, xrefs: 004558B7
CoCreateInstance, xrefs: 0045573F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: E550$FreeString
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue$IShellLink::QueryInterface
API String ID: 491012016-2052886881
Opcode ID: 65e6feab3334f41c747474a8d0c578ebdac36064f9a50202e3e6e8fe36fe3ed3
Instruction ID: 80119b9caab7ce5f12158988fbcf678bfb4129473555bd74f63c4a2737be3c75
Opcode Fuzzy Hash: 65e6feab3334f41c747474a8d0c578ebdac36064f9a50202e3e6e8fe36fe3ed3
Instruction Fuzzy Hash: 23915270A00604EFDB40EFA9C895BAE77F8AF09315F14406AF904E7252DB78DD08CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00457FB8 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458197,?,00000000,004581FA,?,?,00000000,00000000), ref: 00458015
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045812C,?,00000000,00000001,00000000,00000000,00000000,00458197), ref: 00458072
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045812C,?,00000000,00000001,00000000,00000000,00000000,00458197), ref: 0045807F
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004580CB
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458105,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045812C,?,00000000), ref: 004580F1
GetLastError.KERNEL32(?,?,00000000,00000001,00458105,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045812C,?,00000000), ref: 004580F8

Part of subcall function 004527FC: GetLastError.KERNEL32(00000000,0045326D,00000005,00000000,004532A2,?,?,00000000,0049A628,00000004,00000000,00000000,00000000,?,004966A1,00000000), ref: 004527FF

Strings

TransactNamedPipe, xrefs: 0045808B
CreateEvent, xrefs: 00458023

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 80cf0cd36e542965d12430940a80f4859f37586d0a0e4c33ba5d02a8b2aa511b
Instruction ID: a6a517d63fd32511c22b817f408bf5895b74d3bbd499f81ebc87de90a3a3405e
Opcode Fuzzy Hash: 80cf0cd36e542965d12430940a80f4859f37586d0a0e4c33ba5d02a8b2aa511b
Instruction Fuzzy Hash: B6418371A00608AFDB15DF95C981F9EB7F9FB08710F1140AAF904F7292DA789E44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00455B64 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00455CC9,?,?,00000031,?), ref: 00455B8C
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00455B92
LoadTypeLib.OLEAUT32(00000000,?), ref: 00455BDF

Part of subcall function 004527FC: GetLastError.KERNEL32(00000000,0045326D,00000005,00000000,004532A2,?,?,00000000,0049A628,00000004,00000000,00000000,00000000,?,004966A1,00000000), ref: 004527FF

Strings

OLEAUT32.DLL, xrefs: 00455B87
UnRegisterTypeLib, xrefs: 00455C4B
GetProcAddress, xrefs: 00455B9F
ITypeLib::GetLibAttr, xrefs: 00455C15
UnRegisterTypeLib, xrefs: 00455B82
LoadTypeLib, xrefs: 00455BEA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 62cd571dd0a1fb17ba6e2c10dd29e3c4f0f3714fa1bfdf667f957769711da31b
Instruction ID: 2fc49365a89a4c45df309d680fa5544b7bb059dbf90ebb85ee18473684924132
Opcode Fuzzy Hash: 62cd571dd0a1fb17ba6e2c10dd29e3c4f0f3714fa1bfdf667f957769711da31b
Instruction Fuzzy Hash: 94319271600A04AFDB01EFAACD21D6BB7BDEF89701710846AF804D7652DA78D909CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0042E318 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E41D,?,00000000,0047C7D8,00000000), ref: 0042E341
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E347
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E41D,?,00000000,0047C7D8,00000000), ref: 0042E395

Strings

.DEFAULT\Control Panel\International, xrefs: 0042E36C
Locale, xrefs: 0042E384
Control Panel\Desktop\ResourceLocale, xrefs: 0042E3A4
GetUserDefaultUILanguage, xrefs: 0042E337
kernel32.dll, xrefs: 0042E33C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 30aa4657558854c74bcf70448c9976bc0f4bc282bea39f31534e50f6e50fe7f1
Instruction ID: 0354af2e7925d05c70f612fecf04a6532964f813884163ad76eadf20e7b5e4a9
Opcode Fuzzy Hash: 30aa4657558854c74bcf70448c9976bc0f4bc282bea39f31534e50f6e50fe7f1
Instruction Fuzzy Hash: D2214430B00224ABDB00EBA7DC41B9F77B8EB44304FA04477A504E7282DB7C9A059A5C

Uniqueness

Uniqueness Score: -1.00%

Function 00416D68 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416DFB
SaveDC.GDI32(?), ref: 00416E0F
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E32
RestoreDC.GDI32(?,?), ref: 00416E4D
CreateSolidBrush.GDI32(00000000), ref: 00416ECD
FrameRect.USER32(?,?,?), ref: 00416F00
DeleteObject.GDI32(?), ref: 00416F0A
CreateSolidBrush.GDI32(00000000), ref: 00416F1A
FrameRect.USER32(?,?,?), ref: 00416F4D
DeleteObject.GDI32(?), ref: 00416F57

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 3b27755b7b775f665e1a4bd51aa5187cf0cc76b725102093b065a9fda1b6c5e7
Instruction ID: f32214c97c751b668d9b6220275c8661121ed949f26fb06790abfa72b4305b5b
Opcode Fuzzy Hash: 3b27755b7b775f665e1a4bd51aa5187cf0cc76b725102093b065a9fda1b6c5e7
Instruction Fuzzy Hash: 40513B712086446FDB50EF29C8C0B9777E8AF48314F15466ABD49DB287C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Uniqueness

Uniqueness Score: -1.00%

Function 004221D0 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 0042221B
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422239
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422246
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422253
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422260
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 0042226D
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 0042227A
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 00422287
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222A5
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222C1

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 954d5bf433075ec7648aab546171fff7003c2d4d21bf849177f088035aae9b75
Instruction ID: 718b179df737225d37d78316067442912e8fc999dc0e9ef0fec371aaac52ddb0
Opcode Fuzzy Hash: 954d5bf433075ec7648aab546171fff7003c2d4d21bf849177f088035aae9b75
Instruction Fuzzy Hash: F62136703447447AE720D725DD8BFAB7AD89F08718F0444A5B6447F2D3C7FDAA4086A8

Uniqueness

Uniqueness Score: -1.00%

Function 00452F6C Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453053

Strings

NUL, xrefs: 00453115
%nI, xrefs: 00453090, 004530A0, 004530D3, 0045316B, 00453176, 0045315E
[rename], xrefs: 004530B6, 004530F2
WININIT.INI, xrefs: 00453001
MoveFileEx, xrefs: 00453263
\nI, xrefs: 00453294, 0045300B, 00453076, 0045300E
.tmp, xrefs: 0045300F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: %nI$.tmp$MoveFileEx$NUL$WININIT.INI$[rename]$\nI
API String ID: 390214022-3388891449
Opcode ID: 1e5709a8fd6ce803e8b1164f9b854728148892ac4d0473f25b9d7da7bd940309
Instruction ID: 0b0dcec983e824be328fc5c0ac23dd21dd4b303354c37382b4da753e4e763837
Opcode Fuzzy Hash: 1e5709a8fd6ce803e8b1164f9b854728148892ac4d0473f25b9d7da7bd940309
Instruction Fuzzy Hash: 80911130E002099BDB01EFA5D942BDEB7B5EF49346F508467F800B7292D778AE49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00460A30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 00460A6B
GetActiveWindow.USER32 ref: 00460ACF
CoInitialize.OLE32(00000000), ref: 00460AE3
SHBrowseForFolder.SHELL32(?), ref: 00460AFA
756CD120.OLE32(00460B3B,00000000,?,?,?,?,?,00000000,00460BBF), ref: 00460B0F
SetActiveWindow.USER32(?,00460B3B,00000000,?,?,?,?,?,00000000,00460BBF), ref: 00460B25
SetActiveWindow.USER32(?,?,00460B3B,00000000,?,?,?,?,?,00000000,00460BBF), ref: 00460B2E

Strings

A, xrefs: 00460AA3

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
String ID: A
API String ID: 2698730301-3554254475
Opcode ID: a1abc3331e6b094623e386f66bc876b60dabd5cc0da0584f97b83fc861c4bca7
Instruction ID: 6285945bf07c3a166b022f531d05f3a803eb355dac7221229df2d15ab139dc55
Opcode Fuzzy Hash: a1abc3331e6b094623e386f66bc876b60dabd5cc0da0584f97b83fc861c4bca7
Instruction Fuzzy Hash: 283132B0D00308AFDB00EFE6D885A9EBBF8EB09704F51847AF404E7251E7785A44CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00471610 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004716D1,?,?,?,00000008,00000000,00000000,00000000,?,0047192D,?,?,00000000,00471B94), ref: 00471634

Part of subcall function 0042CD38: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CDAE

Part of subcall function 00406F30: DeleteFileA.KERNEL32(00000000,0049A628,004969ED,00000000,00496A42,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F3B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,004716D1,?,?,?,00000008,00000000,00000000,00000000,?,0047192D), ref: 004716AB
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,004716D1,?,?,?,00000008,00000000,00000000,00000000), ref: 004716B1

Strings

desktop.ini, xrefs: 00471648
target.lnk, xrefs: 00471689
CLSID2, xrefs: 0047165E
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 0047166D
.ShellClassInfo, xrefs: 00471663

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: b9e1b9a14cc4994939cc9130746fbba05c0d46580f949f1297625d72549b476d
Instruction ID: c39d6c4db2ad0deae7f1ae965f2db77ee18d80f30206d7cf633db21ebbe3cc69
Opcode Fuzzy Hash: b9e1b9a14cc4994939cc9130746fbba05c0d46580f949f1297625d72549b476d
Instruction Fuzzy Hash: EA11DD703001147BDB11E6AE9C82A9EB3ACDF45714FA0823BF404A72E1DB3C9E02865D

Uniqueness

Uniqueness Score: -1.00%

Function 0045C650 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045C659
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045C669
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045C679
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045C689

Strings

inflateInit_, xrefs: 0045C653
inflateReset, xrefs: 0045C683
inflate, xrefs: 0045C663
inflateEnd, xrefs: 0045C673

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 6381b77caea71f7d8be91453f376269dc5ade138e8b0f1742c8e2d2bc3e4b903
Instruction ID: 0597597a11baf9d9df8e8dc309d43f89446d1c2781f93ec2c5acf252f3f21a6e
Opcode Fuzzy Hash: 6381b77caea71f7d8be91453f376269dc5ade138e8b0f1742c8e2d2bc3e4b903
Instruction Fuzzy Hash: BF012CB0901300DEDB14DF32BEC573736A5E7A871AF14A03B9824692A2D77C054CCE6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8C4 Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9A1
73A24D40.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A9DB
SetBkColor.GDI32(?,?), ref: 0041A9F0
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA3A
SetTextColor.GDI32(00000000,00000000), ref: 0041AA45
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA55
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AA94
SetTextColor.GDI32(00000000,00000000), ref: 0041AA9E
SetBkColor.GDI32(00000000,?), ref: 0041AAAB

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: 38b5d4050403801e172c9c725a2e8373fb0560301b4b766f6ce379770849aa6d
Instruction ID: 63a48f429e4cd2ff6867a160972251f173ae3d0b3502bd4ccc057afcf8cfd419
Opcode Fuzzy Hash: 38b5d4050403801e172c9c725a2e8373fb0560301b4b766f6ce379770849aa6d
Instruction Fuzzy Hash: 2E61E7B5A00104AFCB40EFADD985E9AB7F8AF09314B54816AF518DB361CB34ED44CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00456F0C Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D868: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D87B

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,004570C0,?, /s ",?,regsvr32.exe",?,004570C0), ref: 00457032

Strings

regsvr32.exe", xrefs: 00456F53
0x%x, xrefs: 00457055
Spawning 64-bit RegSvr32: , xrefs: 00456F97
CreateProcess, xrefs: 00457024
/s ", xrefs: 00456F7B
/u, xrefs: 00456F6E
Spawning 32-bit RegSvr32: , xrefs: 00456FB9
D, xrefs: 00456FE8

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: fb5f62bd63eaf3dbb40ffd930a477ba7d9b9fa7e28ba8de972149f19ce64a002
Instruction ID: 6f4624668567d04d9f49a5e2cff64df5633838e788db9f5cb64e7bec1705c311
Opcode Fuzzy Hash: fb5f62bd63eaf3dbb40ffd930a477ba7d9b9fa7e28ba8de972149f19ce64a002
Instruction Fuzzy Hash: 7641F570E043086BDB11EFD6D842B8EF7F9AF48705F50407BA904BB292D7789A09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044C7B0 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044C7E1
GetSysColor.USER32(00000014), ref: 0044C7E8
SetTextColor.GDI32(00000000,00000000), ref: 0044C800
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C829
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044C833
GetSysColor.USER32(00000010), ref: 0044C83A
SetTextColor.GDI32(00000000,00000000), ref: 0044C852
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C87B
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044C8A6

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 6c011d19962720c57f99ae84a11f68fd831fc3d5b21fd9a0ea075dcccbe307de
Instruction ID: c72cc10e2be09a409883ce0e42f01e50c9e9a547a85b78d8368daa7df0bb7860
Opcode Fuzzy Hash: 6c011d19962720c57f99ae84a11f68fd831fc3d5b21fd9a0ea075dcccbe307de
Instruction Fuzzy Hash: CB21C0B4201500BFC710FB2ACD8AE9BBBDCDF19319B00457A7954EB3A3C678DD408669

Uniqueness

Uniqueness Score: -1.00%

Function 0047638C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004762B4: GetWindowThreadProcessId.USER32(00000000), ref: 004762BC
Part of subcall function 004762B4: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004763B3,0049B048,00000000), ref: 004762CF
Part of subcall function 004762B4: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004762D5

SendMessageA.USER32(00000000,0000004A,00000000,FgG), ref: 004763C1
GetTickCount.KERNEL32 ref: 00476406
GetTickCount.KERNEL32 ref: 00476410
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00476465

Strings

FgG, xrefs: 004763B3, 004763B6
CallSpawnServer: Unexpected response: $%x, xrefs: 004763F6
CallSpawnServer: Unexpected status: %d, xrefs: 0047644E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d$FgG
API String ID: 613034392-1066121646
Opcode ID: 9e25f47d55cbccab7ee6f41fd75258f09c1f340e8b8b724ef8aa541710ea2bad
Instruction ID: 7b3989facecf81d8293a7ad44f2bcadc878152026df19698122e79260123aea6
Opcode Fuzzy Hash: 9e25f47d55cbccab7ee6f41fd75258f09c1f340e8b8b724ef8aa541710ea2bad
Instruction Fuzzy Hash: FF31C434B006149ADB10EBB9C8867EE76A69F04304F51843BF548EB382DB7C8D058B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00494784 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0044FC8C: SetEndOfFile.KERNEL32(?,?,0045B6DE,00000000,0045B869,?,00000000,00000002,00000002), ref: 0044FC93

Part of subcall function 00406F30: DeleteFileA.KERNEL32(00000000,0049A628,004969ED,00000000,00496A42,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F3B

GetWindowThreadProcessId.USER32(00000000,?), ref: 00494815
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00494829
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00494843
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049484F
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00494855
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00494868

Strings

Deleting Uninstall data files., xrefs: 0049478B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 8b9192de9a864f1d0a42505a3bab7cd9530daa077910e386bbae6d558a472ab8
Instruction ID: d22b71c71f8c218356d39921f4efba8aa632f2c0e28d985d4fe56f9575ee7d0e
Opcode Fuzzy Hash: 8b9192de9a864f1d0a42505a3bab7cd9530daa077910e386bbae6d558a472ab8
Instruction Fuzzy Hash: F021B130300644AEEB10EBB6ED82F573798EB94708F10453BF5009A293DB78AC02DA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0046EE58 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046EF55,?,?,?,?,00000000), ref: 0046EEBF
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046EF55), ref: 0046EED6
AddFontResourceA.GDI32(00000000), ref: 0046EEF3
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0046EF07

Strings

Failed to open Fonts registry key., xrefs: 0046EEDD
AddFontResource, xrefs: 0046EF11
Failed to set value in Fonts registry key., xrefs: 0046EEC8

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: d40500ae8eb822968503ea692d1b1fb5555cb8c9ce6c30d98f2b5ba9323feda8
Instruction ID: 1e4eef1652d92c2a0097eb18b0e556d5c5c9769271b4b4c2730dbdd0d559fb1f
Opcode Fuzzy Hash: d40500ae8eb822968503ea692d1b1fb5555cb8c9ce6c30d98f2b5ba9323feda8
Instruction Fuzzy Hash: 9A2192787402047BEB10EA678C42F5A67DDDB15708F604437B900EB2C2EA7DED02966E

Uniqueness

Uniqueness Score: -1.00%

Function 004621D4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004163F8: GetClassInfoA.USER32(00400000,?,?), ref: 00416467
Part of subcall function 004163F8: UnregisterClassA.USER32(?,00400000), ref: 00416493
Part of subcall function 004163F8: RegisterClassA.USER32(?), ref: 004164B6

GetVersion.KERNEL32 ref: 00462204
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462242
SHGetFileInfo.SHELL32(004622E0,00000000,?,00000160,00004011), ref: 0046225F
LoadCursorA.USER32(00000000,00007F02), ref: 0046227D
SetCursor.USER32(00000000,00000000,00007F02,004622E0,00000000,?,00000160,00004011), ref: 00462283
SetCursor.USER32(?,004622C3,00007F02,004622E0,00000000,?,00000160,00004011), ref: 004622B6

Strings

Explorer, xrefs: 0046221E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: d1a32a133b6ca039cb2888dc6844a3007b82908fc47db2899aab9efd393c9000
Instruction ID: df39b49bb5a3206d8742c7c114f119d7ebc4f95637a316e0e20b0c275ca88c16
Opcode Fuzzy Hash: d1a32a133b6ca039cb2888dc6844a3007b82908fc47db2899aab9efd393c9000
Instruction Fuzzy Hash: 0F21E4707407047AE710BBB68C57B9A76989B09718F4044BFFA05EA1C3EABC8C15866E

Uniqueness

Uniqueness Score: -1.00%

Function 00476A90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02152C1C,?,?,?,02152C1C,00476C54,00000000,00476D72,?,?,-00000010,?), ref: 00476AA9
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00476AAF
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02152C1C,?,?,?,02152C1C,00476C54,00000000,00476D72,?,?,-00000010,?), ref: 00476AC2
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02152C1C,?,?,?,02152C1C), ref: 00476AEC
CloseHandle.KERNEL32(00000000,?,?,?,02152C1C,00476C54,00000000,00476D72,?,?,-00000010,?), ref: 00476B0A

Strings

kernel32.dll, xrefs: 00476AA4
GetFinalPathNameByHandleA, xrefs: 00476A9F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 86a1a23235bbbc84275b5610544e98290f4e87644edb83021c6f4a33461be67c
Instruction ID: e3837007750573e7bf3eedefbd04cf9f926f51f59c13a17cdc71c6aad429c459
Opcode Fuzzy Hash: 86a1a23235bbbc84275b5610544e98290f4e87644edb83021c6f4a33461be67c
Instruction Fuzzy Hash: C2012690740F243BE52031AA4E82FBB588ECB56768F1581377A0CFB2C6E9BCAC01415E

Uniqueness

Uniqueness Score: -1.00%

Function 004591A8 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045932A,?,00000000,00000000,00000000,?,00000006,?,00000000,00495AFB,?,00000000,00495B9E), ref: 0045926E

Part of subcall function 00453610: FindClose.KERNEL32(000000FF,00453706), ref: 004536F5

Strings

Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 004592E3
Failed to delete directory (%d)., xrefs: 00459304
Failed to delete directory (%d). Will retry later., xrefs: 00459287
Stripped read-only attribute., xrefs: 00459230
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459248
Deleting directory: %s, xrefs: 004591F7
Failed to strip read-only attribute., xrefs: 0045923C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: a53ef0b49cd1ee1e91083b2135023f31ef568ee783fb533e59eb02fcd565e2c4
Instruction ID: 534d4fcf54e4ee1330a5b78aec9534ef33c9cf01648189f7a69ba484de5f92f0
Opcode Fuzzy Hash: a53ef0b49cd1ee1e91083b2135023f31ef568ee783fb533e59eb02fcd565e2c4
Instruction Fuzzy Hash: BF41B330A04244DACB10DBA988453AF76A59B89306F51897BBC15D73D3DB7C8E0DC75A

Uniqueness

Uniqueness Score: -1.00%

Function 00422E38 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422E8C
GetCapture.USER32 ref: 00422E9B
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EA1
ReleaseCapture.USER32 ref: 00422EA6
GetActiveWindow.USER32 ref: 00422EB5
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F34
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422F98
GetActiveWindow.USER32 ref: 00422FA7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 6e62e6cc263a0fde97de7acf714bf83ff44e65fa83ba03635c3d4835d450fb58
Instruction ID: a044bb0e81697aad5bb2f1c2e33f51e018d1eeaa3f5d8fe09b274a9bdd63ae90
Opcode Fuzzy Hash: 6e62e6cc263a0fde97de7acf714bf83ff44e65fa83ba03635c3d4835d450fb58
Instruction Fuzzy Hash: D4414270B00214AFDB10EB69DA42B9D77F1EB49304F5540BAF440AB3A2D7789E40DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042EEE8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042EF12
GetWindowLongA.USER32(?,000000EC), ref: 0042EF29
GetActiveWindow.USER32 ref: 0042EF32
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042EF5F
SetActiveWindow.USER32(?,0042F08F,00000000,?), ref: 0042EF80

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: d70eba85cb0092c2572d1dff44f30dcb458b8f6f516ef4a9872502abe7e56b03
Instruction ID: f4fb3eaa4a6516aaedceac6748a0b58c5823fdf0e7ef8281d4afca69d00d3852
Opcode Fuzzy Hash: d70eba85cb0092c2572d1dff44f30dcb458b8f6f516ef4a9872502abe7e56b03
Instruction Fuzzy Hash: E131B470A00714AFD711EFB6DC52D5F7BB8EB09704B9248BAF804E3292D6389D10CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00429468 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000), ref: 00429472
GetTextMetricsA.GDI32(00000000), ref: 0042947B

Part of subcall function 0041A1D0: CreateFontIndirectA.GDI32(?), ref: 0041A28F

SelectObject.GDI32(00000000,00000000), ref: 0042948A
GetTextMetricsA.GDI32(00000000,?), ref: 00429497
SelectObject.GDI32(00000000,00000000), ref: 0042949E
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004294A6
GetSystemMetrics.USER32(00000006), ref: 004294CB
GetSystemMetrics.USER32(00000006), ref: 004294E5

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$A480A570CreateFontIndirect
String ID:
API String ID: 361401722-0
Opcode ID: b023dd09fd4ec06f6d46e53800f6f6acac57706d273235f8cd4e9da7ac8aa401
Instruction ID: 98898a44172f69bf24ec3d8a6ef43543c6468a87450e56550a5d5b4712d68be3
Opcode Fuzzy Hash: b023dd09fd4ec06f6d46e53800f6f6acac57706d273235f8cd4e9da7ac8aa401
Instruction Fuzzy Hash: 3901E1517087513AF710B67A9CC6F6B6198DB84358F44053FFA469A3C3D96C9C41826A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE0C Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00419041,00496EDA), ref: 0041DE0F
73A24620.GDI32(00000000,0000005A,00000000,?,00419041,00496EDA), ref: 0041DE19
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,?,00419041,00496EDA), ref: 0041DE26
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE35
GetStockObject.GDI32(00000007), ref: 0041DE43
GetStockObject.GDI32(00000005), ref: 0041DE4F
GetStockObject.GDI32(0000000D), ref: 0041DE5B
LoadIconA.USER32(00000000,00007F00), ref: 0041DE6C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ObjectStock$A24620A480A570IconLoad
String ID:
API String ID: 3573811560-0
Opcode ID: 757416ecad359ea9456f8a21dcb558b4c43af055770acadfb55ee1772f5bd968
Instruction ID: 6b51b5b9ef12793bce6ff696d6bf2aa44f125c59f143ee087c4134c2e587d034
Opcode Fuzzy Hash: 757416ecad359ea9456f8a21dcb558b4c43af055770acadfb55ee1772f5bd968
Instruction Fuzzy Hash: 831160B06443419AE740FFA96896BA63690D764708F04803FF6449F2D2DA7D1C548B9F

Uniqueness

Uniqueness Score: -1.00%

Function 004625E4 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 004626E8
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046277D), ref: 004626EE
SetCursor.USER32(?,00462765,00007F02,00000000,0046277D), ref: 00462758

Strings

, xrefs: 0046297E
Internal error: Item already expanding, xrefs: 00462685
, xrefs: 00462963

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 2b4ca07bb9afc79652b9b90631f3cfab3ec5696c1e0434d634c2fbfa839246d9
Instruction ID: e6d2e44c9d05907f3e5b990cf56a20fd25f5602c78974bd8caf37cf2cf6e445b
Opcode Fuzzy Hash: 2b4ca07bb9afc79652b9b90631f3cfab3ec5696c1e0434d634c2fbfa839246d9
Instruction Fuzzy Hash: B2B1A230600A04EFD714DF25C685B9EBBF1BF44304F5884AAE845AB792E7B8AD45CB16

Uniqueness

Uniqueness Score: -1.00%

Function 00475374 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 004753CD
73A259E0.USER32(00000000,000000FC,00475328,00000000,0047560C,?,00000000,00475636), ref: 004753F4
GetACP.KERNEL32(00000000,0047560C,?,00000000,00475636), ref: 00475431
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00475477

Strings

Inno Setup: Language, xrefs: 004754FF
COMBOBOX, xrefs: 004753C6

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A259ClassInfoMessageSend
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3217714596-4234151509
Opcode ID: 5775e3af7ae234138f485d1e83d200eb90e5ff2bfade9b773f05fd1c6452f7ef
Instruction ID: e8c162543c025322b71b50dd9b098b1ebc250f955d8e3c075c53d9fee39e0ead
Opcode Fuzzy Hash: 5775e3af7ae234138f485d1e83d200eb90e5ff2bfade9b773f05fd1c6452f7ef
Instruction Fuzzy Hash: 55813C34A00645DFCB10DF69D985AAEB7F1EB09304F5581BBE808DB362D7B8AD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408700 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408948,?,?,?,?,00000000,00000000,00000000,?,0040994F,00000000,00409962), ref: 0040871A

Part of subcall function 00408548: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049A4C0,00000001,?,00408613,?,00000000,004086F2), ref: 00408566

Part of subcall function 00408594: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00408796,?,?,?,00000000,00408948), ref: 004085A7

Strings

m/d/yy, xrefs: 004087E9
mmmm d, yyyy, xrefs: 0040880B
AMPM, xrefs: 004088E5
:mm, xrefs: 004088FC
:mm:ss, xrefs: 00408916

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: d7fa7bddb22e1db07ca528e226100c54cebd64a2cae894e02a576bc154f01e76
Instruction ID: df00404fec8d0a2a4b2d995664e5cd1aa7504ef27e6d614469d6daf0beab5ab3
Opcode Fuzzy Hash: d7fa7bddb22e1db07ca528e226100c54cebd64a2cae894e02a576bc154f01e76
Instruction Fuzzy Hash: F3512F24B00148ABDB01FBA5CD4169E7769DB88308F50D47FA181BB3C6DE3CDA15875E

Uniqueness

Uniqueness Score: -1.00%

Function 004116DC Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118E1), ref: 00411774
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 00411832

Part of subcall function 00411A94: CreatePopupMenu.USER32 ref: 00411AAE

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118BE

Part of subcall function 00411A94: CreateMenu.USER32 ref: 00411AB8

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118A5

Strings

?, xrefs: 0041178E
,, xrefs: 00411787

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 8e8aa01fe8bd538d6c6ab7aab6bfb4d2f36d62a3c5c28930bbd5ce218dcf30d8
Instruction ID: 793fc79b513d20d73f9d230ac8d1e2c96994409d89e9c648594a581ec8cd73ac
Opcode Fuzzy Hash: 8e8aa01fe8bd538d6c6ab7aab6bfb4d2f36d62a3c5c28930bbd5ce218dcf30d8
Instruction Fuzzy Hash: 8B510770A001459BDB10EF7ADC816EA7BF9AF09304B15857BFA04E73A2D738D941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE4B Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF10
GetObjectA.GDI32(?,00000018,?), ref: 0041BF1F
GetBitmapBits.GDI32(?,?,?), ref: 0041BF70
GetBitmapBits.GDI32(?,?,?), ref: 0041BF7E
DeleteObject.GDI32(?), ref: 0041BF87
DeleteObject.GDI32(?), ref: 0041BF90
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFAD

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: 3c3dd4c2968d3148edaca717f274c319af849b13cfc7544b624ece9a1a4d390b
Instruction ID: 4bbd2eff117aa994e69ddbf41dbe459af7dc9631145296d56e4e893510d56d43
Opcode Fuzzy Hash: 3c3dd4c2968d3148edaca717f274c319af849b13cfc7544b624ece9a1a4d390b
Instruction Fuzzy Hash: 33510575E00219AFCB14DFA9C8819EEB7F9EF48314B11842AF914E7391D738AD81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041CEC0 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEE6
73A24620.GDI32(00000000,00000026), ref: 0041CF05
73A18830.GDI32(?,?,00000001,00000000,00000026), ref: 0041CF6B
73A122A0.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF7A
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFE4
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D022
73A18830.GDI32(?,?,00000001,0041D054,00000000,00000026), ref: 0041D047

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Stretch$A18830$A122A24620BitsMode
String ID:
API String ID: 430401518-0
Opcode ID: e86badb8244d5df9a4800637c34f6a1895a7e90cda7e1ea6b6d5024958a3a1d4
Instruction ID: a387d2c4f9a4bc91fd4f0e5b83bec92a14bd02f800b4ec19f0925a60e6c40561
Opcode Fuzzy Hash: e86badb8244d5df9a4800637c34f6a1895a7e90cda7e1ea6b6d5024958a3a1d4
Instruction Fuzzy Hash: 1C512CB4600200AFDB14DFA8C985F9BBBE8AF08304F10859AB545D7292C778ED81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00456120 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 00456172

Part of subcall function 00424264: GetWindowTextA.USER32(?,?,00000100), ref: 00424284

Part of subcall function 0041EE8C: GetCurrentThreadId.KERNEL32 ref: 0041EEDB
Part of subcall function 0041EE8C: 73A25940.USER32(00000000,0041EE3C,00000000,00000000,0041EEF8,?,00000000,0041EF2F,?,0042EB08,?,00000001), ref: 0041EEE1

Part of subcall function 004242AC: SetWindowTextA.USER32(?,00000000), ref: 004242C4

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004561D9
TranslateMessage.USER32(?), ref: 004561F7
DispatchMessageA.USER32(?), ref: 00456200

Strings

[Paused] , xrefs: 004561A8

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Message$TextWindow$A25940CurrentDispatchSendThreadTranslate
String ID: [Paused]
API String ID: 3047529653-4230553315
Opcode ID: 636d67d76d6b1dec8e48a3b0ad47377b192770dafde070f4086419b9ce3c9043
Instruction ID: d2a3ade33fa5ad802753642a4a37e14ea1d0ee6c33f40ad92aa307aa024c524b
Opcode Fuzzy Hash: 636d67d76d6b1dec8e48a3b0ad47377b192770dafde070f4086419b9ce3c9043
Instruction Fuzzy Hash: A531D9319042449ED701EBBADC41BDE7BB8EB49314F9540B7F840E3292D77C9919CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0046A284 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046A3C3), ref: 0046A340
LoadCursorA.USER32(00000000,00007F02), ref: 0046A34E
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046A3C3), ref: 0046A354
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046A3C3), ref: 0046A35E
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046A3C3), ref: 0046A364

Strings

CheckPassword, xrefs: 0046A2E8

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 61e2f43d483135b2ebd74056ce2765722269d96ade5b29c635a855cd567c6201
Instruction ID: 048ef2ac727e4c19906b5fd58d75d7b3626c495d90e6ed791287928044b9bac7
Opcode Fuzzy Hash: 61e2f43d483135b2ebd74056ce2765722269d96ade5b29c635a855cd567c6201
Instruction Fuzzy Hash: 9731B574640604DFD700EB65D98AB9E7BE0EF44304F1480B6BD04AB3A2D778AE50CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00458B20 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 00458BDB

Strings

CreateAssemblyCache, xrefs: 00458BD2
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 00458BE6
Failed to load .NET Framework DLL "%s", xrefs: 00458BC0
Fusion.dll, xrefs: 00458B7B
.NET Framework CreateAssemblyCache function failed, xrefs: 00458BFE

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 244dc61e75036d6c3b0192238eb8083e59cf00f34e40042f08a2e9a4851f9aee
Instruction ID: 1c489dae8163ac769eb4a4ecd270df04bca0dde1928883b4ca469517540c11a6
Opcode Fuzzy Hash: 244dc61e75036d6c3b0192238eb8083e59cf00f34e40042f08a2e9a4851f9aee
Instruction Fuzzy Hash: A0316471E00609ABCB01EFA5C88169EB7A8AF45315F50857FE814B7382DF789909C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C130 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C030: GetObjectA.GDI32(?,00000018), ref: 0041C03D

GetFocus.USER32 ref: 0041C150
73A1A570.USER32(?), ref: 0041C15C
73A18830.GDI32(?,?,00000000,00000000,0041C1DB,?,?), ref: 0041C17D
73A122A0.GDI32(?,?,?,00000000,00000000,0041C1DB,?,?), ref: 0041C189
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1A0
73A18830.GDI32(?,00000000,00000000,0041C1E2,?,?), ref: 0041C1C8
73A1A480.USER32(?,?,0041C1E2,?,?), ref: 0041C1D5

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A18830$A122A480A570BitsFocusObject
String ID:
API String ID: 2231653193-0
Opcode ID: 1db970a339cff4feefedb0e536d61ab8ff4444c21f8c3a2e88a58ace013ddce6
Instruction ID: c0a2ed84afc4bd9bec2804e3d1f319e5299c8bb2955d2d1476203e1e1f035e2e
Opcode Fuzzy Hash: 1db970a339cff4feefedb0e536d61ab8ff4444c21f8c3a2e88a58ace013ddce6
Instruction Fuzzy Hash: BA113D71A44608BFDB10DBE9CC85FAFB7FCEF48704F54446AB514E7281D67899408B68

Uniqueness

Uniqueness Score: -1.00%

Function 00418C3C Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C58
GetSystemMetrics.USER32(0000000D), ref: 00418C60
6F552980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C66

Part of subcall function 00409998: 6F54C400.COMCTL32(0049A628,000000FF,00000000,00418C94,00000000,00418CF0,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 0040999C

6F5BCB00.COMCTL32(0049A628,00000000,00000000,00000000,00000000,00418CF0,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CB6
6F5BC740.COMCTL32(00000000,?,0049A628,00000000,00000000,00000000,00000000,00418CF0,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CC1
6F5BCB00.COMCTL32(0049A628,00000001,?,?,00000000,?,0049A628,00000000,00000000,00000000,00000000,00418CF0,?,00000000,0000000D,00000000), ref: 00418CD4
6F550860.COMCTL32(0049A628,00418CF7,?,00000000,?,0049A628,00000000,00000000,00000000,00000000,00418CF0,?,00000000,0000000D,00000000,0000000E), ref: 00418CEA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: MetricsSystem$C400C740F550860F552980
String ID:
API String ID: 1828538299-0
Opcode ID: 1989086bad89f3295cbd6afa0bd7b054d8bc3cbdeab04a02c144c3b1874e0316
Instruction ID: c0a08d93c5194f224585cf3bb7457c2e62491c79a9a497740637926b19b7cdbe
Opcode Fuzzy Hash: 1989086bad89f3295cbd6afa0bd7b054d8bc3cbdeab04a02c144c3b1874e0316
Instruction Fuzzy Hash: 1E1136B1744204BBEB10EBA9DC82F9EB3B8DB08714F50446EB904F72D2EA799D408758

Uniqueness

Uniqueness Score: -1.00%

Function 00481BA8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00481C60), ref: 00481C45

Strings

ProductType, xrefs: 00481BE4
LanmanNT, xrefs: 00481C0F
WinNT, xrefs: 00481BF5
ServerNT, xrefs: 00481C29
System\CurrentControlSet\Control\ProductOptions, xrefs: 00481BCC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 8cd469757b18ad1c97b0f800bbce6090e307c49f28e2ceb9c7e79cfb5efc90bb
Instruction ID: b684dcc60905fe3996a31ab8ce1ff629bf6ac02f7a7c7ef89ea959ef4614f2a6
Opcode Fuzzy Hash: 8cd469757b18ad1c97b0f800bbce6090e307c49f28e2ceb9c7e79cfb5efc90bb
Instruction Fuzzy Hash: 72119D30688204ABDB11F766D941B9E7BACEB55344F60887BA840E72A2E77CDD02971D

Uniqueness

Uniqueness Score: -1.00%

Function 0041B44A Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B458
SelectObject.GDI32(?,00000000), ref: 0041B467
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B493
SelectObject.GDI32(00000000,00000000), ref: 0041B4A1
SelectObject.GDI32(?,00000000), ref: 0041B4AF
DeleteDC.GDI32(00000000), ref: 0041B4B8
DeleteDC.GDI32(?), ref: 0041B4C1

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: dfa175311f9ed4f4c58f5f79a9db12cdb3c018b6ff94d951a92190f0251cabe9
Instruction ID: 7e0e064550abd0227ef511235a7a95d8cdbd035160633462ab43f6f1e02ee56a
Opcode Fuzzy Hash: dfa175311f9ed4f4c58f5f79a9db12cdb3c018b6ff94d951a92190f0251cabe9
Instruction Fuzzy Hash: 88114C72E00555ABDF10DAD9D885FAFB3BCEF08714F048456B714FB241C678A8418B94

Uniqueness

Uniqueness Score: -1.00%

Function 0042337C Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00423397
WindowFromPoint.USER32(?,?), ref: 004233A4
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233B2
GetCurrentThreadId.KERNEL32 ref: 004233B9
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233D2
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 004233E9
SetCursor.USER32(00000000), ref: 004233FB

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 727b6747768474ef8b363d3615eec6d43d88bdf8fc33f241ae574103e0e3144c
Instruction ID: d1a59ef539c994cdea214d0305b14f31a3db8a311ec8a747cf93f35c87281e80
Opcode Fuzzy Hash: 727b6747768474ef8b363d3615eec6d43d88bdf8fc33f241ae574103e0e3144c
Instruction Fuzzy Hash: F701D82230431026D6217B795C86E2F66A8CFC5B55F50413FB905BA283D93D9D01536D

Uniqueness

Uniqueness Score: -1.00%

Function 004935C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 004935D0
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 004935DD
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 004935EA

Strings

GetMonitorInfoA, xrefs: 004935E4
user32.dll, xrefs: 004935CB
MonitorFromRect, xrefs: 004935D7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: b93ec3be6ad25ce28c378c1e4d937ab42271d583ea12c6acc836fdba75f8bdd8
Instruction ID: 7bca0d46b8794983a04fb8f4f732d7e1003289be8492f80686068f2104363fa3
Opcode Fuzzy Hash: b93ec3be6ad25ce28c378c1e4d937ab42271d583ea12c6acc836fdba75f8bdd8
Instruction Fuzzy Hash: EBF0F692B0175476DE302DB60C81E7B698CCB86B72F040037BD44A7383ED5DCE0546AD

Uniqueness

Uniqueness Score: -1.00%

Function 00456E40 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00456E70
GetExitCodeProcess.KERNEL32(?,BjI), ref: 00456E91
CloseHandle.KERNEL32(?,00456EC4,?,?,004576DF,00000000,00000000), ref: 00456EB7

Strings

MsgWaitForMultipleObjects, xrefs: 00456E7D
BjI, xrefs: 00456E87, 00456E8A
GetExitCodeProcess, xrefs: 00456E9A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: BjI$GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3225529542
Opcode ID: 99ce4a1b0babe4c246de8794e00a0f6f13a283ff9a7e4f00f62208de1080ae0c
Instruction ID: d886056a02a72292ce6438298cb32dc427d01a0b9ddaaab929798cf94f85d4fb
Opcode Fuzzy Hash: 99ce4a1b0babe4c246de8794e00a0f6f13a283ff9a7e4f00f62208de1080ae0c
Instruction Fuzzy Hash: AF01DB78604200AFDB10EBA9C902A1A73A8EB49714FA1457BF810EB2D2CA7C9D049618

Uniqueness

Uniqueness Score: -1.00%

Function 0045C524 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045C52D
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045C53D
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045C54D

Strings

ISCryptGetVersion, xrefs: 0045C527
ArcFourCrypt, xrefs: 0045C547
ArcFourInit, xrefs: 0045C537

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: a56dc9a75a649bc82389aaa1cf2e500f9ee0c9f17d265c5af5864304c513d135
Instruction ID: dd669f08646f4d69055b3ac0f2dc47e0ccf369d631a00cc3a74d6f6c0e75ef3e
Opcode Fuzzy Hash: a56dc9a75a649bc82389aaa1cf2e500f9ee0c9f17d265c5af5864304c513d135
Instruction Fuzzy Hash: 57F049B0900714EFDB28DFB2BEC47233AD5E398706F04C03BA814992A6E7785448DE9C

Uniqueness

Uniqueness Score: -1.00%

Function 0045CA24 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045CA2D
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045CA3D
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045CA4D

Strings

BZ2_bzDecompressEnd, xrefs: 0045CA47
BZ2_bzDecompressInit, xrefs: 0045CA27
BZ2_bzDecompress, xrefs: 0045CA37

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 06c6b3f32bb7345a94d69f1be61e8643689e0f97731b33e76babeefbcb69a411
Instruction ID: 7fb22dad6ed3894bffbe773f62540c0402b5f98a7fc92762d290ad48bf5bf345
Opcode Fuzzy Hash: 06c6b3f32bb7345a94d69f1be61e8643689e0f97731b33e76babeefbcb69a411
Instruction Fuzzy Hash: DCF0F9B0540308DEDB24DB72BDC97232AA5E7A4756F14813B9815A52A2E37C0848CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0042E868 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00498934,00456035,004563D8,00455F8C,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,0047F4AB), ref: 0042E881
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E887
InterlockedExchange.KERNEL32(0049A668,00000001), ref: 0042E898

Part of subcall function 0042E7F8: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042E8BC,00000004,00498934,00456035,004563D8,00455F8C,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E80E
Part of subcall function 0042E7F8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E814
Part of subcall function 0042E7F8: InterlockedExchange.KERNEL32(0049A660,00000001), ref: 0042E825

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00498934,00456035,004563D8,00455F8C,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E8AC

Strings

user32.dll, xrefs: 0042E87C
ChangeWindowMessageFilterEx, xrefs: 0042E877

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 30bdd6e8003465d4fea4329fa8cbb1731c767cefa0c775642ffa75496dfcff28
Instruction ID: f421ee8e4a83efc3418074c22633f0ce5d19712a94174e53daf7bdcdc9ade642
Opcode Fuzzy Hash: 30bdd6e8003465d4fea4329fa8cbb1731c767cefa0c775642ffa75496dfcff28
Instruction Fuzzy Hash: BAE06DB1741720AAEA1077B66C86F9A26988B00769F5C403BF180A61D1C6BD0C50CE9E

Uniqueness

Uniqueness Score: -1.00%

Function 0044BE14 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044E6C1), ref: 0044BE23
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044BE34
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044BE44

Strings

oleacc.dll, xrefs: 0044BE1E
LresultFromObject, xrefs: 0044BE2E
CreateStdAccessibleObject, xrefs: 0044BE3E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 8bdc7ef9088ed22cb10869b3442feeb8d440459eef8afec1899d37dabf29079c
Instruction ID: 9c86094e29855d9c4fbfb7d380fa18a2fcb423c00c04bc0850f3ded04764ea6f
Opcode Fuzzy Hash: 8bdc7ef9088ed22cb10869b3442feeb8d440459eef8afec1899d37dabf29079c
Instruction Fuzzy Hash: 0CF01270540701CEFB109BF5DC8679231B4E3A0709F24217BA101561E1C7BDC4A5CF8E

Uniqueness

Uniqueness Score: -1.00%

Function 00406334 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00496EBC), ref: 0040633A
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00406347
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 0040635D

Strings

SetSearchPathMode, xrefs: 00406357
kernel32.dll, xrefs: 00406335
SetDllDirectoryW, xrefs: 00406341

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: SetDllDirectoryW$SetSearchPathMode$kernel32.dll
API String ID: 667068680-4185904062
Opcode ID: 46a4951564b22c7c4013c457b1693ed8222a8c7de8430cd5ed63a6dc3e90f1f0
Instruction ID: 676d0f0c08149d802e5ed83e46d764d5fdf73ec46bf64f47538378b3546cd005
Opcode Fuzzy Hash: 46a4951564b22c7c4013c457b1693ed8222a8c7de8430cd5ed63a6dc3e90f1f0
Instruction Fuzzy Hash: B1D092D1380701A8EA2036F20C82E3B10488940B64B2A04377D8AB91C3DABCEC2408BD

Uniqueness

Uniqueness Score: -1.00%

Function 00477340 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00496F1B), ref: 00477346
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00477353
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00477363

Strings

VerSetConditionMask, xrefs: 0047734D
kernel32.dll, xrefs: 00477341
VerifyVersionInfoW, xrefs: 0047735D

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 3faa47020917b7afb68e9e0903e1c9b4bdb2150633d74a97218909a69e347e07
Instruction ID: a236109150c79272849cb7216c6885df3d9d6914e7432e1b7d128d817614c72e
Opcode Fuzzy Hash: 3faa47020917b7afb68e9e0903e1c9b4bdb2150633d74a97218909a69e347e07
Instruction Fuzzy Hash: 0CC012E0245740EDEA00A7B12DC2E7B214CD500B28350803BBCC8BD183D77D0C00EE6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B654 Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B72D
73A1A570.USER32(?), ref: 0041B739
73A18830.GDI32(00000000,?,00000000,00000000,0041B804,?,?), ref: 0041B76E
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041B804,?,?), ref: 0041B77A
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B7E2,?,00000000,0041B804,?,?), ref: 0041B7A8
73A18830.GDI32(00000000,00000000,00000000,0041B7E9,?,?,00000000,00000000,0041B7E2,?,00000000,0041B804,?,?), ref: 0041B7DC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: 3c7878d60c44b5f17e172cd8bb0d2994c64aa00f0204818519f339f43435c2da
Instruction ID: cd2a701423028df911f5b3be5ed513c77f87f0206a81684e46f994520bac5752
Opcode Fuzzy Hash: 3c7878d60c44b5f17e172cd8bb0d2994c64aa00f0204818519f339f43435c2da
Instruction Fuzzy Hash: 98512170A002089FCF11DFA9C891AEEBBF8EF49704F104466F510A7390D7785D81CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B924 Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B9FF
73A1A570.USER32(?), ref: 0041BA0B
73A18830.GDI32(00000000,?,00000000,00000000,0041BAD1,?,?), ref: 0041BA45
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041BAD1,?,?), ref: 0041BA51
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BAAF,?,00000000,0041BAD1,?,?), ref: 0041BA75
73A18830.GDI32(00000000,00000000,00000000,0041BAB6,?,?,00000000,00000000,0041BAAF,?,00000000,0041BAD1,?,?), ref: 0041BAA9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: 1b5c3aaf39abfb32ff705986f931cf2caaf3c43be24d6a1839e561c266172d4b
Instruction ID: c42898f10a58dc438a5f451a1a67da607c337991275f3a20adb605244c83d1ef
Opcode Fuzzy Hash: 1b5c3aaf39abfb32ff705986f931cf2caaf3c43be24d6a1839e561c266172d4b
Instruction Fuzzy Hash: 90511B75A002189FCB11DFA9C895AAEBBF9FF49700F11806AF504EB751D7789D40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4F0 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B566
73A1A570.USER32(?,00000000,0041B640,?,?,?,?), ref: 0041B572
73A24620.GDI32(?,00000068,00000000,0041B614,?,?,00000000,0041B640,?,?,?,?), ref: 0041B58E
73A4E680.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B614,?,?,00000000,0041B640,?,?,?,?), ref: 0041B5AB
73A4E680.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B614,?,?,00000000,0041B640), ref: 0041B5C2
73A1A480.USER32(?,?,0041B61B,?,?), ref: 0041B60E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: E680$A24620A480A570Focus
String ID:
API String ID: 3709697839-0
Opcode ID: 17c1b08f9844acdc802f8e535b6c9e4446ce47f3e55dce3a221187752f3c61b8
Instruction ID: be02c3be859bf01bab4daeb430cba663bcef9c8b7ac46c13fc9acf689f5ddf0f
Opcode Fuzzy Hash: 17c1b08f9844acdc802f8e535b6c9e4446ce47f3e55dce3a221187752f3c61b8
Instruction Fuzzy Hash: 1441E871A00658AFCB10DFA9C885AAFBBF5EF59704F1584AAF500E7351D3389D10CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD74 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDBD
GetSystemMetrics.USER32(0000000C), ref: 0041BDC7
73A1A570.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDD1
73A24620.GDI32(00000000,0000000E,00000000,0041BE44,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDF8
73A24620.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BE44,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE05
73A1A480.USER32(00000000,00000000,0041BE4B,0000000E,00000000,0041BE44,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE3E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A24620MetricsSystem$A480A570
String ID:
API String ID: 4042297458-0
Opcode ID: 0df12c8d62bb939400ca0da0d7898a429962746ff966cd16a11938031c817c34
Instruction ID: 6ac2cf66a2cb7e3e475dd524f6c78ba3bd0a364a30d5c052a6fa0d279a6d40ba
Opcode Fuzzy Hash: 0df12c8d62bb939400ca0da0d7898a429962746ff966cd16a11938031c817c34
Instruction Fuzzy Hash: 1A212874E00649AFEB10EFA9C882BEEB7B4EB48714F10802AF514B7780D7795940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0047C854 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047C862
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046B9FC), ref: 0047C888
GetWindowLongA.USER32(?,000000EC), ref: 0047C898
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047C8B9
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047C8CD
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047C8E9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 8c70efdb4814a6ff2c3b7a8bd3aab8f7602cd57d1f979745abfa1706a0c2e60c
Instruction ID: a0480a7355ec7c351c557c8ac51ba8c1a6d938bc9602d29c2a7bb312f8a5b3e0
Opcode Fuzzy Hash: 8c70efdb4814a6ff2c3b7a8bd3aab8f7602cd57d1f979745abfa1706a0c2e60c
Instruction Fuzzy Hash: 63011EB5651310ABD700E768CD81F663798AB0D338F0A027AB999DF3E2C639DC109B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041B258 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6C8: CreateBrushIndirect.GDI32 ref: 0041A733

UnrealizeObject.GDI32(00000000), ref: 0041B264
SelectObject.GDI32(?,00000000), ref: 0041B276
SetBkColor.GDI32(?,00000000), ref: 0041B299
SetBkMode.GDI32(?,00000002), ref: 0041B2A4
SetBkColor.GDI32(?,00000000), ref: 0041B2BF
SetBkMode.GDI32(?,00000001), ref: 0041B2CA

Part of subcall function 0041A040: GetSysColor.USER32(?), ref: 0041A04A

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 119d1b42e4442e97da8ea338fe5b39c5348f28ab57e5b049b79d1ef89492a8b8
Instruction ID: 43bdc70ad03e216046bf5eb3befce14516e6141ecec4e97f80abccfc171ef350
Opcode Fuzzy Hash: 119d1b42e4442e97da8ea338fe5b39c5348f28ab57e5b049b79d1ef89492a8b8
Instruction Fuzzy Hash: 97F0BFB1151500ABCF00FFBAD9CAE4B27ACAF443097048457B544DF19BC53CD8504B3A

Uniqueness

Uniqueness Score: -1.00%

Function 00496058 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242AC: SetWindowTextA.USER32(?,00000000), ref: 004242C4

ShowWindow.USER32(?,00000005,00000000,004962BD,?,?,00000000), ref: 0049608E

Part of subcall function 0042D868: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D87B

Part of subcall function 00407288: SetCurrentDirectoryA.KERNEL32(00000000,?,004960B6,00000000,00496289,?,?,00000005,00000000,004962BD,?,?,00000000), ref: 00407293

Part of subcall function 0042D3F0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D47E,?,?,?,00000001,?,004551E6,00000000,0045524E), ref: 0042D425

Strings

.dat, xrefs: 004960D5
.msg, xrefs: 004960F4
Uninstall, xrefs: 00496074
IMsg, xrefs: 00496162

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 98951bc155f0608bb744c29c03173cf31201980e52192acc6f6e8f643d3a950d
Instruction ID: 4d5ad50552d6dad07fa801569c23eaecf2cc15b5db61348b0cbea2f80843ebcf
Opcode Fuzzy Hash: 98951bc155f0608bb744c29c03173cf31201980e52192acc6f6e8f643d3a950d
Instruction Fuzzy Hash: 1D31B334A006189FDB00FF65DD5295E7B75FB45708F51887AF800A7392CB79AD01DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0049650C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,\nI,00000000,00496602,?,?,00000000,0049A628), ref: 0049657C
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,\nI,00000000,00496602,?,?,00000000,0049A628), ref: 004965A5
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004965BE

Strings

\nI, xrefs: 0049654B, 00496565, 004965F4, 0049654E
isRS-%.3u.tmp, xrefs: 0049655B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: File$Attributes$Move
String ID: \nI$isRS-%.3u.tmp
API String ID: 3839737484-2987684456
Opcode ID: 0894b97a96aef8c868b96fffa263a311636645656615b9a6d228ed9445ca926c
Instruction ID: 563d2e76b9e5a21ffbe4f6293c68080067c427bcface4cd0eb650ccff7f3f32d
Opcode Fuzzy Hash: 0894b97a96aef8c868b96fffa263a311636645656615b9a6d228ed9445ca926c
Instruction Fuzzy Hash: 29216171E04219ABCF01EFA9D8819AFBBB8EF44314F52453BB814B72D1D6389E018A59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8F4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042E926
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E92C
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042E955

Strings

user32.dll, xrefs: 0042E921
ShutdownBlockReasonCreate, xrefs: 0042E91C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: 083bd73b3a57b2c737c687ad4ea0f6b7ff9c77bc07e98a1005f031f642bdcf7d
Instruction ID: c1538ad6e73312534a36969f76a12c14ace08a3a82fdd452fed24f65bcb55ef8
Opcode Fuzzy Hash: 083bd73b3a57b2c737c687ad4ea0f6b7ff9c77bc07e98a1005f031f642bdcf7d
Instruction Fuzzy Hash: 00F0C2E134062276E660B2BFACC2F7F148C8F94725F540137B108EA2C2E96C8905426F

Uniqueness

Uniqueness Score: -1.00%

Function 004531B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 004531BF

Part of subcall function 00406F30: DeleteFileA.KERNEL32(00000000,0049A628,004969ED,00000000,00496A42,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F3B

MoveFileA.KERNEL32(00000000,00000000), ref: 004531E4

Part of subcall function 004527FC: GetLastError.KERNEL32(00000000,0045326D,00000005,00000000,004532A2,?,?,00000000,0049A628,00000004,00000000,00000000,00000000,?,004966A1,00000000), ref: 004527FF

Strings

MoveFile, xrefs: 004531ED
DeleteFile, xrefs: 004531D0
\nI, xrefs: 00453294

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile$\nI
API String ID: 3024442154-1067230999
Opcode ID: 7156d84c7b7d2853cac7a1be5e48cd4f93187ff1da739ba0e3892c1e2a653d6d
Instruction ID: 291e0caee6beb33f6ae25bb805f8f1650d7dc6c3cf4698b78b7b56a94a9abe8b
Opcode Fuzzy Hash: 7156d84c7b7d2853cac7a1be5e48cd4f93187ff1da739ba0e3892c1e2a653d6d
Instruction Fuzzy Hash: 7EF062702146445BEB00EFA6D94266E67ECEB4434BF60443BF800B7683DA3C9E094929

Uniqueness

Uniqueness Score: -1.00%

Function 0042E7F8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042E8BC,00000004,00498934,00456035,004563D8,00455F8C,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E80E
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E814
InterlockedExchange.KERNEL32(0049A660,00000001), ref: 0042E825

Strings

user32.dll, xrefs: 0042E809
ChangeWindowMessageFilter, xrefs: 0042E804

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 9e460d262acf90b746ec3bde9ef241f636213dcbfc0aff1b946f85e68eed8624
Instruction ID: af40488fdc13ea5f0a74c96e39c23783f5695669f32ba7161e5c7fcb4ab476bb
Opcode Fuzzy Hash: 9e460d262acf90b746ec3bde9ef241f636213dcbfc0aff1b946f85e68eed8624
Instruction Fuzzy Hash: B1E0ECB1741310AADE107B62AD8AF5B3654E724715F5C443BF181661E2C6BD0CA0C95E

Uniqueness

Uniqueness Score: -1.00%

Function 004762B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004762BC
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004763B3,0049B048,00000000), ref: 004762CF
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004762D5

Strings

user32.dll, xrefs: 004762CA
AllowSetForegroundWindow, xrefs: 004762C5

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: 7f98f43397a9b6b67b62abbb79cc0086ae238535ca0765badbb258860dac0eff
Instruction ID: fe4a12fdd5c34a6c44b2e884ece8a8160a9aff216a269c429a1620e81a41c3e3
Opcode Fuzzy Hash: 7f98f43397a9b6b67b62abbb79cc0086ae238535ca0765badbb258860dac0eff
Instruction Fuzzy Hash: 31D0A7B0200F01EAED10B3F15D4AD5B234ECD84714711C47B3814E6183CA3CD804893C

Uniqueness

Uniqueness Score: -1.00%

Function 0044ED7C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00496EEE), ref: 0044EDB7
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044EDBD

Strings

HD, xrefs: 0044ED8F
user32.dll, xrefs: 0044EDB2
NotifyWinEvent, xrefs: 0044EDAD

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: HD$NotifyWinEvent$user32.dll
API String ID: 1646373207-3826198660
Opcode ID: b962c4a0bdd04a3d8f0cee902d42f3f17fb110725d15459fbdf9d276febc4f36
Instruction ID: f7f1d492e6724cf617ef4c2160391edda5d29ed164744fb688b7ed0daf2a5a02
Opcode Fuzzy Hash: b962c4a0bdd04a3d8f0cee902d42f3f17fb110725d15459fbdf9d276febc4f36
Instruction Fuzzy Hash: BEE012F4E413019AFB40FFBB5947B192AA0BBA431DB04407FB40466192CB7C48208F5F

Uniqueness

Uniqueness Score: -1.00%

Function 00416C14 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C3A
SaveDC.GDI32(?), ref: 00416C6B
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D2D), ref: 00416CCC
RestoreDC.GDI32(?,?), ref: 00416CF3
EndPaint.USER32(00000000,?,00416D34,00000000,00416D2D), ref: 00416D27

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: 16ea6fe72d0a67e6752744a777096d4696b382ed41d4f8742cdf05d287066012
Instruction ID: 03e1e3e3319143dc4a968aea8456d553e58372997a22922a21284cc38e8d198a
Opcode Fuzzy Hash: 16ea6fe72d0a67e6752744a777096d4696b382ed41d4f8742cdf05d287066012
Instruction Fuzzy Hash: C0413D70A04204AFDB14DBA9C585FAAB7F8EF48314F1640AAE8459B362D778DD41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004147E8 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 0041481E
MulDiv.KERNEL32(?,?,?), ref: 00414838
MulDiv.KERNEL32(?,?,?), ref: 00414861
MulDiv.KERNEL32(?,?,?), ref: 0041488C
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148D4

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6edf728b0c42de24ff2e528c1653778a2220952e7f02e6982977a2359f8597
Instruction ID: 443b87a0ee2644abb9360fba34c74d55fcd0368eb1eab09e5f4fbf2613e6a921
Opcode Fuzzy Hash: 2e6edf728b0c42de24ff2e528c1653778a2220952e7f02e6982977a2359f8597
Instruction Fuzzy Hash: 0E311E74604780AFC320EF69C984BABB7E8AF89714F04891EF9D5C7751C638EC808B19

Uniqueness

Uniqueness Score: -1.00%

Function 004297B4 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 004297F0
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 0042981F
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 0042983B
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 00429866
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 00429884

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a9412af26c33b81cba4159b7563f7f316b19aa3d7953a3cef045392e39d59574
Instruction ID: 383ba272c364ba55b3c4c944082bb2ae4011b1553e559178bd08082a49e480ad
Opcode Fuzzy Hash: a9412af26c33b81cba4159b7563f7f316b19aa3d7953a3cef045392e39d59574
Instruction Fuzzy Hash: CA21AF707507147AE710BB66CC82F8B7AACEB42718F94043EB901BB2D2DB799D41826C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBA0 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBB2
GetSystemMetrics.USER32(0000000C), ref: 0041BBBC
73A1A570.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BBFA
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BD65,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BC41
DeleteObject.GDI32(00000000), ref: 0041BC82

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: MetricsSystem$A26310A570DeleteObject
String ID:
API String ID: 4277397052-0
Opcode ID: 632a9429606b09a093a7d6e7127f2bc34ea9512a51f79ed98bc04dcc40fefe79
Instruction ID: cd8e556df717dd5b5400d21712ca2c64c6068fedc09be683e35ab3f3aea47ce2
Opcode Fuzzy Hash: 632a9429606b09a093a7d6e7127f2bc34ea9512a51f79ed98bc04dcc40fefe79
Instruction Fuzzy Hash: 74315274E00609EFDB04DFA5C941AAEF7F5EB48704F11856AF510AB381D7789E80DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 40462338183cbb1311dfebad793113c38e9d5a114e6fdb44db9785adf1e72679
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: 40462338183cbb1311dfebad793113c38e9d5a114e6fdb44db9785adf1e72679
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Uniqueness

Uniqueness Score: -1.00%

Function 004143C8 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

73A18830.GDI32(00000000,00000000,00000000), ref: 00414401
73A122A0.GDI32(00000000,00000000,00000000,00000000), ref: 00414409
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041441D
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00414423
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041442E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A122A18830$A480
String ID:
API String ID: 3325508737-0
Opcode ID: 4d4dfbe96ba826e8f264f0e5d6029cd50952ac5696d8ac5b07e09d206b5e9ea0
Instruction ID: d6a8c37a96f406e62d9220a552f3636df258dcb6eaae1d75a6e4c5372ed043fd
Opcode Fuzzy Hash: 4d4dfbe96ba826e8f264f0e5d6029cd50952ac5696d8ac5b07e09d206b5e9ea0
Instruction Fuzzy Hash: 1401DF3521C3806AE200B63E8C85A9F6BEC8FCA714F05546EF098DB382CA7ACC018765

Uniqueness

Uniqueness Score: -1.00%

Function 00424CC8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F05C: GetActiveWindow.USER32 ref: 0041F05F
Part of subcall function 0041F05C: GetCurrentThreadId.KERNEL32 ref: 0041F074
Part of subcall function 0041F05C: 73A25940.USER32(00000000,Function_0001F038), ref: 0041F07A

Part of subcall function 00423190: GetSystemMetrics.USER32(00000000), ref: 00423192

OffsetRect.USER32(?,?,?), ref: 00424DB1
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E74
OffsetRect.USER32(?,?,?), ref: 00424E85

Part of subcall function 0042354C: GetCurrentThreadId.KERNEL32 ref: 00423561
Part of subcall function 0042354C: SetWindowsHookExA.USER32(00000003,00423508,00000000,00000000), ref: 00423571
Part of subcall function 0042354C: CreateThread.KERNEL32(00000000,000003E8,004234B8,00000000,00000000), ref: 00423595

Part of subcall function 00424B14: SetTimer.USER32(00000000,00000001,?,0042349C), ref: 00424B2F

Strings

^LB, xrefs: 00424CDB, 00424DB9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$A25940ActiveCreateDrawHookMetricsSystemTextTimerWindowWindows
String ID: ^LB
API String ID: 1906964682-1568537117
Opcode ID: f0ee42d83cdc482020b724c1ab8bf6f75efb1fa829b450050cfecabafd34000c
Instruction ID: 1c571a2e0202a49c00b30b64db7fa21a714ef4218f88d48ac64b06535bd31de3
Opcode Fuzzy Hash: f0ee42d83cdc482020b724c1ab8bf6f75efb1fa829b450050cfecabafd34000c
Instruction Fuzzy Hash: A6812575A00218CFDB14DFA8C884ADEBBF4FF49304F51416AE805AB296EB78AD45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406F84 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00406FE3
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040705D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070B5

Strings

Z, xrefs: 0040701C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 8e45a508a275f8d19e1b220d08d314c4c2bdb250950aeca028ce3cb61823bc25
Instruction ID: fc3385a05c128efc50fcd669146f3a3a020ed707f27dd0bd8925003e0ff73f45
Opcode Fuzzy Hash: 8e45a508a275f8d19e1b220d08d314c4c2bdb250950aeca028ce3cb61823bc25
Instruction Fuzzy Hash: A3516070E04208ABDB11DF65C845A9EBBB9EF49304F1081BAE500BB3D1D778AE45CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0044C5F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044C686
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044C6B1
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044C739

Strings

, xrefs: 0044C66B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 376b7d392e2a7307553df1ab18c3ddb275d00b9527ede2d07debb28ed6b55a5f
Instruction ID: b63f043175787a44f28a4b43282f30ef61c1a1644475def0b68498de72d51a41
Opcode Fuzzy Hash: 376b7d392e2a7307553df1ab18c3ddb275d00b9527ede2d07debb28ed6b55a5f
Instruction Fuzzy Hash: 0D516171901244AFDB50DFA5C8C5BDEBBF9AF48304F09847AE845EB252D738A944CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0042EBCC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,00000000,0042ED20,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042EBF6

Part of subcall function 0041A1D0: CreateFontIndirectA.GDI32(?), ref: 0041A28F

SelectObject.GDI32(?,00000000), ref: 0042EC19
73A1A480.USER32(00000000,?,0042ED05,00000000,0042ECFE,?,00000000,00000000,0042ED20,?,?,?,?,00000000,00000000,00000000), ref: 0042ECF8

Strings

...\, xrefs: 0042ECAA

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: A480A570CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 2998766281-983595016
Opcode ID: 4846ec47f17ee5488c6e9c950676fef11b8ee2913f3253d1a52955b7ccb3cf08
Instruction ID: 7453103fbe016f60fab338fca086c32b62f357f47d6b07848e938ab02232d348
Opcode Fuzzy Hash: 4846ec47f17ee5488c6e9c950676fef11b8ee2913f3253d1a52955b7ccb3cf08
Instruction Fuzzy Hash: D9316F70B00229ABDB11EB9BD841BAEB7B9EB48308F91447AF410A7291D7785E01CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00452C1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004950B1,\nI,?,00000000,00452D56), ref: 00452D0B
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004950B1,\nI,?,00000000,00452D56), ref: 00452D1B

Strings

\nI, xrefs: 00452CAD
.tmp, xrefs: 00452CBF

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$\nI
API String ID: 3498533004-1657403358
Opcode ID: f6208e6fe33eca672dee3c9acfed42d7fbbd8fd5d96c5f2240b38ef860f24016
Instruction ID: 6641462a91bbea351ddec20e413cadf29559210fe3152e4b24b6a5c750fc2ada
Opcode Fuzzy Hash: f6208e6fe33eca672dee3c9acfed42d7fbbd8fd5d96c5f2240b38ef860f24016
Instruction Fuzzy Hash: 5A31A970A00209ABDB11EB95C942BDEBBB5AF45305F50442BF800B73D2D7785F09C768

Uniqueness

Uniqueness Score: -1.00%

Function 004163F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 00416467
UnregisterClassA.USER32(?,00400000), ref: 00416493
RegisterClassA.USER32(?), ref: 004164B6

Strings

@, xrefs: 00416411

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 0a8cc3b2f17ac4381349db0350fb2ff2171dc7f48e36bafdf10ef5e516c740eb
Instruction ID: fa80f34e80ce72a7157469a99740f616e20ddf3543068d20a7a32910f6f97878
Opcode Fuzzy Hash: 0a8cc3b2f17ac4381349db0350fb2ff2171dc7f48e36bafdf10ef5e516c740eb
Instruction Fuzzy Hash: E5318C706042409BD720EF68C985BDB77E5AB98308F00457FFA45DB392DB39D9848B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00455A40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C7A8: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C7CC

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00455A94
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00455AC1

Strings

RegisterTypeLib, xrefs: 00455ACC
LoadTypeLib, xrefs: 00455A9F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 42f504823ca98d41addfabf493d63b08436e80606897518654ecf2745b8768bc
Instruction ID: a107af06ca24713579a9f59546026f32d234bf23ddff17bfe20c85435272d302
Opcode Fuzzy Hash: 42f504823ca98d41addfabf493d63b08436e80606897518654ecf2745b8768bc
Instruction Fuzzy Hash: CB118130A00A04AFDB11EFA6CDA6E6EB7ADEF89705B108476B904D7652DA789D04CA14

Uniqueness

Uniqueness Score: -1.00%

Function 00455F98 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00455FB2
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 0045604F

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00455FDE
Failed to create DebugClientWnd, xrefs: 00456018

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: ac049d8fe273c18747176890294fd1bb2bea1aca9f2d2cd756fe056c7422034d
Instruction ID: 8101da392541b400ae5b795579f0d3e58c1a7d4edfb3ba9888df2f93032852a6
Opcode Fuzzy Hash: ac049d8fe273c18747176890294fd1bb2bea1aca9f2d2cd756fe056c7422034d
Instruction Fuzzy Hash: 5E11E3B0604350AFE710EB698C81B5B7B989F55718F45443BF984DB3C3D7B98818CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00494630 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004946F8,?,004946EC,00000000,004946D3), ref: 0049469E
CloseHandle.KERNEL32(8GI,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,004946F8,?,004946EC,00000000), ref: 004946B5

Part of subcall function 00494588: GetLastError.KERNEL32(00000000,00494620,?,?,?,?), ref: 004945AC

Strings

D, xrefs: 00494678
8GI, xrefs: 004946B1, 004946B4

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: 8GI$D
API String ID: 3798668922-2929899198
Opcode ID: 5762a93c52b3abf7e00052e7c186dd083a7c919334be8cfda6e4d8fd860ac32c
Instruction ID: 91b9c8945242908719221f4f270b117abe2ae84f1159afd9c81a063f896f5909
Opcode Fuzzy Hash: 5762a93c52b3abf7e00052e7c186dd083a7c919334be8cfda6e4d8fd860ac32c
Instruction Fuzzy Hash: DE015EB1604248AFDB00EB91CC42E9FBBACEB49714F51007AB504E7691D67C9E158668

Uniqueness

Uniqueness Score: -1.00%

Function 00476E0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242AC: SetWindowTextA.USER32(?,00000000), ref: 004242C4

GetFocus.USER32 ref: 00476E77
GetKeyState.USER32(0000007A), ref: 00476E89
WaitMessage.USER32(?,00000000,00476EB0,?,00000000,00476ED7,?,?,00000001,00000000,?,?,?,0047E5AA,00000000,0047F4AB), ref: 00476E93

Strings

Wnd=$%x, xrefs: 00476E5B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: 487d88f660e2db342b28d8ea9a610eec796a45953038bcf55554d2f05921c81e
Instruction ID: ab57e28be1e4fcc0e1ddb7abdb903e3276d19df6d4f808f79b30ce90165c1ed7
Opcode Fuzzy Hash: 487d88f660e2db342b28d8ea9a610eec796a45953038bcf55554d2f05921c81e
Instruction Fuzzy Hash: 8611A774604644AFC700EF65DC41EDE77BAEB09308B5284BAF808E3681D7386D00CB7A

Uniqueness

Uniqueness Score: -1.00%

Function 0046D2B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(000000FF), ref: 0046D2B8
FileTimeToSystemTime.KERNEL32(?,?,000000FF), ref: 0046D2C7

Strings

(invalid), xrefs: 0046D34A
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046D33C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 36d9bebcf48fc4e47daec87f7ec0e8c2e6e4ef91435bbded2fa0d0d9e98eec99
Instruction ID: a2bc08620057326219c40d993f6a8a3ba00e8e6f5ef9a56d20be324eed520211
Opcode Fuzzy Hash: 36d9bebcf48fc4e47daec87f7ec0e8c2e6e4ef91435bbded2fa0d0d9e98eec99
Instruction Fuzzy Hash: DD11FBA490C3919ED340DF6AC44432FBBE4AB89704F04496EF9D8D6381E779C988DB67

Uniqueness

Uniqueness Score: -1.00%

Function 00458700 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,0045883D,00000000,004589F5,?,00000000,00000000,00000000), ref: 0045874D

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00458720
InstallRoot, xrefs: 0045873C
.NET Framework not found, xrefs: 0045875C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 0d67f79db1d11d0032434b1f69172327e0c7ca74904ec16c403dac35e76e3c37
Instruction ID: 86385215b14aa4bd85385ed386ba8ee4b547d3e34f26af389d27f961ba584293
Opcode Fuzzy Hash: 0d67f79db1d11d0032434b1f69172327e0c7ca74904ec16c403dac35e76e3c37
Instruction Fuzzy Hash: B5F0AF727001109BC710EB1ADC45B4A6699DBD9356F70443FF980E725ACF78CC06866E

Uniqueness

Uniqueness Score: -1.00%

Function 00481B00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00481B41
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00481B64

Strings

System\CurrentControlSet\Control\Windows, xrefs: 00481B0E
CSDVersion, xrefs: 00481B38

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 39248bbe456b169cc99e3b092f271958bef425fb462f132eb437649bbee1014a
Instruction ID: d4eb2fabfffeea21f828f3fdb10868f6bd1cb5e37b018e891f73b8bc1f729c42
Opcode Fuzzy Hash: 39248bbe456b169cc99e3b092f271958bef425fb462f132eb437649bbee1014a
Instruction Fuzzy Hash: B6F03175E4020CAADF10EAE18C45BAF73BCEB14704F104967E910E7291F678AA058B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042D894 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00452EBA,00000000,00452F5D,?,?,00000000,00000000,00000000,00000000,00000000,?,00453229,00000000), ref: 0042D8AE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D8B4

Strings

GetSystemWow64DirectoryA, xrefs: 0042D8A4
kernel32.dll, xrefs: 0042D8A9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: e5f508ec5dc001122720bbe4664bdc426e1182a3fdd4e1cf48d1cf9e38e4094c
Instruction ID: 2275d08308b165e9e0622e0b8aed55941db7b7b97042d88504f839f086166f53
Opcode Fuzzy Hash: e5f508ec5dc001122720bbe4664bdc426e1182a3fdd4e1cf48d1cf9e38e4094c
Instruction Fuzzy Hash: C9E04FA1F40B1012D71076BA6C82B5B158D8B84724FA4843B39A4E62C3DEBCD944AE5E

Uniqueness

Uniqueness Score: -1.00%

Function 0042E9A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042E91C), ref: 0042E9AE
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9B4

Strings

ShutdownBlockReasonDestroy, xrefs: 0042E9A4
user32.dll, xrefs: 0042E9A9

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 21c9fa3a2d11ff7284b7675fe2bc2137e574b6faa2fa7b2d94cb811354c27e86
Instruction ID: fe073370cef51c3703db6b7fb7ad7ea86c472328d3868f31f6acb5ff3f9c01d5
Opcode Fuzzy Hash: 21c9fa3a2d11ff7284b7675fe2bc2137e574b6faa2fa7b2d94cb811354c27e86
Instruction Fuzzy Hash: 30D0C7D271177256595175F73CD1AEB018C8D146B53541477F500F5141E65DCC8155AC

Uniqueness

Uniqueness Score: -1.00%

Function 00496C64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00496F3F,00000001,00000000,00496F63), ref: 00496C6E
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00496C74

Strings

DisableProcessWindowsGhosting, xrefs: 00496C64
user32.dll, xrefs: 00496C69

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 36ef3444fa3ca6611e99739fe395530270c8f25b62f63714864b18ed002405a7
Instruction ID: 8660657ad8ffdb3818d4ec5ebda05fdf68863284740220a37be85ac82002cc40
Opcode Fuzzy Hash: 36ef3444fa3ca6611e99739fe395530270c8f25b62f63714864b18ed002405a7
Instruction Fuzzy Hash: 41B00291791741549D6032F20D96A1B0858C8917A9B66057774E8F61C6DD6CA904582D

Uniqueness

Uniqueness Score: -1.00%

Function 00463998 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044AC90: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044EDAD,00496EEE), ref: 0044ACB7
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044ACCF
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044ACE1
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044ACF3
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044AD05
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044AD17
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044AD29
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044AD3B
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044AD4D
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044AD5F
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044AD71
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044AD83
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044AD95
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044ADA7
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044ADB9
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044ADCB
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044ADDD
Part of subcall function 0044AC90: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044ADEF

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00496F11), ref: 004639A7
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 004639AD

Strings

shell32.dll, xrefs: 004639A2
SHPathPrepareForWriteA, xrefs: 0046399D

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 87b08c8b6191556c9a0c39310b7190fc6992e2adf9615a07a76443d842a308cd
Instruction ID: d58f98c37e49cf89cd65eb7f8077158a14b36975b6f8973cacb4338f5eeecc27
Opcode Fuzzy Hash: 87b08c8b6191556c9a0c39310b7190fc6992e2adf9615a07a76443d842a308cd
Instruction Fuzzy Hash: 7CB092E0A81B80A19E00FFB22A87A0B10088554B0AB10007F7008B9183EEBC11084D6E

Uniqueness

Uniqueness Score: -1.00%

Function 0047BE38 Relevance: 6.2, APIs: 4, Instructions: 194fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047BFA8,?,?,?,?,00000000,0047C0FD,?,00000000,?,00000000,?,0047C251), ref: 0047BF84
FindClose.KERNEL32(000000FF,0047BFAF,0047BFA8,?,?,?,?,00000000,0047C0FD,?,00000000,?,00000000,?,0047C251,00000000), ref: 0047BFA2

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 9aaa0953431bb21a78cb54c65b2df6b2b97c64a82b0dd2856713064ca1519057
Instruction ID: a402577b2c58905a9d1885d09e8e39d8c358a8e002e7fd7631d24f9962583542
Opcode Fuzzy Hash: 9aaa0953431bb21a78cb54c65b2df6b2b97c64a82b0dd2856713064ca1519057
Instruction Fuzzy Hash: 0D812C3490024D9FCF11DFA5CC81BDFBBB9EB49304F5084AAE408A7291D7399A46CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00413CE0 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D2E
GetDesktopWindow.USER32 ref: 00413DE6

Part of subcall function 00418EA8: 6F5BC6F0.COMCTL32(?,00000000,00413FAB,00000000,004140BB,?,?,0049A628), ref: 00418EC4
Part of subcall function 00418EA8: ShowCursor.USER32(00000001,?,00000000,00413FAB,00000000,004140BB,?,?,0049A628), ref: 00418EE1

SetCursor.USER32(00000000,?,?,?,?,00413ADB,00000000,00413AEE), ref: 00413E24

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: d952c8c129c069f382cd386b7de7329279eaed5a8884da675d8caadbd4d77934
Instruction ID: ece583def3ae3bec66251b8eb53a3083707ce0208ac3aa2b878898e1aeac743c
Opcode Fuzzy Hash: d952c8c129c069f382cd386b7de7329279eaed5a8884da675d8caadbd4d77934
Instruction Fuzzy Hash: A1414C75700250AFCB10EF39E984B5677E1AB68325B16807BE404CB365DB38DD91CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00408A34 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A55
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AC4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B5F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408B9E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: fea9a368a89c386dd3579c3314086181e5495c38b00c0fb169f00db9bc71266b
Instruction ID: 00047562bc896292eae92fc83f22833cb5706b72e5976c979f35d299ad0ec2f6
Opcode Fuzzy Hash: fea9a368a89c386dd3579c3314086181e5495c38b00c0fb169f00db9bc71266b
Instruction Fuzzy Hash: 853112716083809BE330EB65C945BDB77E89B85704F44483FB6C8D72D1EB7999048B6B

Uniqueness

Uniqueness Score: -1.00%

Function 0044DEFC Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044DF45

Part of subcall function 0044C588: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044C5BA

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044DFC9

Part of subcall function 0042BB9C: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBB0

IsRectEmpty.USER32(?), ref: 0044DF8B
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044DFAE

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: f3a57beacc7deec48f8f8280ea100c1b8bec1928a737322d8a0c719621f816dd
Instruction ID: aef3801dd175dc9c32e5e06c16a8f84906a60ef011ead4f401377c2e5f976240
Opcode Fuzzy Hash: f3a57beacc7deec48f8f8280ea100c1b8bec1928a737322d8a0c719621f816dd
Instruction Fuzzy Hash: 99114A72B4031027E620BA7A8C86B5F66C99B98759F04083FB506EB383DE7DDC194399

Uniqueness

Uniqueness Score: -1.00%

Function 00493BB8 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00493C1C
OffsetRect.USER32(?,00000000,?), ref: 00493C37
OffsetRect.USER32(?,?,00000000), ref: 00493C51
OffsetRect.USER32(?,00000000,?), ref: 00493C6C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 37c02f2732351b85fe6e18ebd3d448150a5576b07545843ebd70591764eaa53f
Instruction ID: f65d0900f560fcc952ae0e27cf9e39305c7a0972bf48f558fbf7b8a6fb88b1c7
Opcode Fuzzy Hash: 37c02f2732351b85fe6e18ebd3d448150a5576b07545843ebd70591764eaa53f
Instruction Fuzzy Hash: A0218CB6704201ABDB00DE69CD85E6BBBDEEBC4305F14CA2AF954C7249D634E90487A6

Uniqueness

Uniqueness Score: -1.00%

Function 00417200 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417248
SetCursor.USER32(00000000), ref: 0041728B
GetLastActivePopup.USER32(?), ref: 004172B5
GetForegroundWindow.USER32(?), ref: 004172BC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: f9b7bf21fd8922fb7f9da71226400e527e4ad197ed769eca181c9807d9be9f57
Instruction ID: b826a2350a425d8d56277764797b706088dbb3a68c20bc35c201dc7f13df9d46
Opcode Fuzzy Hash: f9b7bf21fd8922fb7f9da71226400e527e4ad197ed769eca181c9807d9be9f57
Instruction Fuzzy Hash: 9221B3313042008ACB10EB69C984AD733B1AF58768B5685BBF8449B392D73DDCC2CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00493870 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000008,?), ref: 00493885
MulDiv.KERNEL32(?,00000008,?), ref: 00493899
MulDiv.KERNEL32(?,00000008,?), ref: 004938AD
MulDiv.KERNEL32(?,00000008,?), ref: 004938CB

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c743c6b27eefd6cab486c462f54d795bae45f37f50d13c17f9c8637463e693f
Instruction ID: 5653efebbc7a30ab2eb6b0d7d640e5bf66e03e3c642689ea58aa2ed4b22252ee
Opcode Fuzzy Hash: 6c743c6b27eefd6cab486c462f54d795bae45f37f50d13c17f9c8637463e693f
Instruction Fuzzy Hash: 8E112472604204AFCF40EE99D8C4D9B7BECEF4D364B1441A6F918DB246D634ED408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041F468 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F458,?), ref: 0041F489
UnregisterClassA.USER32(0041F458,00400000), ref: 0041F4B2
RegisterClassA.USER32(00498598), ref: 0041F4BC
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F4F7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 0b1a5e90ea599a0961c5be15fe06e8290fc74b2ca7d7cec1263de347709274d1
Instruction ID: 9d7d8ad8aa831552a82a53d5345394442936d3ade59afb2306efe89d8dafa453
Opcode Fuzzy Hash: 0b1a5e90ea599a0961c5be15fe06e8290fc74b2ca7d7cec1263de347709274d1
Instruction Fuzzy Hash: 3E0140712401047BCB10EF69DC81E9B3798A769314B11413BBA05E72E2DA3A9D199BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1E8 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D1FF
LoadResource.KERNEL32(00400000,72756F73,0040A9A0,00400000,00000001,00000000,?,0040D15C,00000000,?,00000000,?,?,0047B138,0000000A,REGDLL_EXE), ref: 0040D219
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A9A0,00400000,00000001,00000000,?,0040D15C,00000000,?,00000000,?,?,0047B138), ref: 0040D233
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A9A0,00400000,00000001,00000000,?,0040D15C,00000000,?,00000000,?), ref: 0040D23D

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: b72bee812b4bf47a05f7cdcf57bf9b781682874112b85cf5d766e00015fd305b
Instruction ID: 317aed317d3b892ebdcd66b9e6bae3e249017520f8437a3530a96d2459133adc
Opcode Fuzzy Hash: b72bee812b4bf47a05f7cdcf57bf9b781682874112b85cf5d766e00015fd305b
Instruction Fuzzy Hash: 09F01DB36056046F9745EE9EA881D6B77ECDF88364320017FF908EB256DA38DD118B78

Uniqueness

Uniqueness Score: -1.00%

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049A420,00000000,00401A82,?,?,0040222E,02150650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049A420,0049A420,00000000,00401A82,?,?,0040222E,02150650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049A420,00000000,00401A82,?,?,0040222E,02150650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049A420,00401A89,00000000,00401A82,?,?,0040222E,02150650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 32c3f79555f68ec1bc11d54ffe7e2d8c2f8c3d101e81e839edcab80f59bb9ff8
Instruction ID: b5067cfae5201e79e85213ffc863b03902d2ba9507e13bed97c350dada6f2a02
Opcode Fuzzy Hash: 32c3f79555f68ec1bc11d54ffe7e2d8c2f8c3d101e81e839edcab80f59bb9ff8
Instruction Fuzzy Hash: 9C01C0706442405EFB19AB69980A7263ED4D79574CF11803BF840A6AF1CAFC48A0CBAF

Uniqueness

Uniqueness Score: -1.00%

Function 0046EA50 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046EAA1

Strings

Unsetting NTFS compression on directory: %s, xrefs: 0046EA87
Setting NTFS compression on directory: %s, xrefs: 0046EA6F
Failed to set NTFS compression state (%d)., xrefs: 0046EAB2

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: 3f2085e131380c7f5da77398344f1736c5cf7d5eb251f8b2b402a33526aece9f
Instruction ID: 3efdd372df2affd4ade082c6483982d5e4590e080722fc2af47a54a846c8b7b9
Opcode Fuzzy Hash: 3f2085e131380c7f5da77398344f1736c5cf7d5eb251f8b2b402a33526aece9f
Instruction Fuzzy Hash: 1E016234E0824896CF14D7EE90412EDBBF49F09704F44C5EFE456EB282EA791A09C79B

Uniqueness

Uniqueness Score: -1.00%

Function 00454FB8 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045AB4A,?,?,?,?,?,00000000,0045AB71), ref: 00454FF4
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045AB4A,?,?,?,?,?,00000000), ref: 00454FFD
RemoveFontResourceA.GDI32(00000000), ref: 0045500A
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0045501E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: ff81541ad65e738e61be4b760b006228087a8c2549ae41a4e195221c2217dca6
Instruction ID: 939da9693d8b7a58c52c965e3ea10a2d1f3c938dc4a11dd4f6774f6072705970
Opcode Fuzzy Hash: ff81541ad65e738e61be4b760b006228087a8c2549ae41a4e195221c2217dca6
Instruction Fuzzy Hash: 4BF05EB574471136EA20B6BA9C87F6B228C9F58749F10483BBA00EF2C3D9BCD804566D

Uniqueness

Uniqueness Score: -1.00%

Function 0046F1FC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 0046F24D

Strings

Setting NTFS compression on file: %s, xrefs: 0046F21B
Unsetting NTFS compression on file: %s, xrefs: 0046F233
Failed to set NTFS compression state (%d)., xrefs: 0046F25E

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: 93f7f7ee3fbe46887396e0d59efa9c6872d48ff1b9f9f5449602dbfd64fe8072
Instruction ID: d4ac74669b66db6e3c059ab59b5fef26885b757fb78d8d61fce7d85db13fc410
Opcode Fuzzy Hash: 93f7f7ee3fbe46887396e0d59efa9c6872d48ff1b9f9f5449602dbfd64fe8072
Instruction Fuzzy Hash: 0E014834E0824856CF14D7DDA0512DDB7B49F49304F54C6FBA495D7242DA79050DCB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00476924 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,0047F4AB,?,?,?,?,?,00496FD2,00000000), ref: 0047692D
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,0047F4AB,?,?,?,?,?,00496FD2), ref: 00476933
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,0047F4AB), ref: 00476955
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,0047F4AB), ref: 00476966

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 6638d2616fdc4babfde8a22db633763a8ab16e525989c2c1e51a975794de3396
Instruction ID: 27bd0ef3eb54f5e8884fa922feac968426520882f0bbce2df0076db31bc8e5d6
Opcode Fuzzy Hash: 6638d2616fdc4babfde8a22db633763a8ab16e525989c2c1e51a975794de3396
Instruction Fuzzy Hash: 92F030A1644701ABD600EAB5CC82E9B77DCEB44754F04893A7E98D72C1D678DC18AB26

Uniqueness

Uniqueness Score: -1.00%

Function 00424228 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 00424234
IsWindowVisible.USER32(?), ref: 00424245
IsWindowEnabled.USER32(?), ref: 0042424F
SetForegroundWindow.USER32(?), ref: 00424259

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 82b6da80a40c4c1c4bf04df77498b935b9686ebc6b89ac6962e6542017b5bce5
Instruction ID: 2a7e14987d27369ef8710af098a3b5809c63b96fec088f20efa1dfba1a38df21
Opcode Fuzzy Hash: 82b6da80a40c4c1c4bf04df77498b935b9686ebc6b89ac6962e6542017b5bce5
Instruction Fuzzy Hash: B2E08691702535939E25772719C1A9B028CCDC53D434601A7BE24F7243DB1DCC0181BC

Uniqueness

Uniqueness Score: -1.00%

Function 00406284 Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406287
GlobalUnWire.KERNEL32(00000000), ref: 0040628E
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 00406293
GlobalFix.KERNEL32(00000000), ref: 00406299

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction ID: ad050c8fb554795a0ca7e59246f03ac17dd57b6c6051e6027a9978793207e39e
Opcode Fuzzy Hash: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction Fuzzy Hash: A0B009C5814A05B9EC0833B24C0BD3F141CD88072C3808A6FB458BA1839C7C9C402A3D

Uniqueness

Uniqueness Score: -1.00%

Function 00469C44 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 259windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 00469E4F
EnableMenuItem.USER32(00000000,00000000,00000000), ref: 00469E55

Strings

CurPageChanged, xrefs: 00469FF0

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: 53ce5a7be921c8bf30e2fca1d5e0a03a41b5f8c4c34f641526f963d138debfb9
Instruction ID: f1e669c9fe2375b542d712c7743f0cf24833e96c781f245e4a8257aed6fc37ff
Opcode Fuzzy Hash: 53ce5a7be921c8bf30e2fca1d5e0a03a41b5f8c4c34f641526f963d138debfb9
Instruction Fuzzy Hash: 08B13934604204DFCB11DB69D985EE973F9EF85304F2640B6F8049B362DB79AE41DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00478A8C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047A2FD,?,00000000,00000000,00000001,00000000,00478D29,?,00000000), ref: 00478CED

Strings

Failed to parse "reg" constant, xrefs: 00478CF4
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00478B61

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 07bf0a71d9d563af8cb629409e8f260d9455bbbb5403baebb8d212675b6d23ff
Instruction ID: 80855d84898bfaddbb6886241cdf265d67617a304eb8fc684ca52e8f7352bdc5
Opcode Fuzzy Hash: 07bf0a71d9d563af8cb629409e8f260d9455bbbb5403baebb8d212675b6d23ff
Instruction Fuzzy Hash: 69814275E00148AFCB11DF95C585ADEBBF9AF48314F10817AF815AB391DB38AE05CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00424928 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0042494D
WaitMessage.USER32(00000000,00424A41,?,?,?,?), ref: 00424A21

Strings

coI, xrefs: 004249DA, 004249E4, 00424A33

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CursorMessageWait
String ID: coI
API String ID: 4021538199-1488265783
Opcode ID: 9cd7eb64ed9fb77526c24434481c4f91bcece4e91d8d3d24096384cf43a00bf1
Instruction ID: 29e41b0b5ff4de018dadf6b1b630a4be1df661cdf43175d7bf3e4b0652e8eab1
Opcode Fuzzy Hash: 9cd7eb64ed9fb77526c24434481c4f91bcece4e91d8d3d24096384cf43a00bf1
Instruction Fuzzy Hash: 9031D2B17002248BCB11EF79E88579FB7A5EFC8304F95456AE808A7386D778DD80CA5C

Uniqueness

Uniqueness Score: -1.00%

Function 0046B8C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046B9EB
Failed to proceed to next wizard page; aborting., xrefs: 0046B9D7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 3c374b80a55c8dcbad6b4286dc741b37f39de5f616afe605c4fd7e84cbe6f9a0
Instruction ID: f6f5def29fd01a76a0e70968f9f656ccb6497193a2f872ccb259e7a909502bc5
Opcode Fuzzy Hash: 3c374b80a55c8dcbad6b4286dc741b37f39de5f616afe605c4fd7e84cbe6f9a0
Instruction Fuzzy Hash: 1631C470A04244EFDB11EB59E985B9977E4EB15304F1400BBF944DB3A2E7386D84C79E

Uniqueness

Uniqueness Score: -1.00%

Function 004775B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00481B1F,?,00000001,?,?,00481B1F,?,00000001,00000000), ref: 0042DD38

RegCloseKey.ADVAPI32(?,0047769E,?,?,00000001,00000000,00000000,004776B9), ref: 00477687

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00477612
%s\%s_is1, xrefs: 00477630

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 5c46ab6b9a0829493843b83eff8f251c7cec3d7ed61a6bdc21eab3c4f24e7e50
Instruction ID: c3e4b7c1c29be41fb09634d7eb1c3f6661502ee037a036ab57c0af5e881dc35e
Opcode Fuzzy Hash: 5c46ab6b9a0829493843b83eff8f251c7cec3d7ed61a6bdc21eab3c4f24e7e50
Instruction Fuzzy Hash: 70218474B086446FDB01DFA9C851A9EBBE8EB49314F90847AE404E7385D7789D01CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0044F688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 0044F71D
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0044F74E

Strings

open, xrefs: 0044F741

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: 8557d672ea6816ff7fb14c5c51ec05fd81896cd129512ca080232f47c9d3c73e
Instruction ID: 07fa3aa9e6481adb3f177055b8311fd08e471a5f432c7923df0ec2ee9cc2f724
Opcode Fuzzy Hash: 8557d672ea6816ff7fb14c5c51ec05fd81896cd129512ca080232f47c9d3c73e
Instruction Fuzzy Hash: 41217170E00204AFEB00DF69C882A9EB7F9EB44714F60857AF404E7291D77CAA45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004544AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00454548
GetLastError.KERNEL32(0000003C,00000000,00454591,?,?,?), ref: 00454559

Part of subcall function 0042D868: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D87B

Strings

<, xrefs: 00454502

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 58aeaf905f3f467ad630160d5addbe77d4166b81bed2c2b576aed89019a82919
Instruction ID: 2758f0baa38893e3594e4aedfeffe3f84d614776496217f8315c959fe0903a0f
Opcode Fuzzy Hash: 58aeaf905f3f467ad630160d5addbe77d4166b81bed2c2b576aed89019a82919
Instruction Fuzzy Hash: CE219970A00249AFDB10EF65C88169E7BF8EF44349F50443AF844EB381E7789E45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049A420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049A420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049A420,00000000,00401A82,?,?,0040222E,02150650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049A420,0049A420,00000000,00401A82,?,?,0040222E,02150650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049A420,00000000,00401A82,?,?,0040222E,02150650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049A420,00401A89,00000000,00401A82,?,?,0040222E,02150650,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 88dd2724dbd3ff1c3207952c5660733b34460a855d8f77796fd9f5c01a3a41c6
Instruction ID: e822125da835f5420473686c3c07f3a27ad935215509521471bf00a9407fd077
Opcode Fuzzy Hash: 88dd2724dbd3ff1c3207952c5660733b34460a855d8f77796fd9f5c01a3a41c6
Instruction Fuzzy Hash: 2311EF317042046EEB25AF799E1A62A6AD497D575CB24487BF804F32D2D9FD8C0282AD

Uniqueness

Uniqueness Score: -1.00%

Function 00494DBE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00494DF9

Strings

/INITPROCWND=$%x , xrefs: 00494E24
@, xrefs: 00494DC4

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: d2d1dd15c77d9dc13def2cd938d3cf206de4a7ac51679d0e4959a98b33c3f143
Instruction ID: 02732182cb7cc3c242b89999aa52cf5d897fd5ad7201844d0be9ad2f2cbadaa1
Opcode Fuzzy Hash: d2d1dd15c77d9dc13def2cd938d3cf206de4a7ac51679d0e4959a98b33c3f143
Instruction Fuzzy Hash: 7A119371A042088FDF01DBA5D841FAE7BE9EB88318F10847BE904E7292D67899058798

Uniqueness

Uniqueness Score: -1.00%

Function 00446A4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 00446AFE

Strings

NIL Interface Exception, xrefs: 00446AA0
Unknown Method, xrefs: 00446AD7

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: 8644278fd13da8ad55c33e871d79fd575bba1fd022dec5432197de0710cda13b
Instruction ID: c91e97682c898982e004f1900ba90c2e3641e7a513101758b9e9268cd1a9d275
Opcode Fuzzy Hash: 8644278fd13da8ad55c33e871d79fd575bba1fd022dec5432197de0710cda13b
Instruction Fuzzy Hash: 94119A707046449FDB04DFA68D51AAE7AACEB0A704F52407AF500E7681D6799D10CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 00495B02 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00454800: GetCurrentProcess.KERNEL32(00000028), ref: 0045480F
Part of subcall function 00454800: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00454815

SetForegroundWindow.USER32(?), ref: 00495B34

Strings

Restarting Windows., xrefs: 00495B11
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 00495B5F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 66bdaacedb8a45610beddee2d20125154b8e42121436ef7f3c5e6b901cfca238
Instruction ID: 694d077cbb5550d478cb7a92b5dd5bf0ba6dd24c7a52c1ed9a6f9e49195c4d49
Opcode Fuzzy Hash: 66bdaacedb8a45610beddee2d20125154b8e42121436ef7f3c5e6b901cfca238
Instruction Fuzzy Hash: A201F770A04284ABEB02F765E842B9C3FD99B5431DFA0407BF404AB6D3CB3CA945871E

Uniqueness

Uniqueness Score: -1.00%

Function 004742F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406F30: DeleteFileA.KERNEL32(00000000,0049A628,004969ED,00000000,00496A42,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F3B

MoveFileA.KERNEL32(00000000,00000000), ref: 00474352

Part of subcall function 004741A4: GetLastError.KERNEL32(00000000,00474290,?,?,?,0049B150,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00474317,0049B16C), ref: 004741C5

Strings

MoveFile, xrefs: 0047432D
DeleteFile, xrefs: 0047430B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: File$DeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3195829115-139070271
Opcode ID: 031b8a37cfe901da499c226069c3cd18b9d4165d4d06860ce72184e7ea3fe1f3
Instruction ID: 35a0a26b338b5613561a3cc36d86805e3b55e8e995fc9abc998881b51050af59
Opcode Fuzzy Hash: 031b8a37cfe901da499c226069c3cd18b9d4165d4d06860ce72184e7ea3fe1f3
Instruction Fuzzy Hash: 98F0C2A030010096DA107AAEA5826FB379C8F9139D710C13BBD9C6F383CB3C9C0646AF

Uniqueness

Uniqueness Score: -1.00%

Function 00496300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047B6F4: FreeLibrary.KERNEL32(00000000,0047FBAA), ref: 0047B70A

Part of subcall function 0047B3C8: GetTickCount.KERNEL32 ref: 0047B410

Part of subcall function 004560D8: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004560F7

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,00496C57), ref: 00496355
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,00496C57), ref: 0049635B

Strings

Detected restart. Removing temporary directory., xrefs: 0049630F

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 74462091f4d0a79b56a72c3bc3e9c533a90eeb28a6d824edd8719864a272ed67
Instruction ID: f434d9678a6a31a85f0ef440eaa6fab1b5385b5ae403e44371098c14193c2303
Opcode Fuzzy Hash: 74462091f4d0a79b56a72c3bc3e9c533a90eeb28a6d824edd8719864a272ed67
Instruction Fuzzy Hash: 59E055712082447EDA1273A7BC139AB7F9CD741768792043BFC0882442C63D0804857C

Uniqueness

Uniqueness Score: -1.00%

Function 004969E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00406F30: DeleteFileA.KERNEL32(00000000,0049A628,004969ED,00000000,00496A42,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F3B

ReleaseMutex.KERNEL32(00000000,00496A49,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00496A64,?,?,00000000), ref: 00496A33
CloseHandle.KERNEL32(00000000,00000000,00496A49,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00496A64), ref: 00496A3C

Strings

/REGU, xrefs: 00496725
Inno-Setup-RegSvr-Mutex, xrefs: 00496759
.lst, xrefs: 004967E0
%nI, xrefs: 004966F1, 004966FE, 00496715, 00496722, 004967B6, 004967C0, 004967D0, 004967DA
/REG, xrefs: 00496701
Setup, xrefs: 0049673B
\nI, xrefs: 004967DD, 004967EA, 004969E5, 0049683B
.msg, xrefs: 004967C6

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CloseDeleteFileHandleMutexRelease
String ID: %nI$.lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup$\nI
API String ID: 3841931355-3190912533
Opcode ID: 30bf0bb91cb104a3c65cecc3f15a6b93e61117046b5e5409cbff438ae1072373
Instruction ID: 887a9e1efbe808a1e74057037fa5da8bf73f20d41789fa1c587db5377786c5da
Opcode Fuzzy Hash: 30bf0bb91cb104a3c65cecc3f15a6b93e61117046b5e5409cbff438ae1072373
Instruction Fuzzy Hash: CFF082316186009EDF159BA5E85296E7BA4E749314FA3487BF800B2981D93C5C10C918

Uniqueness

Uniqueness Score: -1.00%

Function 00421D10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,coI,00000000,00421A5C,00000000,00000000,004185E0,00000000,00000001,?,?,00464756,00000001,00000000,00000000,00469CA1), ref: 00421D33
GetFocus.USER32 ref: 00421D41

Strings

coI, xrefs: 00421D11

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Focus
String ID: coI
API String ID: 2734777837-1488265783
Opcode ID: 6803450af1749c1f343997f6079699f7449cc7a208dc82f9e235c9bb2b5f2d47
Instruction ID: 46719000c87614a5dc43871479ffc91fe90331590ae2374df4c89699cd139320
Opcode Fuzzy Hash: 6803450af1749c1f343997f6079699f7449cc7a208dc82f9e235c9bb2b5f2d47
Instruction Fuzzy Hash: F3E0923170022496EB14367A78C57AB11884B74354F54697FF5029B253DE7C9C850648

Uniqueness

Uniqueness Score: -1.00%

Function 00456854 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,0049A628), ref: 00456861
FileTimeToSystemTime.KERNEL32(00000000,\nI,00000000,0049A628), ref: 00456878

Strings

\nI, xrefs: 00456873

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: Time$FileSystem
String ID: \nI
API String ID: 2086374402-1855566299
Opcode ID: d10593feda3b52d56be89682fb11ad5fac7f13c2d1c7acc4f1884032c785b7a1
Instruction ID: 5eeb9a01154d5d1569ffe6d2c3dae9475e6f472a06e877563c0ce66d36d1021b
Opcode Fuzzy Hash: d10593feda3b52d56be89682fb11ad5fac7f13c2d1c7acc4f1884032c785b7a1
Instruction Fuzzy Hash: CED05B7340820C66CF00B1E5AC828CFB7ECD504334F100677A118A25C1FF35A651459C

Uniqueness

Uniqueness Score: -1.00%

Function 00403344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00496EB2), ref: 0040334B
GetCommandLineA.KERNEL32(00000000,00496EB2), ref: 00403356

Strings

(7T, xrefs: 0040335B

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: (7T
API String ID: 2123368496-891222931
Opcode ID: 746e9a92de36605cdfd87c84c822714f18c0eb0a2b64ce99e66b90c69837d839
Instruction ID: 938fc5d7150061a66cd9a397de50459b98cc473a78e96f9e03329754a5f1b6bd
Opcode Fuzzy Hash: 746e9a92de36605cdfd87c84c822714f18c0eb0a2b64ce99e66b90c69837d839
Instruction Fuzzy Hash: 57C002A09012058AE750AFB6A84AB552A94A751349F8044BFB104BA2E2DA7D82156BDF

Uniqueness

Uniqueness Score: -1.00%

Function 00454890 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 004548AF
Sleep.KERNEL32(?), ref: 004548BF
GetLastError.KERNEL32 ref: 004548D2
GetLastError.KERNEL32 ref: 004548DC

Memory Dump Source

Source File: 00000033.00000002.2561803594.0000000000401000.00000020.00000001.01000000.00000017.sdmp, Offset: 00400000, based on PE: true

Associated: 00000033.00000002.2561768364.0000000000400000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561860330.0000000000498000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561888470.0000000000499000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561917918.000000000049A000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000033.00000002.2561981294.00000000004AA000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_51_2_400000_Wondershare Helper Compact.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 1700dfcccc257f74bbfb94d82cc3bfe3373259457c7db011796e62d74c9f577d
Instruction ID: bb5436bd1afa1b5b0edb46f81817bb6cbc242dc966f94768ac6a47bd1cf447a6
Opcode Fuzzy Hash: 1700dfcccc257f74bbfb94d82cc3bfe3373259457c7db011796e62d74c9f577d
Instruction Fuzzy Hash: 65F0F03AA00554578F20F99E9C81A2F628CDAD0B6E710016BEC04DF343C439CD89A6A9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WSHelper.exePID: 5592, Parent PID: 7992COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	46.9%
Signature Coverage:	0.1%
Total number of Nodes:	1063
Total number of Limit Nodes:	64

Executed Functions

Function 00B57498 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 207
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,?,00000000), ref: 00B574B4
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 00B574D4
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 00B574F2
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000), ref: 00B57510
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00B5752E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00B575CC,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?), ref: 00B57577
RegQueryValueExW.ADVAPI32(?,00B577C0,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00B575CC,?,80000001), ref: 00B57595
RegCloseKey.ADVAPI32(?,00B575D3,00000000,?,?,00000000,00B575CC,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00B575C6
lstrcpynW.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000), ref: 00B575E3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 00B575F0
GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 00B575F6
lstrlenW.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00B57624
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00B5767A
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00B5768A
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00B576BA
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00B576CA
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00B576F9

Strings

Software\Borland\Delphi\Locales, xrefs: 00B57524
Software\CodeGear\Locales, xrefs: 00B574CA, 00B574E8
Software\Borland\Locales, xrefs: 00B57506

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Openlstrcpyn$LibraryLoadLocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3838733197-345420546
Opcode ID: 041654e065dfb4f17c5fd87bccca54bf416523b9696796ebd21677fe2fd2821a
Instruction ID: 5ed9fc527e1ca1107e443e4715f057be3d0e6e6c81b16c9677395797ba2602f3
Opcode Fuzzy Hash: 041654e065dfb4f17c5fd87bccca54bf416523b9696796ebd21677fe2fd2821a
Instruction Fuzzy Hash: 3E613875B442197AEB11DAA8EC45FEF73ECDB08701F4048E1BD00E65D1EAB49D488B95

Uniqueness

Uniqueness Score: -1.00%

Function 00B575D3 Relevance: 15.1, APIs: 10, Instructions: 108
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpynW.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000), ref: 00B575E3
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 00B575F0
GetLocaleInfoW.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 00B575F6
lstrlenW.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00B57624
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00B5767A
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00B5768A
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00B576BA
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00B576CA
lstrcpynW.KERNEL32(-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00B576F9
LoadLibraryExW.KERNEL32(?,00000000,00000002,-00000002,?,00000105,?,00000000,00000002,-00000002,?,00000105,?,00000000,00000003,?), ref: 00B57709

Strings

Software\Borland\Delphi\Locales, xrefs: 00B57524
Software\CodeGear\Locales, xrefs: 00B574CA, 00B574E8
Software\Borland\Locales, xrefs: 00B57506

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 1599918012-345420546
Opcode ID: bd9ccb4f7de11d218772f9294d3d8b1a15f6cb38c10ab0e43a5750388f2d457b
Instruction ID: 4c4f835cce7abcf451df75ff5c71d4ddc402e85190c6dec26cb2521b84e30cc1
Opcode Fuzzy Hash: bd9ccb4f7de11d218772f9294d3d8b1a15f6cb38c10ab0e43a5750388f2d457b
Instruction Fuzzy Hash: A2318732F4061976DB21DAA8EC49BEF62FD9B08301F4449E1AD00E75C5FAB49E4C8B95

Uniqueness

Uniqueness Score: -1.00%

Function 69445610 Relevance: 30.0, APIs: 1, Strings: 16, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_DebugHeapAllocator.LIBCPMTD ref: 694459D1

Part of subcall function 6944AE60: _DebugHeapAllocator.LIBCPMTD ref: 6944AE6E

Strings

float, xrefs: 69445682
string, xrefs: 6944579A
sfixed64, xrefs: 694458B2
fixed32, xrefs: 6944572A
double, xrefs: 69445653
sint32, xrefs: 6944595A
uint32, xrefs: 69445842
bytes, xrefs: 6944580A
sint64, xrefs: 69445992
sfixed32, xrefs: 6944587A
int64, xrefs: 69445922
uint64, xrefs: 694456BA
fixed64, xrefs: 694456F2
int32, xrefs: 694458EA
bool, xrefs: 69445762
group, xrefs: 694457D2

Memory Dump Source

Source File: 00000035.00000002.2558732748.00000000693C1000.00000020.00000001.01000000.0000001C.sdmp, Offset: 693C0000, based on PE: true

Associated: 00000035.00000002.2558703775.00000000693C0000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559476750.000000006951C000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559503322.000000006951D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559534304.0000000069520000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559561478.0000000069521000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559587024.0000000069525000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_693c0000_WSHelper.jbxd

Similarity

API ID: AllocatorDebugHeap
String ID: bool$bytes$double$fixed32$fixed64$float$group$int32$int64$sfixed32$sfixed64$sint32$sint64$string$uint32$uint64
API String ID: 571936431-4081158258
Opcode ID: 42213f74ffcf6f3905069005f1b1ccc055016803bd3e3c6c86a15f2aac8f832e
Instruction ID: e3353b7fc554237d399ea86822553f750d3addff218d9c6492ca5a74b33afd9e
Opcode Fuzzy Hash: 42213f74ffcf6f3905069005f1b1ccc055016803bd3e3c6c86a15f2aac8f832e
Instruction Fuzzy Hash: C7B1E674804198DEEB15DB90CD65BDDBB70AF2130CF5490E9C0866B291DF752F48DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BC7F34 Relevance: 29.8, APIs: 4, Strings: 13, Instructions: 95
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00BC7F4D
GetModuleHandleW.KERNEL32(USER32,00000000,00BC809A,?,00008000), ref: 00BC7F71

Part of subcall function 00B58708: GetProcAddress.KERNEL32(?,?), ref: 00B5872C

LoadLibraryW.KERNEL32(imm32.dll,00000000,00BC809A,?,00008000), ref: 00BC7F9A
SetErrorMode.KERNEL32(?,00BC80A1,00008000), ref: 00BC8094

Strings

WINNLSEnableIME, xrefs: 00BC7F78
ImmGetCompositionStringW, xrefs: 00BC8044
ImmIsIME, xrefs: 00BC8059
ImmSetCompositionWindow, xrefs: 00BC801A
ImmGetContext, xrefs: 00BC7FB1
ImmSetOpenStatus, xrefs: 00BC8005
ImmNotifyIME, xrefs: 00BC806E
imm32.dll, xrefs: 00BC7F95
USER32, xrefs: 00BC7F6C
ImmReleaseContext, xrefs: 00BC7FC6
ImmSetConversionStatus, xrefs: 00BC7FF0
ImmGetConversionStatus, xrefs: 00BC7FDB
ImmSetCompositionFontW, xrefs: 00BC802F

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ErrorMode$AddressHandleLibraryLoadModuleProc
String ID: ImmGetCompositionStringW$ImmGetContext$ImmGetConversionStatus$ImmIsIME$ImmNotifyIME$ImmReleaseContext$ImmSetCompositionFontW$ImmSetCompositionWindow$ImmSetConversionStatus$ImmSetOpenStatus$USER32$WINNLSEnableIME$imm32.dll
API String ID: 380357001-1271369619
Opcode ID: f8a3a49e20e80eb4b3f2bb00c059e8a31ee0a00ede0cb7130b3cc6101389ac0a
Instruction ID: 600b11fa196fa848f26e7d50ab535cbe7821c68b6ac5e208b41a8e34e8082bcd
Opcode Fuzzy Hash: f8a3a49e20e80eb4b3f2bb00c059e8a31ee0a00ede0cb7130b3cc6101389ac0a
Instruction Fuzzy Hash: 2C31ED71660784AFD701AFB8EC87F6937E8E709701F6408D9F508BF261EE74588A8B11

Uniqueness

Uniqueness Score: -1.00%

Function 00BC841C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 108
registrythreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00BC85A7), ref: 00BC843D
GlobalAddAtomW.KERNEL32(00000000), ref: 00BC8470
GetCurrentThreadId.KERNEL32 ref: 00BC848B
GlobalAddAtomW.KERNEL32(00000000), ref: 00BC84C1
RegisterWindowMessageW.USER32(00000000,00000000,?,?,00000000,00BC85A7), ref: 00BC84D7

Part of subcall function 00B6BEA4: InitializeCriticalSection.KERNEL32(00B69108,00B69318,00000001,00B6C11F,?,00000001,00B81985,?,?,?,00B81F90), ref: 00B6BEC3

Part of subcall function 00BC7F34: SetErrorMode.KERNEL32(00008000), ref: 00BC7F4D
Part of subcall function 00BC7F34: GetModuleHandleW.KERNEL32(USER32,00000000,00BC809A,?,00008000), ref: 00BC7F71
Part of subcall function 00BC7F34: LoadLibraryW.KERNEL32(imm32.dll,00000000,00BC809A,?,00008000), ref: 00BC7F9A
Part of subcall function 00BC7F34: SetErrorMode.KERNEL32(?,00BC80A1,00008000), ref: 00BC8094

Part of subcall function 00BA37AC: GetKeyboardLayout.USER32(00000000), ref: 00BA37F1
Part of subcall function 00BA37AC: GetDC.USER32(00000000), ref: 00BA3846
Part of subcall function 00BA37AC: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BA3850
Part of subcall function 00BA37AC: ReleaseDC.USER32(00000000,00000000), ref: 00BA385B

Part of subcall function 00BA4B6C: OleInitialize.OLE32(00000000), ref: 00BA4B9D
Part of subcall function 00BA4B6C: LoadIconW.USER32(00000000,MAINICON), ref: 00BA4C88
Part of subcall function 00BA4B6C: GetModuleFileNameW.KERNEL32(00000000,?,00000100,00000000,MAINICON), ref: 00BA4CCC

GetModuleHandleW.KERNEL32(USER32,00000000,00000000,?,?,00000000,00BC85A7), ref: 00BC855A

Part of subcall function 00B58708: GetProcAddress.KERNEL32(?,?), ref: 00B5872C

Strings

USER32, xrefs: 00BC8555
ControlOfs%.8X%.8X, xrefs: 00BC849F
AnimateWindow, xrefs: 00BC8579
Delphi%.8X, xrefs: 00BC844E

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Module$AtomCurrentErrorGlobalHandleInitializeLoadMode$AddressCapsCriticalDeviceFileIconKeyboardLayoutLibraryMessageNameProcProcessRegisterReleaseSectionThreadWindow
String ID: AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$USER32
API String ID: 2902964639-1126952177
Opcode ID: 792a7ed598586b4d9411e9c0d9bffc151360a0c077f778b7fc0a9f95a2b31697
Instruction ID: 046b812babc296b45bd7693a42b30817e693ab402d991a7303afe863154ec19b
Opcode Fuzzy Hash: 792a7ed598586b4d9411e9c0d9bffc151360a0c077f778b7fc0a9f95a2b31697
Instruction Fuzzy Hash: AC415E716006848FCB40EFB8DC82A9E77F9EB49301B5044E9F804EB362DF75A9058B95

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4B6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150
comwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 00BA4B9D
LoadIconW.USER32(00000000,MAINICON), ref: 00BA4C88
GetModuleFileNameW.KERNEL32(00000000,?,00000100,00000000,MAINICON), ref: 00BA4CCC
CharNextW.USER32(?,00000000,?,00000100,00000000,MAINICON), ref: 00BA4D11
CharLowerW.USER32(00000000,?,00000000,?,00000100,00000000,MAINICON), ref: 00BA4D17

Part of subcall function 00BA4F34: GetClassInfoW.USER32(00B50000,00BA4B50,?), ref: 00BA4F96
Part of subcall function 00BA4F34: RegisterClassW.USER32(00BE1860), ref: 00BA4FAE
Part of subcall function 00BA4F34: SetWindowLongW.USER32(?,000000FC,?), ref: 00BA504E
Part of subcall function 00BA4F34: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00BA5073

Strings

MAINICON, xrefs: 00BA4C7B

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CharClass$FileIconInfoInitializeLoadLongLowerMessageModuleNameNextRegisterSendWindow
String ID: MAINICON
API String ID: 896494604-2283262055
Opcode ID: 1d54a60668618770cb47a64893c6d5927a6a8de22a21934b8b7d5532d7df04f2
Instruction ID: 149171789391f42cb92ac3962f10c23bd781d0ddf0e457de1c4701216708a769
Opcode Fuzzy Hash: 1d54a60668618770cb47a64893c6d5927a6a8de22a21934b8b7d5532d7df04f2
Instruction Fuzzy Hash: AE61FB705082848EDB40EF68D8C6B867BE5AB16304F4884F9EC58CF367DBB59948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3D48 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetKeyboardLayoutList.USER32(00000040,?,00000000,00BA3EF5,?,00000000,?,00BA3F99,00000000,?,00BBD2D7), ref: 00BA3DA0
RegOpenKeyExW.ADVAPI32(80000002,00000000), ref: 00BA3E08
RegQueryValueExW.ADVAPI32(?,layout text,00000000,00000000,?,00000200,00000000,00BA3EB1,?,80000002,00000000), ref: 00BA3E42
RegCloseKey.ADVAPI32(?,00BA3EB8,00000000,?,00000200,00000000,00BA3EB1,?,80000002,00000000), ref: 00BA3EAB

Strings

layout text, xrefs: 00BA3E39
System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 00BA3DF2

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CloseKeyboardLayoutListOpenQueryValue
String ID: System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 1703357764-2652665750
Opcode ID: ffb65bfd6810beff2b3c96890b0404d35fb4b2ac2757ed0a46611dffc1fcbfec
Instruction ID: 6dab83d20155116022a8eb196c14533870e2e7c372065cf384acb85a8424f81f
Opcode Fuzzy Hash: ffb65bfd6810beff2b3c96890b0404d35fb4b2ac2757ed0a46611dffc1fcbfec
Instruction Fuzzy Hash: 6A414574A04248AFDB12DF54C992BAEB7F9EB09700F9044E5F904A7351EB74AF48CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B92954 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00000008,00000060,00000048), ref: 00B9297A

Part of subcall function 00B92910: GetDC.USER32(00000000), ref: 00B92919
Part of subcall function 00B92910: SelectObject.GDI32(00000000,058A00B4), ref: 00B9292B
Part of subcall function 00B92910: GetTextMetricsW.GDI32(00000000), ref: 00B92936
Part of subcall function 00B92910: ReleaseDC.USER32(00000000,00000000), ref: 00B92947

Strings

MS Shell Dlg 2, xrefs: 00B929E4
Tahoma, xrefs: 00B9299C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes, xrefs: 00B929D0

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID: MS Shell Dlg 2$SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes$Tahoma
API String ID: 2013942131-1011973972
Opcode ID: 18f594924b62c8e7848f2bd900a69d92f65a5896cf35954ffca776158f334f5f
Instruction ID: 2472b45cf8eb74d4ddfcaa2e0a561ad96cd605f7ae499351a26ace78837dc147
Opcode Fuzzy Hash: 18f594924b62c8e7848f2bd900a69d92f65a5896cf35954ffca776158f334f5f
Instruction Fuzzy Hash: C111BC31A40208AFDF11EF68CC52A5D7BE9EB0A300F9184F0F904A7662DB319E068B10

Uniqueness

Uniqueness Score: -1.00%

Function 00B54DF4 Relevance: 6.2, APIs: 4, Instructions: 158
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00B54E2B

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5cf35a199a6e950d17e92d23e93cc6e2ca03810c191650cc9f3ba40cbaa76492
Instruction ID: e1b370a70af2143d6d3a6642e7af05b1e98b44eec23b6056990a4d634ab3e812
Opcode Fuzzy Hash: 5cf35a199a6e950d17e92d23e93cc6e2ca03810c191650cc9f3ba40cbaa76492
Instruction Fuzzy Hash: 66517A30600A848FDB35DF69D89576A7BE0EF4831BF1845E9EC058B252DB70DD88CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6944F680 Relevance: 6.1, APIs: 4, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

allocator.LIBCPMTD ref: 6944F6B7
allocator.LIBCONCRTD ref: 6944F6EA
allocator.LIBCONCRTD ref: 6944F715
allocator.LIBCONCRTD ref: 6944F740

Memory Dump Source

Source File: 00000035.00000002.2558732748.00000000693C1000.00000020.00000001.01000000.0000001C.sdmp, Offset: 693C0000, based on PE: true

Associated: 00000035.00000002.2558703775.00000000693C0000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559476750.000000006951C000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559503322.000000006951D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559534304.0000000069520000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559561478.0000000069521000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559587024.0000000069525000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_693c0000_WSHelper.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 47136770d072d7873c8f00165805e8d77e9b1e99ffce560c2d902dbfcbeb7e09
Instruction ID: 1b75dc2d55ea1c4e7c704d8dd42dd4618210416ec398e5b0ac6487c0096b3469
Opcode Fuzzy Hash: 47136770d072d7873c8f00165805e8d77e9b1e99ffce560c2d902dbfcbeb7e09
Instruction Fuzzy Hash: 7C2128B5D00209ABDB04CF98D951EEFBBB8EF48718F10821DE515A7380E735AA00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B743BC Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassInfoW.USER32(00B50000,00B743A0,?), ref: 00B743DD
UnregisterClassW.USER32(00B743A0,00B50000), ref: 00B74406
RegisterClassW.USER32(00BDFC58), ref: 00B74410
SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 00B7445B

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: e0daee53ae97b95009397f21c7d30bfae45297c4cbb9cef463dc20fdf2200d5d
Instruction ID: abada58a69d05921e063a8db7548cf6cbac1c69f9e2f8b08c44382d7a875a894
Opcode Fuzzy Hash: e0daee53ae97b95009397f21c7d30bfae45297c4cbb9cef463dc20fdf2200d5d
Instruction Fuzzy Hash: A5018471214105ABDB60EFA8DC81FAAB3DDE708315F1481E1FD19EB3A1EF32A8558764

Uniqueness

Uniqueness Score: -1.00%

Function 00B74CAC Relevance: 4.6, APIs: 3, Instructions: 144
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00B74E5D,?,?,00000000,00000000), ref: 00B74D25
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00000000,00B74E5D,?,?,00000000), ref: 00B74D95
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?), ref: 00B74E00

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2c1a7765a3e64057ba4d114fc1f63c9e8559662ec6e0977a07b79751d82082d0
Instruction ID: f2eb4c4b6b653f346d85a6ba386bb58bed4fee9ab3e00e792eeff0bce41aaa67
Opcode Fuzzy Hash: 2c1a7765a3e64057ba4d114fc1f63c9e8559662ec6e0977a07b79751d82082d0
Instruction Fuzzy Hash: 8B417331B00608AFDB22DBA4C852B9EB7F9EB44311F5584F9B868E3252D775DF0A9740

Uniqueness

Uniqueness Score: -1.00%

Function 00B55138 Relevance: 4.6, APIs: 3, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00B55171
FreeLibrary.KERNEL32(?,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00B55212
ExitProcess.KERNEL32(00000000,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00B5524E

Part of subcall function 00B550B0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B550E9
Part of subcall function 00B550B0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B550EF
Part of subcall function 00B550B0: GetStdHandle.KERNEL32(000000F5,00B5513C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161), ref: 00B55104
Part of subcall function 00B550B0: WriteFile.KERNEL32(00000000,000000F5,00B5513C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161), ref: 00B5510A

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 441b648eeebf4a21f3bb8ff8c7bfd300e936b8090ee5347c123e8db168115a45
Instruction ID: 091221995dfd74f320897a67247182974132627629bf6a669f192ab9af3945d2
Opcode Fuzzy Hash: 441b648eeebf4a21f3bb8ff8c7bfd300e936b8090ee5347c123e8db168115a45
Instruction Fuzzy Hash: CF317030600F858BD731AFB984A971A7BE0AF45317F1849E9EC458B292EB75DC8CCB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B5513C Relevance: 4.6, APIs: 3, Instructions: 92
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00B55171
FreeLibrary.KERNEL32(?,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00B55212
ExitProcess.KERNEL32(00000000,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00B5524E

Part of subcall function 00B550B0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B550E9
Part of subcall function 00B550B0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B550EF
Part of subcall function 00B550B0: GetStdHandle.KERNEL32(000000F5,00B5513C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161), ref: 00B55104
Part of subcall function 00B550B0: WriteFile.KERNEL32(00000000,000000F5,00B5513C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161), ref: 00B5510A

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 60fdf6f1c7872d74e2ad45f03a5f051b941bd0b07891889b18d9aa48254a5b1c
Instruction ID: 4477e399f357b21956ff60e4370d81db5457b5c9df8a4fe3223270ebec26effb
Opcode Fuzzy Hash: 60fdf6f1c7872d74e2ad45f03a5f051b941bd0b07891889b18d9aa48254a5b1c
Instruction Fuzzy Hash: 6F315030600F858BD731AB7994A971A7BE0AF44317F1849E9EC458B292EB75DC8CCB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B55140 Relevance: 4.6, APIs: 3, Instructions: 92
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00B55171
FreeLibrary.KERNEL32(?,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00B55212
ExitProcess.KERNEL32(00000000,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00B5524E

Part of subcall function 00B550B0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B550E9
Part of subcall function 00B550B0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B550EF
Part of subcall function 00B550B0: GetStdHandle.KERNEL32(000000F5,00B5513C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161), ref: 00B55104
Part of subcall function 00B550B0: WriteFile.KERNEL32(00000000,000000F5,00B5513C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161), ref: 00B5510A

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 2244c69faf46aca8cd45bb40d6420aa125eb291eb662b02c1a963ee4211901f0
Instruction ID: 455a4dcb2f2d53fae1a70544aa71f03b182d7b91315810cb6d6cc041dbf32f47
Opcode Fuzzy Hash: 2244c69faf46aca8cd45bb40d6420aa125eb291eb662b02c1a963ee4211901f0
Instruction Fuzzy Hash: F8317030600F458BD731AB7984A971A7BE0AF44317F1809E9EC458B292DB75DC8CCB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B750F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00B7511B

Strings

InstallPath, xrefs: 00B750F0

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: QueryValue
String ID: InstallPath
API String ID: 3660427363-1821322030
Opcode ID: 1d5ea858ce0382f42d14a08018eaa8148462137adcd66b0c98181cb03bc4b7b9
Instruction ID: 5064687dea892f7ab9460c136a2776b92106558cbeb15ea56a61e9d9f9aec730
Opcode Fuzzy Hash: 1d5ea858ce0382f42d14a08018eaa8148462137adcd66b0c98181cb03bc4b7b9
Instruction Fuzzy Hash: C9012C76604108ABD710EAA9DC81A9EB7ECDB49311F1481A6BD18DB242EB709E048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B74FB0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,00B75014,?,InstallPath,?,InstallPath,00000000,00B75014), ref: 00B74FE2

Strings

InstallPath, xrefs: 00B74FB1, 00B74FB3

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: QueryValue
String ID: InstallPath
API String ID: 3660427363-1821322030
Opcode ID: cbc7dff13cce6f6ada2a492945c9550f38e67165e5d52a68bebfe0dcb38e1a66
Instruction ID: a2c1e76f9a3f2a1aabdcb96aa3f65c184443bd47c266e7f281b03d713f40a3ad
Opcode Fuzzy Hash: cbc7dff13cce6f6ada2a492945c9550f38e67165e5d52a68bebfe0dcb38e1a66
Instruction Fuzzy Hash: 7EF030663091487BE714EAADAC41FAB77DCDB85752F0484BAB948C7241DB20DD098365

Uniqueness

Uniqueness Score: -1.00%

Function 694B4579 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 694B4593

Part of subcall function 694B62FE: __FF_MSGBANNER.LIBCMT ref: 694B6321
Part of subcall function 694B62FE: __NMSG_WRITE.LIBCMT ref: 694B6328
Part of subcall function 694B62FE: RtlAllocateHeap.NTDLL(00000000,694B4589,?,?,00000000,?,694B4598,?), ref: 694B6375

Part of subcall function 69408720: std::exception::exception.LIBCMT ref: 6940872A

Strings

PMH, xrefs: 694B45D7

Memory Dump Source

Source File: 00000035.00000002.2558732748.00000000693C1000.00000020.00000001.01000000.0000001C.sdmp, Offset: 693C0000, based on PE: true

Associated: 00000035.00000002.2558703775.00000000693C0000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559476750.000000006951C000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559503322.000000006951D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559534304.0000000069520000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559561478.0000000069521000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559587024.0000000069525000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_693c0000_WSHelper.jbxd

Similarity

API ID: AllocateHeap_mallocstd::exception::exception
String ID: PMH
API String ID: 10242141-2727293503
Opcode ID: 2800d2bb54f0fef9439f0c916e2c1f517f17b1ef04557bde6f63b485050aeace
Instruction ID: 5a4c62519c1279976f9e856b8c06f09bebc3935127c98e1667808fd529ae797c
Opcode Fuzzy Hash: 2800d2bb54f0fef9439f0c916e2c1f517f17b1ef04557bde6f63b485050aeace
Instruction Fuzzy Hash: 8FF0E23960054972DF08DBA4DC04E4D3BA8AF412ACF00846CD9119F1D8EF32A60585F1

Uniqueness

Uniqueness Score: -1.00%

Function 00B6E454 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000400,00000000,00000000,?,00000000,?), ref: 00B6E4FC
CompareStringW.KERNEL32(00000400,00000001,00000000,?,00000000,?), ref: 00B6E58A

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 3d4b32950a55d557f80a95e0e1a7cb11a5a94549e5247d9e57132b91a5bef081
Instruction ID: c733e87c4dda071a3f288b44f25812fabe30baee9e2acec9a02c20af753ed010
Opcode Fuzzy Hash: 3d4b32950a55d557f80a95e0e1a7cb11a5a94549e5247d9e57132b91a5bef081
Instruction Fuzzy Hash: B441D135B00615ABDB21EEB4C896B5E77F9EF44301F1040F0E911AB295EB78ED498750

Uniqueness

Uniqueness Score: -1.00%

Function 00BA3BD8 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00BA3BE5
LoadCursorW.USER32(00000000,00000000), ref: 00BA3C17

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 8aa9ce436485c70070c2f47880712514d1c47fa78f2eaaf48d01b20eec86d7b9
Instruction ID: b125330cc127b195eaeab158f4e21f53a925cccccd3863e7c01619b631c1d732
Opcode Fuzzy Hash: 8aa9ce436485c70070c2f47880712514d1c47fa78f2eaaf48d01b20eec86d7b9
Instruction Fuzzy Hash: 55F0E2217083401A8A30553D4CC1A6A72D4CB83B30F2003F6FE2ADB2D1EA225C815561

Uniqueness

Uniqueness Score: -1.00%

Function 00B559C8 Relevance: 3.0, APIs: 2, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00B5599A
SysReAllocStringLen.OLEAUT32(?,?,?), ref: 00B559E2

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 79283dfe11e682ad05577cc094b911d0aee1c4d03b094a310d9699b34b39ce72
Instruction ID: 4551f24a860e1d827290b2a60d629692236f78b81569951cd73faa7b7626e8d6
Opcode Fuzzy Hash: 79283dfe11e682ad05577cc094b911d0aee1c4d03b094a310d9699b34b39ce72
Instruction Fuzzy Hash: A9E0CDB4100601EEEA345E14C83173773E9DFC1313F6C89D8AC014F151DA399C08C670

Uniqueness

Uniqueness Score: -1.00%

Function 00B74AF0 Relevance: 3.0, APIs: 2, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegFlushKey.ADVAPI32(00010000,00B74960,00B74B47,00B74960,00000000,00B74A62,0002001F,00000001,00B74AA6,?,00000000,00BDBA7C,00BDC069,?,?,00000000), ref: 00B74B01
RegCloseKey.ADVAPI32(00010000,00B74960,00B74B47,00B74960,00000000,00B74A62,0002001F,00000001,00B74AA6,?,00000000,00BDBA7C,00BDC069,?,?,00000000), ref: 00B74B0A

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: bb4c439b0778a66f37b95c9d584c351c2411a381f8f725543669e5882eaf3715
Instruction ID: bfd9b9e12261b7b8ba6ef20d9f64ab209ad3e27278b93eb69b20e48c05bda0bf
Opcode Fuzzy Hash: bb4c439b0778a66f37b95c9d584c351c2411a381f8f725543669e5882eaf3715
Instruction Fuzzy Hash: AAE01260B002408BDF50DF7589C5B0777D8AF08342B48C4D1AC0CDF107EB34D8448720

Uniqueness

Uniqueness Score: -1.00%

Function 00B74470 Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 00B74477
DestroyWindow.USER32(00000000,00000000,000000FC,?,00000000,00BB72F7,00000000,00BB84E3,00000000,00BB870F,?,00000000,00BB8781), ref: 00B7447F

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$DestroyLong
String ID:
API String ID: 2871862000-0
Opcode ID: 127b44f3ed0e36aaf69ce9fc714609e5ed29efdbbb57fa9d0d7ee733a7d5f75d
Instruction ID: 57ac2de58b5f0f2caa811d0eb3e1529f2430fcf43192f04b8cceda8d001b0794
Opcode Fuzzy Hash: 127b44f3ed0e36aaf69ce9fc714609e5ed29efdbbb57fa9d0d7ee733a7d5f75d
Instruction Fuzzy Hash: E8C01282606630269A1031A82CC1ABA01CC880636332006F2FD28A62D2CF460E0812E6

Uniqueness

Uniqueness Score: -1.00%

Function 00B52F1C Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00BE3A24,00000000,00008000,?,?,?,?,00B52FFC,00B57F84,00000000,00B57FA6), ref: 00B52F3A
VirtualFree.KERNEL32(00BE5AC8,00000000,00008000,00BE3A24,00000000,00008000,?,?,?,?,00B52FFC,00B57F84,00000000,00B57FA6), ref: 00B52F97

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3f97ef9deb79b9d64ede91458439407bbb58f1ed9e3c6b16bd04d38b619d1c35
Instruction ID: 30fe3304d4b457774b653f9a2a503b6d8434c3e97065c820674b071513c8868d
Opcode Fuzzy Hash: 3f97ef9deb79b9d64ede91458439407bbb58f1ed9e3c6b16bd04d38b619d1c35
Instruction Fuzzy Hash: AF11C0B27013019BCB249F09A9C0B29BBE5EB85712F29C0FDF6099F352D674EC058B64

Uniqueness

Uniqueness Score: -1.00%

Function 00B74CA8 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00B74E5D,?,?,00000000,00000000), ref: 00B74D25

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e081f77f8cfc6876a79e5c6c5e2b53f93bfda5429c5a7544db0e307887628d9e
Instruction ID: 179a5bbcb1dfa23f3a5e6b432de138ed35fcdb3b4584dbaa0e86448b55c6dc7e
Opcode Fuzzy Hash: e081f77f8cfc6876a79e5c6c5e2b53f93bfda5429c5a7544db0e307887628d9e
Instruction Fuzzy Hash: 5F21F531B04608AFDB22DBA4CC52B9EB7F9EB44311F5184F9E869E3292D7349F099740

Uniqueness

Uniqueness Score: -1.00%

Function 00B5908A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B590CB

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: afad1be83c8feab1d9c6164bbbdf13b9d4ed48d4be3a599c0ded2acbf9d39e65
Instruction ID: 35c887e52fccdbd455efc40c7a82a322e2d0abb34518e26e7fbdafa52ffad0f9
Opcode Fuzzy Hash: afad1be83c8feab1d9c6164bbbdf13b9d4ed48d4be3a599c0ded2acbf9d39e65
Instruction Fuzzy Hash: 2BF07AB2700158BF9B80DE9DDC81E9B77ECEB8C6A5B0541A5FA08D3201D635ED108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B5908C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B590CB

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e3521d7d6d969c88a6d822aff9a2c2d205162dca2e4f140bfb2e5c7c9276027e
Instruction ID: 7ee819cfbda9057bbe35a7d36218cd2700abe21bf69a6c73713224862849c329
Opcode Fuzzy Hash: e3521d7d6d969c88a6d822aff9a2c2d205162dca2e4f140bfb2e5c7c9276027e
Instruction Fuzzy Hash: F7F07AB2600158AF8B80DE9DDC81E9B77ECEB8C6A5B0541A5FA08D3201D635ED108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 69429E20 Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

std::bad_exception::~bad_exception.LIBCMTD ref: 69429E85

Memory Dump Source

Source File: 00000035.00000002.2558732748.00000000693C1000.00000020.00000001.01000000.0000001C.sdmp, Offset: 693C0000, based on PE: true

Associated: 00000035.00000002.2558703775.00000000693C0000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559476750.000000006951C000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559503322.000000006951D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559534304.0000000069520000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559561478.0000000069521000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559587024.0000000069525000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_693c0000_WSHelper.jbxd

Similarity

API ID: std::bad_exception::~bad_exception
String ID:
API String ID: 2813134625-0
Opcode ID: fc6f6adcbfb76f0201600725c01bbed01be20275279c9b0beed7aca25d40ef79
Instruction ID: 92ce661f3c04cb6b825f101adadf66e8c787c4538b9f34dface6d2cc348c113b
Opcode Fuzzy Hash: fc6f6adcbfb76f0201600725c01bbed01be20275279c9b0beed7aca25d40ef79
Instruction Fuzzy Hash: 880186B6900548ABCB00CF94D941FDEB778FB45614F10862DE525976D0E735A604CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00BDE7B4 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00BDE833), ref: 00BDE7CE

Part of subcall function 00BC841C: GetCurrentProcessId.KERNEL32(?,00000000,00BC85A7), ref: 00BC843D
Part of subcall function 00BC841C: GlobalAddAtomW.KERNEL32(00000000), ref: 00BC8470
Part of subcall function 00BC841C: GetCurrentThreadId.KERNEL32 ref: 00BC848B
Part of subcall function 00BC841C: GlobalAddAtomW.KERNEL32(00000000), ref: 00BC84C1
Part of subcall function 00BC841C: RegisterWindowMessageW.USER32(00000000,00000000,?,?,00000000,00BC85A7), ref: 00BC84D7
Part of subcall function 00BC841C: GetModuleHandleW.KERNEL32(USER32,00000000,00000000,?,?,00000000,00BC85A7), ref: 00BC855A

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: AtomCurrentGlobal$HandleMessageModuleProcessRegisterThreadVersionWindow
String ID:
API String ID: 3196784325-0
Opcode ID: 877d39bca631cf4efd0abd62545bbf9fb5607b8fd795ace01596abec521dfa74
Instruction ID: 139bae2e6cb52ee06b11e9d4cc636c56d16396d93b0a39d06548eeacb5292b5e
Opcode Fuzzy Hash: 877d39bca631cf4efd0abd62545bbf9fb5607b8fd795ace01596abec521dfa74
Instruction Fuzzy Hash: 09F067342259819FC711FB28EEA2D0A33E4EB4A30079142B5E600AB331DEA4BC01CA86

Uniqueness

Uniqueness Score: -1.00%

Function 6944FAD0 Relevance: 1.5, APIs: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6944FB05

Memory Dump Source

Source File: 00000035.00000002.2558732748.00000000693C1000.00000020.00000001.01000000.0000001C.sdmp, Offset: 693C0000, based on PE: true

Associated: 00000035.00000002.2558703775.00000000693C0000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559476750.000000006951C000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559503322.000000006951D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559534304.0000000069520000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559561478.0000000069521000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559587024.0000000069525000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_693c0000_WSHelper.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: b6e918c5acd6bd974e3ca6ae6402578627e608ec2ee2d3df32d5d7a9ae47e099
Instruction ID: 62f6d6981a7c5e5b2fd3e019c457285dfa6685ec82932312833a34d7b31217b9
Opcode Fuzzy Hash: b6e918c5acd6bd974e3ca6ae6402578627e608ec2ee2d3df32d5d7a9ae47e099
Instruction Fuzzy Hash: D6E02270C02148BAEF08DF60DC94F8D3B68EB11394F00C7A8EC198A1C0DB30D688C2D2

Uniqueness

Uniqueness Score: -1.00%

Function 00B571F8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 00B57216

Part of subcall function 00B57498: GetModuleFileNameW.KERNEL32(00000000,?,00000105,?,00000000), ref: 00B574B4
Part of subcall function 00B57498: RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 00B574D4
Part of subcall function 00B57498: RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,?,00000000), ref: 00B574F2
Part of subcall function 00B57498: RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000), ref: 00B57510
Part of subcall function 00B57498: RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00B5752E
Part of subcall function 00B57498: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00B575CC,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?), ref: 00B57577
Part of subcall function 00B57498: RegQueryValueExW.ADVAPI32(?,00B577C0,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00B575CC,?,80000001), ref: 00B57595
Part of subcall function 00B57498: RegCloseKey.ADVAPI32(?,00B575D3,00000000,?,?,00000000,00B575CC,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00B575C6

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b1355a938c7910fec3cbf74dc7afad3b1ed914b55a2b51ab0a37a7cc820c9193
Instruction ID: c78ade01ab621adff039d6604d46be2bf7fcc3cc2a86d46c88e6d490795b7fbb
Opcode Fuzzy Hash: b1355a938c7910fec3cbf74dc7afad3b1ed914b55a2b51ab0a37a7cc820c9193
Instruction Fuzzy Hash: 2DE0C2B1A443109BCB10DEACD8C5B4677E8AB09755F044AE1BD28CF247E771DE288BE1

Uniqueness

Uniqueness Score: -1.00%

Function 694BD325 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,694B6FF3,00000001,?,?,?,694B716C,?,?,?,69513958,0000000C,694B7227), ref: 694BD33A

Memory Dump Source

Source File: 00000035.00000002.2558732748.00000000693C1000.00000020.00000001.01000000.0000001C.sdmp, Offset: 693C0000, based on PE: true

Associated: 00000035.00000002.2558703775.00000000693C0000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559333669.00000000694E5000.00000002.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559476750.000000006951C000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559503322.000000006951D000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559534304.0000000069520000.00000008.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559561478.0000000069521000.00000004.00000001.01000000.0000001C.sdmpDownload File
Associated: 00000035.00000002.2559587024.0000000069525000.00000002.00000001.01000000.0000001C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_693c0000_WSHelper.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 7c4312a624fca4dd1bfa0ced874c30696ab5a17e13b719fd05c272e52d9b3ef0
Instruction ID: 2e0b0c381cf9747549486a4627b659c4daa792da9aae5c4863e0bdffdf9561d6
Opcode Fuzzy Hash: 7c4312a624fca4dd1bfa0ced874c30696ab5a17e13b719fd05c272e52d9b3ef0
Instruction Fuzzy Hash: 86D0A772958384AEDF00DFB45C09B623BDCD386B95F144476F80CC6280F575C580C610

Uniqueness

Uniqueness Score: -1.00%

Function 00B5809C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

Part of subcall function 00B58064: TlsGetValue.KERNEL32(0000001B), ref: 00B5807C
Part of subcall function 00B58064: LocalFree.KERNEL32(00000000,0000001B), ref: 00B58086
Part of subcall function 00B58064: TlsSetValue.KERNEL32(0000001B,00000000,00000000,0000001B), ref: 00B58093

TlsFree.KERNEL32(0000001B), ref: 00B580B9

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FreeValue$Local
String ID:
API String ID: 2930853931-0
Opcode ID: 8fd34948e55db7d1c4c7612657ff2bdc0e37d6f190a4d062139930fe318a2872
Instruction ID: bfbab83613e446d88eef32a2587e341137877a912ba1ed0757228f005c988e98
Opcode Fuzzy Hash: 8fd34948e55db7d1c4c7612657ff2bdc0e37d6f190a4d062139930fe318a2872
Instruction Fuzzy Hash: 3AC08C3120830246DA60B379A82832863C8E701363F4883E56F71E20F0EE38CC0ECA12

Uniqueness

Uniqueness Score: -1.00%

Function 00B57EF6 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00B57EFC

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9bcadd6a6533b980dc3c589d1a71221fe0b0ac98db33aecf26553df7b93241c4
Instruction ID: bf0b4e83477574ecfef0573c9e8b6186aeb706d32f650418595b5cfb8b7c6e7d
Opcode Fuzzy Hash: 9bcadd6a6533b980dc3c589d1a71221fe0b0ac98db33aecf26553df7b93241c4
Instruction Fuzzy Hash: 6EB012246084021BC504A72C4C4364F31C01E40124FC41EA0B85CD5692F60DC9A902DF

Uniqueness

Uniqueness Score: -1.00%

Function 00B742F4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 00B74312

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a3ec344b096fb22883bdcad4dd3856d94048fe56a10b3d41c8d99c2691e6ca3
Instruction ID: 71e6b574978b7e7b52cf1945132c215652d9144b01054860acc25ad523cedcbe
Opcode Fuzzy Hash: 2a3ec344b096fb22883bdcad4dd3856d94048fe56a10b3d41c8d99c2691e6ca3
Instruction Fuzzy Hash: 681188352443058FD710DF69C881B82F7E4EB48351F10C5BAE9AC8F395D7B0E9158BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B517F8 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00B51E07,?,00B51ADA), ref: 00B5180E

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 730ed4c06b8ae63b095b0125347e67680fbc202aac2e8bd7562b8525f81d876b
Instruction ID: 656f50c183c1fce3a5c5d5d9c75c8d88d56f8207a4758a502ef3c020e0be826c
Opcode Fuzzy Hash: 730ed4c06b8ae63b095b0125347e67680fbc202aac2e8bd7562b8525f81d876b
Instruction Fuzzy Hash: 71F0AFF1B003805BDB05CF798DC43197AD5A789705F2080BCE948CF398EA7084868B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B8FA80 Relevance: 48.5, APIs: 32, Instructions: 500windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(00000000,00000054,?), ref: 00B8FB00
GetDC.USER32(00000000), ref: 00B8FB11
CreateCompatibleDC.GDI32(00000000), ref: 00B8FB22
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 00B8FB6E
CreateCompatibleBitmap.GDI32(00000028,00000000,?), ref: 00B8FB92
SelectObject.GDI32(?,?), ref: 00B8FDEF
SelectPalette.GDI32(?,00000000,00000000), ref: 00B8FE2F
RealizePalette.GDI32(?), ref: 00B8FE3B
SetTextColor.GDI32(?,00000000), ref: 00B8FEA4
SetBkColor.GDI32(?,00000000), ref: 00B8FEBE
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,00000000,00B9004C,?,00000000,00B9006E,?,00000000,00B9007F), ref: 00B8FF06
FillRect.USER32(?,?,00000000), ref: 00B8FE8C

Part of subcall function 00B8AC4C: GetSysColor.USER32(?), ref: 00B8AC56

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 00B8FF28
CreateCompatibleDC.GDI32(00000028), ref: 00B8FF3B
SelectObject.GDI32(?,00000000), ref: 00B8FF5E
SelectPalette.GDI32(?,00000000,00000000), ref: 00B8FF7A
RealizePalette.GDI32(?), ref: 00B8FF85
SetTextColor.GDI32(?,00000000), ref: 00B8FFA3
SetBkColor.GDI32(?,00000000), ref: 00B8FFBD
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00B8FFE5
SelectPalette.GDI32(?,00000000,000000FF), ref: 00B8FFF7
SelectObject.GDI32(?,00000000), ref: 00B90001
DeleteDC.GDI32(?), ref: 00B9001C

Part of subcall function 00B8BCBC: CreateBrushIndirect.GDI32(?), ref: 00B8BD67

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapRealizeText$BrushDeleteFillIndirectRectTable
String ID:
API String ID: 1299887459-0
Opcode ID: d313e63862e8a5970348ca09e6b70a1e632ad0025655cbf0df7ac90e7827d4af
Instruction ID: 1a15f9e9a584606bfcdba35a3b56cb31e7d49c67bb2697c6597eb516ab16b0b8
Opcode Fuzzy Hash: d313e63862e8a5970348ca09e6b70a1e632ad0025655cbf0df7ac90e7827d4af
Instruction Fuzzy Hash: C512BB75A00209AFDB50EFA8C885FAEB7F8EB08311F1185A5F918EB261D774DD45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B5729C Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 152stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000), ref: 00B572B9
GetProcAddress.KERNEL32(?,GetLongPathNameW), ref: 00B572D0
lstrcpynW.KERNEL32(?,?,?), ref: 00B57300
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,00000000,?,00000000), ref: 00B5736F
lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,00000000,?,00000000), ref: 00B573B7
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,00000000,?,00000000), ref: 00B573CA
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,00000000,?,00000000), ref: 00B573E0
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00000000,?,00000000), ref: 00B573EC
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00000000,?), ref: 00B57428
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,00000000), ref: 00B57434
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00B57457

Strings

\, xrefs: 00B573FE
kernel32.dll, xrefs: 00B572B4
GetLongPathNameW, xrefs: 00B572C7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 3245196872-3908791685
Opcode ID: a6e1464317ba640d46727768455201105851e23259b2b0822ddfc3261f5e88d1
Instruction ID: 89864d74068531a7e49282de9dd3052e7ee075de8fb5f579c8658554ea9c639e
Opcode Fuzzy Hash: a6e1464317ba640d46727768455201105851e23259b2b0822ddfc3261f5e88d1
Instruction Fuzzy Hash: D1519272E44219ABCB10EAE8DC85BDE73FCEB04311F1449E5AD04E7251EB74EE488B58

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2E14 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00BC2E23
GetWindowPlacement.USER32(?,0000002C), ref: 00BC2E40
GetWindowRect.USER32(?,?), ref: 00BC2E5F
GetWindowLongW.USER32(?,000000F0), ref: 00BC2E6D
GetWindowLongW.USER32(?,000000F8), ref: 00BC2E86
GetWindowLongW.USER32(00000000,000000EC), ref: 00BC2E94
ScreenToClient.USER32(00000000), ref: 00BC2EC4
ScreenToClient.USER32(00000000), ref: 00BC2EE9

Strings

,, xrefs: 00BC2E2C

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Long$ClientScreen$IconicPlacementRect
String ID: ,
API String ID: 1823113212-3772416878
Opcode ID: 6bcbc173979f4a1d701d335460b579214f9f694f40f975e4aabb3686205a0de6
Instruction ID: e55e7fd80a5c8432352be083f0eddcc3ab6a6fd26517c1f387614f9a053ec4c6
Opcode Fuzzy Hash: 6bcbc173979f4a1d701d335460b579214f9f694f40f975e4aabb3686205a0de6
Instruction Fuzzy Hash: 5631C2B5509302AFC740DF6CC484A5BBBE8EF88350F1089ADBD98EB391D730D8448B92

Uniqueness

Uniqueness Score: -1.00%

Function 00B9DAD8 Relevance: 12.4, APIs: 8, Instructions: 381windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(00000000), ref: 00B9DBB0
SetFocus.USER32(00000000), ref: 00B9DC51
SaveDC.GDI32(?), ref: 00B9DE13
RestoreDC.GDI32(?,?), ref: 00B9DE84
GetWindowDC.USER32(00000000), ref: 00B9DEF0
SaveDC.GDI32(?), ref: 00B9DF27
RestoreDC.GDI32(?,?), ref: 00B9DF8B

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: RestoreSave$FocusIconicWindow
String ID:
API String ID: 1400084646-0
Opcode ID: 1bad7ea5d3cd9c707a8d6a82037c648c482c7056514ceeed21ff0349ce5424a3
Instruction ID: fd2b5c9e42737d1f302ed24d90c14f9eebaf044fa3d6d5e33048cd1a20d34718
Opcode Fuzzy Hash: 1bad7ea5d3cd9c707a8d6a82037c648c482c7056514ceeed21ff0349ce5424a3
Instruction Fuzzy Hash: 31E17B30A006449FDF15EB69C986FAEB7F2EB45700F2941F5E414AB6A2CB71EE40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B9AE8C Relevance: 12.1, APIs: 8, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00B9AE9A
IsIconic.USER32(?), ref: 00B9AEC8
IsWindowVisible.USER32(?), ref: 00B9AED8
ShowWindow.USER32(?,00000000,?,?,?,000000EC,00000001,?,?,00000000,00BA56CD,?,?,?,00BA5863,00000000), ref: 00B9AEF5
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B9AF08
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B9AF19
ShowWindow.USER32(?,00000006,?,000000EC,00000000,?,?,?,000000EC,00000001,?,?,00000000,00BA56CD), ref: 00B9AF39
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,?,?,000000EC,00000001,?,?,00000000,00BA56CD), ref: 00B9AF43

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$LongShow$IconicVisible
String ID:
API String ID: 3484284227-0
Opcode ID: c722207a556aa789f70be547f7f6bdebe3b8e3a4eb5ab23563ab8db975ef43b5
Instruction ID: f013ae6831605a1dfb3bc4bdd497b60279556c476745fc20aa171f328f9ea7d0
Opcode Fuzzy Hash: c722207a556aa789f70be547f7f6bdebe3b8e3a4eb5ab23563ab8db975ef43b5
Instruction Fuzzy Hash: C911A74254D6D038DF2272354C46FBF2AE98F93356F1849F9F9D5E20C2C629854982A7

Uniqueness

Uniqueness Score: -1.00%

Function 00BAF684 Relevance: 10.9, APIs: 7, Instructions: 415COMMON

Download Yara Rule

APIs

SaveDC.GDI32(?), ref: 00BAF954
RestoreDC.GDI32(?,?), ref: 00BAF9C8
GetWindowDC.USER32(?,00000000,00BAFBD6), ref: 00BAFA42
SaveDC.GDI32(?), ref: 00BAFA79
RestoreDC.GDI32(?,?), ref: 00BAFB04
DefWindowProcW.USER32(?,?,?,?,00000000,00BAFBD6), ref: 00BAFBB8

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: RestoreSaveWindow$Proc
String ID:
API String ID: 1975259465-0
Opcode ID: 1f6891f405715c5c0a3604213b203606eb9c1012549e29848478379e2dcf0f4d
Instruction ID: 3f225b2782f7c42ee9c6aea243fbc485fbcf8c127536f82d2e76ed6147d8751c
Opcode Fuzzy Hash: 1f6891f405715c5c0a3604213b203606eb9c1012549e29848478379e2dcf0f4d
Instruction Fuzzy Hash: 59F10974A0820A9FCB10EFA9C491DAEF7F5FB8A300B6585E5E911A7361D734ED41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BC244C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00BC248B
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00BC24A9
GetWindowPlacement.USER32(?,0000002C), ref: 00BC24DF
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00BC2503

Strings

,, xrefs: 00BC24CD

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: fc9377a52b3a9c1496a51c9b93cb7dfc739fb7cf967ead1d629f8a50d462a073
Instruction ID: c3259565d783c29d9550938adc404277ef7a0c4d7b7c2204b39eef40b9fdc642
Opcode Fuzzy Hash: fc9377a52b3a9c1496a51c9b93cb7dfc739fb7cf967ead1d629f8a50d462a073
Instruction Fuzzy Hash: 7F210C71A012049BCF54EF6DD8C5E9A77E9EF09311F0484A9FE18EF206DA71EC448BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B94128 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

MonitorFromWindow, xrefs: 00B9413F

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: AddressProc
String ID: MonitorFromWindow
API String ID: 190572456-2842599566
Opcode ID: a71504f1be9a300efdd9374141c71d790053d9446431c9cdfb509f705bcf9708
Instruction ID: 2c6862148a5fc87e61bb2926713c7bec78d752c53659af49630c5caebf154792
Opcode Fuzzy Hash: a71504f1be9a300efdd9374141c71d790053d9446431c9cdfb509f705bcf9708
Instruction Fuzzy Hash: 3001A2725009286A9B10EB50EDC1EBF7BEDDB15364B0401F1FE14BB262DF249E4A43B1

Uniqueness

Uniqueness Score: -1.00%

Function 00B8F354 Relevance: 4.6, APIs: 3, Instructions: 51fileclipboardCOMMON

Download Yara Rule

APIs

GetClipboardData.USER32(0000000E), ref: 00B8F361
CopyEnhMetaFileW.GDI32(00000000,00000000), ref: 00B8F383
GetEnhMetaFileHeader.GDI32(?,00000064,?,00000000,00000000), ref: 00B8F395

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileMeta$ClipboardCopyDataHeader
String ID:
API String ID: 1752724394-0
Opcode ID: c27530e71b93fe73308dee9e5d843ce3bea7400021da56f53d0879d2f0879aa3
Instruction ID: 3f9a1dcdfd84be6d4798e072ea684d364f0a423bfeb9c14fb9577cd3158a1b93
Opcode Fuzzy Hash: c27530e71b93fe73308dee9e5d843ce3bea7400021da56f53d0879d2f0879aa3
Instruction Fuzzy Hash: 361161716003058FD710EF6DC885A9AB7F8EF49310F1045A9E908DB252DB70EC05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4844 Relevance: 4.5, APIs: 3, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BA4850
GetCursorPos.USER32(?), ref: 00BA486D
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 00BA488D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CurrentCursorObjectSingleThreadWait
String ID:
API String ID: 1359611202-0
Opcode ID: ade8ebdcadc695be8460844af7e2c226c903c3e540cea2bd5e535673967e8576
Instruction ID: c2314ce0edc8bd4411e73a4961baefe0c96d20d1811ca3d61127f07e91db7d3a
Opcode Fuzzy Hash: ade8ebdcadc695be8460844af7e2c226c903c3e540cea2bd5e535673967e8576
Instruction Fuzzy Hash: DBF0893151C644DBDB14EB54ECC6B9933DDDF41351F5000E1E504AB1D2EFB59848CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00BBF7EC Relevance: 3.1, APIs: 2, Instructions: 97windowCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 00BBF7FB
GetKeyboardState.USER32(?,?,?,?,00BBFD54), ref: 00BBF8F8

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: KeyboardMessageState
String ID:
API String ID: 3083355189-0
Opcode ID: ffa0f836828c30cb0a280b059e9fa3e8ed931d0ffeb48ec9346d8991759b5a9a
Instruction ID: e3dddb0575386addbe175944d2ca755ba8bc19eafbfa238b148f02c26a21ff0c
Opcode Fuzzy Hash: ffa0f836828c30cb0a280b059e9fa3e8ed931d0ffeb48ec9346d8991759b5a9a
Instruction Fuzzy Hash: A0316D31608742DBC724DF788C867FEBBD1AB89310F004ABEE599D6291E7B4C9048796

Uniqueness

Uniqueness Score: -1.00%

Function 00B8C7A8 Relevance: 3.0, APIs: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00B8C844), ref: 00B8C7C8
FormatMessageW.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,00B8C844), ref: 00B8C7EE

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a4298fbfb558b49dd86a1e8745a9e0fd25616779e5050760fd17ff7529887860
Instruction ID: e0ecb5756ad97a17817e00ad777ddc2fdc3884d41a313e4199b3dccd3b8bbc6e
Opcode Fuzzy Hash: a4298fbfb558b49dd86a1e8745a9e0fd25616779e5050760fd17ff7529887860
Instruction Fuzzy Hash: 0B0184B06447065FE721FB608C96BA977E9EB08701F8044F4BA04A61D2EAB0AD44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00BD20B0 Relevance: 99.4, APIs: 66, Instructions: 363windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00BD20F0
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BD20FC
CreateBitmap.GDI32(00000001,00000001,00000001,00000000,00000000), ref: 00BD210C
DeleteDC.GDI32(00000000), ref: 00BD211B
SelectObject.GDI32(00000000,00000000), ref: 00BD212A
BitBlt.GDI32(00000000,00000000,00000000,00000001,00000001,00000000,?,?,00CC0020), ref: 00BD2150
SelectObject.GDI32(00000000,?), ref: 00BD215E
DeleteObject.GDI32(00000000), ref: 00BD2167
DeleteDC.GDI32(00000000), ref: 00BD216D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: DeleteObject$CreateSelect$BitmapCapsCompatibleDevice
String ID:
API String ID: 212303809-0
Opcode ID: 3cd9ac3eabdd42deddb3126305981f01b2844d0e46314510d76bb71880e00306
Instruction ID: 3dd841702026deb1e571417724fd476fcf3909f518a575c897858b759135aebb
Opcode Fuzzy Hash: 3cd9ac3eabdd42deddb3126305981f01b2844d0e46314510d76bb71880e00306
Instruction Fuzzy Hash: 46B1DFB1A40249BBDB50EBA88C86FBF73ECAF09705F1054C5FA14F7281DA74A9058B65

Uniqueness

Uniqueness Score: -1.00%

Function 00B93378 Relevance: 86.0, APIs: 1, Strings: 48, Instructions: 268libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(uxtheme.dll,00000000,00B9372A), ref: 00B933AD

Part of subcall function 00B58708: GetProcAddress.KERNEL32(?,?), ref: 00B5872C

Part of subcall function 00B58708: GetProcAddress.KERNEL32(?,00000000), ref: 00B5874E

Strings

GetThemeMetric, xrefs: 00B934DD
GetThemeSysColor, xrefs: 00B935C7
IsThemeBackgroundPartiallyTransparent, xrefs: 00B934B9
GetThemeInt, xrefs: 00B93513
GetThemeTextMetrics, xrefs: 00B9344D
GetThemeEnumValue, xrefs: 00B93525
GetThemeRect, xrefs: 00B9355B
SetThemeAppProperties, xrefs: 00B936B1
GetThemePropertyOrigin, xrefs: 00B93591
GetThemePartSize, xrefs: 00B93429
GetThemeIntList, xrefs: 00B9357F
DrawThemeBackground, xrefs: 00B933E1
uxtheme.dll, xrefs: 00B933A8
GetWindowTheme, xrefs: 00B93669
GetThemeSysFont, xrefs: 00B9360F
GetThemeSysSize, xrefs: 00B935FD
GetThemeSysBool, xrefs: 00B935EB
GetThemeColor, xrefs: 00B934CB
DrawThemeIcon, xrefs: 00B93495
GetThemeBool, xrefs: 00B93501
GetThemeBackgroundRegion, xrefs: 00B9345F
EnableThemeDialogTexture, xrefs: 00B9367B
GetThemeString, xrefs: 00B934EF
GetThemeBackgroundContentRect, xrefs: 00B93405
IsAppThemed, xrefs: 00B93657
GetThemeFilename, xrefs: 00B935B5
IsThemeActive, xrefs: 00B93645
GetThemeSysString, xrefs: 00B93621
GetCurrentThemeName, xrefs: 00B936C3
DrawThemeEdge, xrefs: 00B93483
GetThemeSysColorBrush, xrefs: 00B935D9
CloseThemeData, xrefs: 00B933CF
GetThemeAppProperties, xrefs: 00B9369F
GetThemeSysInt, xrefs: 00B93633
OpenThemeData, xrefs: 00B933BD
GetThemePosition, xrefs: 00B93537
EnableTheming, xrefs: 00B936F9
HitTestThemeBackground, xrefs: 00B93471
DrawThemeText, xrefs: 00B933F3
DrawThemeParentBackground, xrefs: 00B936E7
GetThemeFont, xrefs: 00B93549
GetThemeDocumentationProperty, xrefs: 00B936D5
IsThemePartDefined, xrefs: 00B934A7
IsThemeDialogTextureEnabled, xrefs: 00B9368D
SetWindowTheme, xrefs: 00B935A3
GetThemeTextExtent, xrefs: 00B9343B
GetThemeBackgroundExtent, xrefs: 00B93417
GetThemeMargins, xrefs: 00B9356D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundExtent$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2238633743-1748089680
Opcode ID: 6f1801abe83f4482b835e437476bb779507efc951a31bba7e1b51811e60fee7d
Instruction ID: 152f751f8cda8d431061355962c5af28533ae5aaf5a403ff2b3bb463c47b9c46
Opcode Fuzzy Hash: 6f1801abe83f4482b835e437476bb779507efc951a31bba7e1b51811e60fee7d
Instruction Fuzzy Hash: 8AA115B4AA4690AFDF01EBA4DCC6E293BE8EB0AB0175045F5F800EF265DE749D048F51

Uniqueness

Uniqueness Score: -1.00%

Function 00B64974 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 00B6497D

Part of subcall function 00B64948: GetProcAddress.KERNEL32(00000000), ref: 00B64961

Strings

VarMul, xrefs: 00B649F9
VarR4FromStr, xrefs: 00B64ABF
VarNot, xrefs: 00B649B7
VarAnd, xrefs: 00B64A51
VarCyFromStr, xrefs: 00B64B01
VarIdiv, xrefs: 00B64A25
VarBstrFromBool, xrefs: 00B64B59
VarBstrFromDate, xrefs: 00B64B43
VarCmp, xrefs: 00B64A93
VarI4FromStr, xrefs: 00B64AA9
VarBoolFromStr, xrefs: 00B64B17
VarSub, xrefs: 00B649E3
VarDateFromStr, xrefs: 00B64AEB
VarXor, xrefs: 00B64A7D
VarMod, xrefs: 00B64A3B
VarDiv, xrefs: 00B64A0F
VarBstrFromCy, xrefs: 00B64B2D
VarAdd, xrefs: 00B649CD
VarOr, xrefs: 00B64A67
VariantChangeTypeEx, xrefs: 00B6498B
VarNeg, xrefs: 00B649A1
oleaut32.dll, xrefs: 00B64978
VarR8FromStr, xrefs: 00B64AD5

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 27e6037e642bdd9018f547c2e5020ed7c9bd5ceee929545f0aca1d88df7e900d
Instruction ID: b65c10535045101c1c80e59736795bf69358be231420171e59d1d665e77886ea
Opcode Fuzzy Hash: 27e6037e642bdd9018f547c2e5020ed7c9bd5ceee929545f0aca1d88df7e900d
Instruction Fuzzy Hash: A14129A7688A885F5308ABADFC4143777DDDA417203A584FAF404CB794DF3CEC414A69

Uniqueness

Uniqueness Score: -1.00%

Function 00BCACE4 Relevance: 38.7, APIs: 1, Strings: 21, Instructions: 170COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32(00000000,?,00000000,00BCAF9C), ref: 00BCAF81

Strings

GdiplusUnknownImageFormat, xrefs: 00BCAE87
GdiplusNotInitialized, xrefs: 00BCAEF6
GdiplusUnknown, xrefs: 00BCAF35
GdiplusUnsupportedGdiplusVersion, xrefs: 00BCAEE1
GdiplusAccessDenied, xrefs: 00BCAE6F
GDIPlus Exception: %d - %s, xrefs: 00BCAF6E
GdiplusGenericError, xrefs: 00BCAD67, 00BCADF7
GdiplusInsufficientBuffer, xrefs: 00BCADC7
GdiplusNotImplemented, xrefs: 00BCADDF
GdiplusFontFamilyNotFound, xrefs: 00BCAE9F
GdiplusAborted, xrefs: 00BCAE27
GdiplusFontStyleNotFound, xrefs: 00BCAEB7
GdiplusPropertyNotFoundError, xrefs: 00BCAF0B
GdiplusWrongState, xrefs: 00BCAE0F
GdiplusObjectBusy, xrefs: 00BCADAF
GdiplusFileNotFound, xrefs: 00BCAE3F
GdiplusPropertyNotSupportedError, xrefs: 00BCAF20
GdiplusOutOfMemory, xrefs: 00BCAD97
GdiplusOverflow, xrefs: 00BCAE57
GdiplusInvalidParameter, xrefs: 00BCAD7F
GdiplusNotTrueTypeFont_NoName, xrefs: 00BCAECC

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: DebugOutputString
String ID: GDIPlus Exception: %d - %s$GdiplusAborted$GdiplusAccessDenied$GdiplusFileNotFound$GdiplusFontFamilyNotFound$GdiplusFontStyleNotFound$GdiplusGenericError$GdiplusInsufficientBuffer$GdiplusInvalidParameter$GdiplusNotImplemented$GdiplusNotInitialized$GdiplusNotTrueTypeFont_NoName$GdiplusObjectBusy$GdiplusOutOfMemory$GdiplusOverflow$GdiplusPropertyNotFoundError$GdiplusPropertyNotSupportedError$GdiplusUnknown$GdiplusUnknownImageFormat$GdiplusUnsupportedGdiplusVersion$GdiplusWrongState
API String ID: 1166629820-518354240
Opcode ID: bbc6d5eeed3bf951137a462358f2681f399e15b283b0a631fa9eb53717ac2c87
Instruction ID: babbf0362eadc5912770cbaf00e92d7503ee81db78c492507be5a92b701d90cd
Opcode Fuzzy Hash: bbc6d5eeed3bf951137a462358f2681f399e15b283b0a631fa9eb53717ac2c87
Instruction Fuzzy Hash: 7F516B7171014E9B8305EB69D8D6F6D33D6974D34CB5008FCE602EF3A2DE66AC04A796

Uniqueness

Uniqueness Score: -1.00%

Function 00B8CA00 Relevance: 37.7, APIs: 25, Instructions: 245windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 00B8CA43
SelectObject.GDI32(?,?), ref: 00B8CA58
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,CCAA0029,00000000,00B8CAC8,?,?), ref: 00B8CA9C
SelectObject.GDI32(?,?), ref: 00B8CAB6
DeleteObject.GDI32(?), ref: 00B8CAC2
CreateCompatibleDC.GDI32(00000000), ref: 00B8CAD6
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00B8CAF7
SelectObject.GDI32(?,?), ref: 00B8CB0C
SelectPalette.GDI32(?,E2080E87,00000000), ref: 00B8CB20
SelectPalette.GDI32(?,?,00000000), ref: 00B8CB32
SelectPalette.GDI32(?,00000000,000000FF), ref: 00B8CB47
SelectPalette.GDI32(?,E2080E87,000000FF), ref: 00B8CB5D
RealizePalette.GDI32(?), ref: 00B8CB69
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 00B8CB8B
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 00B8CBAD
SetTextColor.GDI32(?,00000000), ref: 00B8CBB5
SetBkColor.GDI32(?,00FFFFFF), ref: 00B8CBC3
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 00B8CBEF
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 00B8CC14
SetTextColor.GDI32(?,?), ref: 00B8CC1E
SetBkColor.GDI32(?,?), ref: 00B8CC28
SelectObject.GDI32(?,00000000), ref: 00B8CC3B
DeleteObject.GDI32(?), ref: 00B8CC44
SelectPalette.GDI32(?,00000000,00000000), ref: 00B8CC66
DeleteDC.GDI32(?), ref: 00B8CC6F

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: e560f0b4a7e8d548d407343df7d500efcc03243e922d79044f96e3d346fbfba2
Instruction ID: 5630ea3553d41b3e42eb0e716c61146a48e2220c6cb6e0113492b253af79e638
Opcode Fuzzy Hash: e560f0b4a7e8d548d407343df7d500efcc03243e922d79044f96e3d346fbfba2
Instruction Fuzzy Hash: BE8190B2A00209AFDB50EEA8CD85FAF7BECEB0D714F110595FA18E7251D674AD00CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B90148 Relevance: 31.7, APIs: 21, Instructions: 194windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000054,?), ref: 00B9016B
GetDC.USER32(00000000), ref: 00B90199
CreateCompatibleDC.GDI32(?), ref: 00B901AA
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 00B901C5
SelectObject.GDI32(?,00000000), ref: 00B901DF
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 00B90201
CreateCompatibleDC.GDI32(?), ref: 00B9020F
SelectObject.GDI32(?), ref: 00B90257
SelectPalette.GDI32(?,?,00000000), ref: 00B9026A
RealizePalette.GDI32(?), ref: 00B90273
SelectPalette.GDI32(?,?,00000000), ref: 00B9027F
RealizePalette.GDI32(?), ref: 00B90288
SetBkColor.GDI32(?), ref: 00B90292
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00B902B6
SetBkColor.GDI32(?,00000000), ref: 00B902C0
SelectObject.GDI32(?,00000000), ref: 00B902D3
DeleteObject.GDI32 ref: 00B902DF
DeleteDC.GDI32(?), ref: 00B902F5
SelectObject.GDI32(?,00000000), ref: 00B90310
DeleteDC.GDI32(00000000), ref: 00B9032C
ReleaseDC.USER32(00000000,00000000), ref: 00B9033D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: 727f23636c4b75c83fb3fb34095de71b8fdbe571b2a10bf83bdcceecea0d580d
Instruction ID: 21961d4c129be5a67e5b8be581ceb177c1236cc1ab49ad9e282a99c2e0fca1f8
Opcode Fuzzy Hash: 727f23636c4b75c83fb3fb34095de71b8fdbe571b2a10bf83bdcceecea0d580d
Instruction Fuzzy Hash: 6D51EBB1E14209AFDF51EBF88C46BAEB7FCEB08701F1044E5B614E7281DA749944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00B91420 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 352windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B91690
CreateCompatibleDC.GDI32(00000001), ref: 00B916F5
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 00B9170A
SelectObject.GDI32(?,00000000), ref: 00B91714
SelectPalette.GDI32(?,?,00000000), ref: 00B91744
RealizePalette.GDI32(?), ref: 00B91750
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 00B91774
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,00B917CD,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 00B91782
SelectPalette.GDI32(?,00000000,000000FF), ref: 00B917B4
SelectObject.GDI32(?,?), ref: 00B917C1
DeleteObject.GDI32(00000000), ref: 00B917C7

Strings

(, xrefs: 00B915DB
BM, xrefs: 00B91546

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 078706d798adc38eaec05192e6c57d461cd40db0ca37f11e08268cffab2aec93
Instruction ID: e0c13a43c2be4206788330a0924114467349846fa2b2c6e49f4c6f609ba385dd
Opcode Fuzzy Hash: 078706d798adc38eaec05192e6c57d461cd40db0ca37f11e08268cffab2aec93
Instruction Fuzzy Hash: 6CD128B4E002199FDF14DFA8C885BAEBBF5FF49300F0488A5F904AB295DB349944DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B90930 Relevance: 22.8, APIs: 15, Instructions: 253windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B91198: GetDC.USER32(00000000), ref: 00B911EE
Part of subcall function 00B91198: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B91203
Part of subcall function 00B91198: GetDeviceCaps.GDI32(00000000,0000000E), ref: 00B9120D
Part of subcall function 00B91198: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00B8F7E3,00000000,00B8F86F), ref: 00B91231
Part of subcall function 00B91198: ReleaseDC.USER32(00000000,00000000), ref: 00B9123C

SelectPalette.GDI32(?,?,000000FF), ref: 00B90973
RealizePalette.GDI32(?), ref: 00B90982
GetDeviceCaps.GDI32(?,0000000C), ref: 00B90994
GetDeviceCaps.GDI32(?,0000000E), ref: 00B909A3
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 00B909D6
SetStretchBltMode.GDI32(?,00000004), ref: 00B909E4
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 00B909FC
SetStretchBltMode.GDI32(00000000,00000003), ref: 00B90A19
CreateCompatibleDC.GDI32(00000000), ref: 00B90A7A
SelectObject.GDI32(?,?), ref: 00B90A8F
SelectObject.GDI32(?,00000000), ref: 00B90AEE
DeleteDC.GDI32(00000000), ref: 00B90AFD

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 2d9f041ad775877836b4e6eda642fa83bc0579f01dbc30461fd529068c645414
Instruction ID: 285616489e5f93953f9578436923694471755b458660ea69564d89cc3110a566
Opcode Fuzzy Hash: 2d9f041ad775877836b4e6eda642fa83bc0579f01dbc30461fd529068c645414
Instruction Fuzzy Hash: 4B911BB1A04245AFDB50EFACC985F6EBBF8EF09300F1485A5F548E7292D674E944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B90684 Relevance: 22.8, APIs: 15, Instructions: 252windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B91198: GetDC.USER32(00000000), ref: 00B911EE
Part of subcall function 00B91198: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B91203
Part of subcall function 00B91198: GetDeviceCaps.GDI32(00000000,0000000E), ref: 00B9120D
Part of subcall function 00B91198: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00B8F7E3,00000000,00B8F86F), ref: 00B91231
Part of subcall function 00B91198: ReleaseDC.USER32(00000000,00000000), ref: 00B9123C

SelectPalette.GDI32(?,?,000000FF), ref: 00B906C7
RealizePalette.GDI32(?), ref: 00B906D6
GetDeviceCaps.GDI32(?,0000000C), ref: 00B906E8
GetDeviceCaps.GDI32(?,0000000E), ref: 00B906F7
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 00B9072A
SetStretchBltMode.GDI32(?,00000004), ref: 00B90738
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 00B90750
SetStretchBltMode.GDI32(00000000,00000003), ref: 00B9076D
CreateCompatibleDC.GDI32(00000000), ref: 00B907CE
SelectObject.GDI32(?,?), ref: 00B907E3
SelectObject.GDI32(?,00000000), ref: 00B90842
DeleteDC.GDI32(00000000), ref: 00B90851

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 99d55333d1d93880406dcf9f0c42e3d15fa811bd21787618f872aa37b053eb31
Instruction ID: f3995380e81c114b5d4dd644d2886359ecbed6466fe6cf83fc409474b663c9a3
Opcode Fuzzy Hash: 99d55333d1d93880406dcf9f0c42e3d15fa811bd21787618f872aa37b053eb31
Instruction Fuzzy Hash: B291E9B5A00205AFDB50EFACC985F6ABBF8EF08300F1485A5F518E7692D634ED44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BCFCF4 Relevance: 22.7, APIs: 15, Instructions: 216COMMON

Download Yara Rule

APIs

Part of subcall function 00BCC3B4: GdipGetImageFlags.GDIPLUS(?,?,?,?,00BCFD12), ref: 00BCC3C2

GdipGetImageWidth.GDIPLUS(?), ref: 00BCFD27
GdipGetImageHeight.GDIPLUS(?,?,?), ref: 00BCFD53

Part of subcall function 00BCA070: IsEqualGUID.OLE32(?,?), ref: 00BCA072

GetDC.USER32(00000000), ref: 00BCFD86
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BCFD90
ReleaseDC.USER32(00000000,00000000), ref: 00BCFD9A
GdipGetImageWidth.GDIPLUS(?,0000005A,00000000,00000000,00000000,0000005A,00000000), ref: 00BCFDB4
GdipGetImageHorizontalResolution.GDIPLUS(?,00000000,?,0000005A,00000000,00000000,00000000,0000005A,00000000), ref: 00BCFDDB
MulDiv.KERNEL32(0000005A,00000000,00000000), ref: 00BCFDFD
GdipGetImageHeight.GDIPLUS(?,00000000,0000005A,00000000,00000000,?,00000000,?,0000005A,00000000,00000000,00000000,0000005A,00000000), ref: 00BCFE1D
GdipGetImageVerticalResolution.GDIPLUS(?,?,?,00000000,0000005A,00000000,00000000,?,00000000,?,0000005A,00000000,00000000,00000000,0000005A,00000000), ref: 00BCFE44
MulDiv.KERNEL32(00000000,00000000,00000000), ref: 00BCFE66
GdipGetImagePixelFormat.GDIPLUS(?,?,?,?,?,?), ref: 00BCFEDC
GdipGetImageRawFormat.GDIPLUS(?,?,?,?,?,?,?,?), ref: 00BCFF29

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: GdipImage$FormatHeightResolutionWidth$CapsDeviceEqualFlagsHorizontalPixelReleaseVertical
String ID:
API String ID: 1127474611-0
Opcode ID: 4d1f7e4fa12748b3344ad0f0b6a298727da5a8d654690eb3c8e39f5c1fe19653
Instruction ID: dc2023d85ee768a8ac519e2025722fdf63d18e7cd4509338d90ade434b77ca2c
Opcode Fuzzy Hash: 4d1f7e4fa12748b3344ad0f0b6a298727da5a8d654690eb3c8e39f5c1fe19653
Instruction Fuzzy Hash: 6681D7B66042019FC741EF28C485E5BB7E9AF8C720B158AA9F89CDB316D730ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B8C860 Relevance: 21.1, APIs: 14, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00B8C877
CreateCompatibleDC.GDI32(00000000), ref: 00B8C881
GetObjectW.GDI32(?,00000018,?), ref: 00B8C8A1
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 00B8C8B8
GetDC.USER32(00000000), ref: 00B8C8C4
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00B8C8F1
ReleaseDC.USER32(00000000,00000000), ref: 00B8C917
SelectObject.GDI32(?,?), ref: 00B8C932
SelectObject.GDI32(?,00000000), ref: 00B8C941
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 00B8C96D
SelectObject.GDI32(?,00000000), ref: 00B8C97B
SelectObject.GDI32(?,00000000), ref: 00B8C989
DeleteDC.GDI32(?), ref: 00B8C99F
DeleteDC.GDI32(?), ref: 00B8C9A8

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 1073c77a40b3baaf7e459cdc2ec6a00f049341cb2c23fa338290bfd785ef6ba8
Instruction ID: 434ac3d9de8cbc50b0413ac7d533bf948b53f7adfd8ad52459e286ebe8220782
Opcode Fuzzy Hash: 1073c77a40b3baaf7e459cdc2ec6a00f049341cb2c23fa338290bfd785ef6ba8
Instruction Fuzzy Hash: FB41C8B1A44249AFDB51EAE8C842FBEBBFCEB08701F5104D1FA14E7291DA749904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BA57F0 Relevance: 19.9, APIs: 13, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138a120a8b8a7217fea8e41e1c10f36a4c8510d52d7cc9f6beb794851aba2b1a
Instruction ID: 1e61e74f34f6b9a28c972b1e66ac2615f93d6461e1e923e02b918f961a02b5c0
Opcode Fuzzy Hash: 138a120a8b8a7217fea8e41e1c10f36a4c8510d52d7cc9f6beb794851aba2b1a
Instruction Fuzzy Hash: 9CF14E75608A04EFDB20DF68C985A9DBBF5EF0A310F6841E5E805AB652DB31EF40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BC39B8 Relevance: 19.7, APIs: 13, Instructions: 248COMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 00BC39EC
GetClientRect.USER32(00000000,?), ref: 00BC3A0F
GetWindowRect.USER32(00000000,?), ref: 00BC3A21
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00BC3A37
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,00000000,?,00000002,00000000,?,00000000,?,00000000,00BC3C63), ref: 00BC3A62
InflateRect.USER32(?,00000000,00000000), ref: 00BC3A80
GetWindowLongW.USER32(00000000,000000F0), ref: 00BC3A9A
DrawEdge.USER32(?,?,?,00000008), ref: 00BC3B9D
IntersectClipRect.GDI32(?,?,?,?,?), ref: 00BC3BB6
GetRgnBox.GDI32(?,?), ref: 00BC3BEC
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00BC3C02
FillRect.USER32(?,?,00000000), ref: 00BC3C3E
ReleaseDC.USER32(00000000,?), ref: 00BC3C5D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Rect$Window$ClipPoints$ClientDrawEdgeExcludeFillInflateIntersectLongRelease
String ID:
API String ID: 2031318930-0
Opcode ID: ea92ea97402c926c84a568aa0440320cce896f024393599b055d25d5055443ff
Instruction ID: e6352ad086194c34763df331225d230c00a98ae001d65f93b2fbb5ca4b92b7d6
Opcode Fuzzy Hash: ea92ea97402c926c84a568aa0440320cce896f024393599b055d25d5055443ff
Instruction Fuzzy Hash: F9A11971A00248AFCB05DBA8C885FDEB7F9AF49701F1484E9F915BB251CB71AE05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B590E4 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61windowregistryCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(MouseZ,Magellan MSWHEEL), ref: 00B590FC
RegisterWindowMessageW.USER32(MSWHEEL_ROLLMSG), ref: 00B59108
RegisterWindowMessageW.USER32(MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG), ref: 00B59117
RegisterWindowMessageW.USER32(MSH_SCROLL_LINES_MSG,MSH_WHEELSUPPORT_MSG,MSWHEEL_ROLLMSG), ref: 00B59123
SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B5913B
SendMessageW.USER32(00000000,?,00000000,00000000), ref: 00B5915F

Strings

MSH_SCROLL_LINES_MSG, xrefs: 00B5911E
MSH_WHEELSUPPORT_MSG, xrefs: 00B59112
MouseZ, xrefs: 00B590F7
Magellan MSWHEEL, xrefs: 00B590F2
MSWHEEL_ROLLMSG, xrefs: 00B59103

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Message$Window$Register$Send$Find
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 3569030445-3736581797
Opcode ID: 3ad1b17f80c3b2dda3ff653c7a07c7b4d9acf8511562b01ac1447f89d8d9e53a
Instruction ID: d79e740cfd7f44781a4ad0e00ad12b3a46380ed634ae0dcaa6e458a64321a3ce
Opcode Fuzzy Hash: 3ad1b17f80c3b2dda3ff653c7a07c7b4d9acf8511562b01ac1447f89d8d9e53a
Instruction Fuzzy Hash: 4E112A70244716FFE710AF64CC86B66B7E9EF49712F2044E5BD49AB290DBB09C48CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00BA1A88 Relevance: 18.5, APIs: 12, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: ea543ca97709207fe3fc28f77dd8c354a758af38787d2c70851ef3ad39701d8b
Instruction ID: 8bcfb0ebe28cdf262628f868179b8d3a193abd6a05b2db2756d282c5a3c9588a
Opcode Fuzzy Hash: ea543ca97709207fe3fc28f77dd8c354a758af38787d2c70851ef3ad39701d8b
Instruction Fuzzy Hash: 9D123835A08644EFDB51DBACC985F9D77E5AB06300F1549E0F908EB3A2DB31AE45DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B94550 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 00B94589
GetSystemMetrics.USER32(00000000), ref: 00B945AE
GetSystemMetrics.USER32(00000001), ref: 00B945B9
GetClipBox.GDI32(?,?), ref: 00B945CB
GetDCOrgEx.GDI32(?,?), ref: 00B945D8
OffsetRect.USER32(?,?,?), ref: 00B945F1
IntersectRect.USER32(?,?,?), ref: 00B94602
IntersectRect.USER32(?,?,?), ref: 00B94618

Part of subcall function 00B93EC8: GetProcAddress.KERNEL32(75BD0000,00000000), ref: 00B93F64

Strings

EnumDisplayMonitors, xrefs: 00B94568

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Rect$IntersectMetricsSystem$AddressClipDisplayEnumMonitorsOffsetProc
String ID: EnumDisplayMonitors
API String ID: 362875416-2491903729
Opcode ID: 229402529cb4194ae986a16f8294c827700ef7cb947baff19f5bf66af0efd4ec
Instruction ID: d7ad65238dec4870fcdcbc903dd204940c7861ade59250c1028ac02de836c758
Opcode Fuzzy Hash: 229402529cb4194ae986a16f8294c827700ef7cb947baff19f5bf66af0efd4ec
Instruction Fuzzy Hash: 02312DB2900149AFDF51DFA48885EEF77FCEB0A301F0045A6FD25E7141EB7499058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3594 Relevance: 16.8, APIs: 11, Instructions: 287windowCOMMON

Download Yara Rule

APIs

StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,00CC0020), ref: 00BD3641
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00BD3749
CreateCompatibleDC.GDI32(?), ref: 00BD3752
SelectObject.GDI32(00000000,?), ref: 00BD3762
GetStretchBltMode.GDI32(?,00000000,00BD3871,?,00000000,?,?,?,?,?,?,?,?), ref: 00BD377F
SetStretchBltMode.GDI32(00000000,00000000), ref: 00BD3789
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00BD24D0,?,00CC0020), ref: 00BD37BF

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Stretch$CompatibleCreateMode$BitmapObjectSelect
String ID:
API String ID: 572248302-0
Opcode ID: 9869b3c3e39ed3804dbdc9467976f88d847e91161caa24a2a3ce783a8161ca5f
Instruction ID: 2a2358cd4980937e847fa28f56d96a594297288e8dac8748c77c2ed36993e9ac
Opcode Fuzzy Hash: 9869b3c3e39ed3804dbdc9467976f88d847e91161caa24a2a3ce783a8161ca5f
Instruction Fuzzy Hash: 1AC15279600209AFCB40DF98C5C4E9ABBF9EB4D361B158195FD88DB352C631EE41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB0F20 Relevance: 16.6, APIs: 11, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000EC), ref: 00BB0F3B
GetWindowRect.USER32(00000000,?), ref: 00BB0F56
GetWindowDC.USER32(00000000,00000000,?,00000000,000000EC), ref: 00BB0F76
GetWindowLongW.USER32(00000000,000000F0), ref: 00BB0FA7
GetSystemMetrics.USER32(00000002), ref: 00BB0FBC
GetSystemMetrics.USER32(00000003), ref: 00BB0FC5
InflateRect.USER32(?,000000FE,000000FE), ref: 00BB0FD4
GetSysColorBrush.USER32(0000000F), ref: 00BB1001
FillRect.USER32(?,?,00000000), ref: 00BB100F
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,00BB1076,?,00000000,00000000,?,00000000,000000EC), ref: 00BB1034
ReleaseDC.USER32(00000000,?), ref: 00BB1070

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: RectWindow$LongMetricsSystem$BrushClipColorExcludeFillInflateRelease
String ID:
API String ID: 3669760922-0
Opcode ID: 46bf42379a84c91d5edbfd0e02dec034c59e2da6e41ae093b2c89f06da318bd6
Instruction ID: 62e77b2bd7ec337f52a0f34c8c96e0d121ee7a67f6813ca07299291700f44128
Opcode Fuzzy Hash: 46bf42379a84c91d5edbfd0e02dec034c59e2da6e41ae093b2c89f06da318bd6
Instruction Fuzzy Hash: E4412E71A00108ABCB41EFA8CD92EEEB7F9EF49311F5005A5F914F7291CA74AE45C760

Uniqueness

Uniqueness Score: -1.00%

Function 00BB6A60 Relevance: 16.6, APIs: 11, Instructions: 91COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32(?), ref: 00BB6A7A
SetWindowLongW.USER32(?,000000FC,?), ref: 00BB6A95
GetWindowLongW.USER32(?,000000F0), ref: 00BB6AA0
GetWindowLongW.USER32(?,000000F4), ref: 00BB6AB2
SetWindowLongW.USER32(?,000000F4,?), ref: 00BB6AC5
SetWindowLongW.USER32(?,000000FC,?), ref: 00BB6ADE
GetWindowLongW.USER32(?,000000F0), ref: 00BB6AE9
GetWindowLongW.USER32(?,000000F4), ref: 00BB6AFB
SetWindowLongW.USER32(?,000000F4,?), ref: 00BB6B0E
SetPropW.USER32(?,00000000,00000000), ref: 00BB6B25
SetPropW.USER32(?,00000000,00000000), ref: 00BB6B3C

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Long$Prop$Unicode
String ID:
API String ID: 1693715928-0
Opcode ID: a28e181d65df8c5d9a4a20af52c94cef9098a2969532b06a2d4dc5e44a72ced3
Instruction ID: faf89b0af2e602972bcc0da37a6d75652bc8b036e1cb5a2dc9b2a64c32ab588a
Opcode Fuzzy Hash: a28e181d65df8c5d9a4a20af52c94cef9098a2969532b06a2d4dc5e44a72ced3
Instruction Fuzzy Hash: 9D31C075504244BBDF10DFACDD85FAA37ECAB09355F104A94BD24DB2E1DB34D9448B60

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0148 Relevance: 15.2, APIs: 10, Instructions: 231windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00BC0260
SaveDC.GDI32(?), ref: 00BC0283
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00BC02C3
RestoreDC.GDI32(?,00BC010B), ref: 00BC02EF

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Rect$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 1976014923-0
Opcode ID: 2a93bab6f22a34837ff1c9bd70258d1c56a8481ee0de01c242863cd360aefeb8
Instruction ID: c6f92921c1924931c91a73520add48f8842e2307d6654937c00134ce5cce6cb4
Opcode Fuzzy Hash: 2a93bab6f22a34837ff1c9bd70258d1c56a8481ee0de01c242863cd360aefeb8
Instruction Fuzzy Hash: 9491C470A10248DFDB05EF98C485FAEBBF4AF48314F1940E9EA44AB256D774ED85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BC04D4 Relevance: 15.2, APIs: 10, Instructions: 197COMMON

Download Yara Rule

APIs

SaveDC.GDI32(?), ref: 00BC04F1

Part of subcall function 00BB8870: GetWindowOrgEx.GDI32(?), ref: 00BB887E
Part of subcall function 00BB8870: SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 00BB8894

IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00BC052A
GetWindowLongW.USER32(00000000,000000EC), ref: 00BC053E
GetWindowLongW.USER32(00000000,000000F0), ref: 00BC055F
SetRect.USER32(00000010,00000000,00000000,?,?), ref: 00BC05BF
IntersectClipRect.GDI32(?,00000000,00000000,00000010,?), ref: 00BC062F

Part of subcall function 00BC0428: SaveDC.GDI32(?), ref: 00BC0438
Part of subcall function 00BC0428: ExcludeClipRect.GDI32(?,?,?,?,?,00000000,00BC04BC,?,?), ref: 00BC0479
Part of subcall function 00BC0428: RestoreDC.GDI32(?,?), ref: 00BC04B6

SetRect.USER32(?,00000000,00000000,?,?), ref: 00BC0650
DrawEdge.USER32(?,?,00000000,00000000), ref: 00BC065F
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00BC0688
RestoreDC.GDI32(?,?), ref: 00BC0707

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Rect$ClipWindow$Intersect$LongRestoreSave$DrawEdgeExclude
String ID:
API String ID: 3997055466-0
Opcode ID: 03772f7df84fa715acdb8bb3abf00dff031b0ec2c6b9c97f947dacc52c7e5638
Instruction ID: eac5e75ec09f48ac109156fb899d33b175e7b02f77fa4da68412315ab29ed4a9
Opcode Fuzzy Hash: 03772f7df84fa715acdb8bb3abf00dff031b0ec2c6b9c97f947dacc52c7e5638
Instruction Fuzzy Hash: 9D71D975A10209EFDB54EF98C985FAEB7F9EF48310F1041D5BA00AB292DB74AE41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BD33CC Relevance: 15.2, APIs: 10, Instructions: 171windowCOMMON

Download Yara Rule

APIs

CreateCompatibleBitmap.GDI32(?,?,?), ref: 00BD346A
CreateCompatibleDC.GDI32(?), ref: 00BD3473
SelectObject.GDI32(00000000,?), ref: 00BD3483
GetStretchBltMode.GDI32(?,00000000,00BD3580,?,00000000,?,?,?,?,?,?,?,?), ref: 00BD34A0
SetStretchBltMode.GDI32(00000000,00000000), ref: 00BD34AA
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00BD34CF
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00BD3545

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CompatibleCreateModeStretch$BitmapObjectSelect
String ID:
API String ID: 1691368784-0
Opcode ID: 61383ee540ac6893ca97bbe1f4026df66a4edd108cf9bb8bf96a21919592f8c3
Instruction ID: 8180e6b3079662bfdda25097abc530b49b7d72b7dd8e1f845b2e8fbf5ae8a3d5
Opcode Fuzzy Hash: 61383ee540ac6893ca97bbe1f4026df66a4edd108cf9bb8bf96a21919592f8c3
Instruction Fuzzy Hash: F8510A75A05248AFCB00DF98D885E9EBBF8EF58710F1084C6F948EB752D634EA44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2484 Relevance: 15.2, APIs: 10, Instructions: 163windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00BA24F5
GetCapture.USER32 ref: 00BA2504
SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 00BA250A
ReleaseCapture.USER32 ref: 00BA250F
GetActiveWindow.USER32 ref: 00BA252C
IsWindow.USER32(00000000), ref: 00BA2572
GetActiveWindow.USER32 ref: 00BA257B
SendMessageW.USER32(00000000,0000B000,00000000,00000000), ref: 00BA2611
SendMessageW.USER32(00000000,0000B001,00000000,00000000), ref: 00BA267E
GetActiveWindow.USER32 ref: 00BA268D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$ActiveCaptureMessageSend$Release
String ID:
API String ID: 3054343883-0
Opcode ID: 72fd3ad7839fc1a96d662d0d3586396aa043788374e2f7d248c53361e918a20b
Instruction ID: bdba23ec0bf3d02338e769db339b7411459b64e0f579ef07f75888f555857adc
Opcode Fuzzy Hash: 72fd3ad7839fc1a96d662d0d3586396aa043788374e2f7d248c53361e918a20b
Instruction Fuzzy Hash: 5E612D70A04644AFDB11EF68C986B9E77F6EF4A300F1544E4F904AB2A2DF74AE44DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00B9E800 Relevance: 15.1, APIs: 10, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 00B9E871
GetWindowLongW.USER32(00000000,000000EC), ref: 00B9E883
GetClassLongW.USER32(00000000,000000E6), ref: 00B9E896
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00B9E8D6
SetWindowLongW.USER32(00000000,000000EC,?), ref: 00B9E8EA
SetClassLongW.USER32(00000000,000000E6,?), ref: 00B9E8FE
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B9E938
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B9E950
GetSystemMenu.USER32(00000000,000000FF,00000000,000000EC,?,00000000,000000F0,00000000,?,00000000,000000EC,00000000,000000F0), ref: 00B9E95F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037,00000000,000000EC,?,00000000,000000F0,00000000,?,00000000,000000EC), ref: 00B9E988

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Long$Window$ClassMessageSend$MenuSystem
String ID:
API String ID: 494549727-0
Opcode ID: 45ce14c7e8b2a8edd1df29954b99fdef57bbbdf1827860f6eed1d4722bb14fc8
Instruction ID: 619cdafad8a1d5b11ce13c827636edb0bc4fe213f4e20ed5bd5e31f4665e9e49
Opcode Fuzzy Hash: 45ce14c7e8b2a8edd1df29954b99fdef57bbbdf1827860f6eed1d4722bb14fc8
Instruction Fuzzy Hash: 2741A47070824166DE56B7388C96FBE67DA5F81314F184AD8F8A0AB2D2CF74DC45D352

Uniqueness

Uniqueness Score: -1.00%

Function 00B53564 Relevance: 15.1, APIs: 10, Instructions: 129fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00B535ED
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00B53611
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00B5362D
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 00B5364E
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00B53677
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00B53685
GetStdHandle.KERNEL32(000000F5), ref: 00B536C0
GetFileType.KERNEL32(?,000000F5), ref: 00B536D6
CloseHandle.KERNEL32(?,?,000000F5), ref: 00B536F1
GetLastError.KERNEL32(000000F5), ref: 00B53709

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 879ab36a9e4a33014ea69617f6acffbda594a61d7d54cf0ba9314907eef9e0f0
Instruction ID: daa2cf19ff3994bd7c7af5a08df63d14d4573babca3db1a59882476b08ea1244
Opcode Fuzzy Hash: 879ab36a9e4a33014ea69617f6acffbda594a61d7d54cf0ba9314907eef9e0f0
Instruction Fuzzy Hash: 4041D370108701AAE7319F288845B2376E4EB04F92F248EDDEC968A7D0E776DE4D8B54

Uniqueness

Uniqueness Score: -1.00%

Function 00B75A7C Relevance: 15.1, APIs: 10, Instructions: 89synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B75A8C
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B75AAD
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00B75AE1
LeaveCriticalSection.KERNEL32(?,00000000,00B75B5D,?,00000000,00000000,00000000,00000000), ref: 00B75AE7
WaitForSingleObject.KERNEL32(?,?,?,00000000,00B75B5D,?,00000000,00000000,00000000,00000000), ref: 00B75AF4
SetLastError.KERNEL32(000005B4,?,?,?,00000000,00B75B5D,?,00000000,00000000,00000000,00000000), ref: 00B75B0E
SetLastError.KERNEL32(00000000,?,?,?,00000000,00B75B5D,?,00000000,00000000,00000000,00000000), ref: 00B75B21
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00B75B5D,?,00000000,00000000,00000000,00000000), ref: 00B75B27
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00B75B3E
CloseHandle.KERNEL32(?,00B75B68,?,?,?,00000000,00B75B5D,?,00000000,00000000,00000000,00000000), ref: 00B75B57

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CriticalErrorExchangeInterlockedLastSection$CloseCreateCurrentEnterEventHandleLeaveObjectSingleThreadWait
String ID:
API String ID: 3135347424-0
Opcode ID: df31e560a9725a24fbeec4dc4d939bea408157933b1d967c671eb134f66b5d47
Instruction ID: b45ca2929e4b8ad125b967565edbcc9254fbdca07b6a4adf26df600feebc7f18
Opcode Fuzzy Hash: df31e560a9725a24fbeec4dc4d939bea408157933b1d967c671eb134f66b5d47
Instruction Fuzzy Hash: B121A871A04648AEDB10DFA4DC82F6EB7E8DB45711F5484E1FD08FB382DAB5990487B1

Uniqueness

Uniqueness Score: -1.00%

Function 00BA0D5C Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00BA0DA7
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00BA0DC5
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00BA0DD2
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00BA0DDF
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00BA0DEC
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00BA0DF9
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00BA0E06
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 00BA0E13
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 00BA0E31
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 00BA0E4D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: b860c75d8aaf00831763b340fde95db0e9ecff19ef0ece49d5cebfaa91a1c162
Instruction ID: a56db039388a0ea2685ae96bb1b02bf8080477979a3c47c249407192b51c79f1
Opcode Fuzzy Hash: b860c75d8aaf00831763b340fde95db0e9ecff19ef0ece49d5cebfaa91a1c162
Instruction Fuzzy Hash: AB212CB47853047EE760AA24CC8EF597BDCAF05B05F0488E4BA487F2D3CAB5A9449614

Uniqueness

Uniqueness Score: -1.00%

Function 00B624EC Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 212threadCOMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000409,00000001,00000000,00B627B2,?,?,00000000,?,00000000,00000000,?,00BDC9C3,00000000,00BDCA7C), ref: 00B62513
GetThreadLocale.KERNEL32(00000409,00000001,00000000,00B627B2,?,?,00000000,?,00000000,00000000,?,00BDC9C3,00000000,00BDCA7C), ref: 00B62520

Part of subcall function 00B5FE40: GetLocaleInfoW.KERNEL32(00000000,0000000F,?,00000002,0000002C,00000409,?,00000000,00B625A0,?,?,00000000,00000409,00000001,00000000,00B627B2), ref: 00B5FE53

Part of subcall function 00B5FDF4: GetLocaleInfoW.KERNEL32(?,00000044,?,00000100,00000044,?,?,00B5FFED,?,00000000,?,00000001,00BDF9BC,?,00B6004F,00000000), ref: 00B5FE12

Strings

AMPM, xrefs: 00B62734
AMPM , xrefs: 00B62743
:mm:ss, xrefs: 00B6276E
:mm, xrefs: 00B62753
mmmm d, yyyy, xrefs: 00B6261D
m/d/yy, xrefs: 00B625F2

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 233154393-2493093252
Opcode ID: 341c79f0287e06bab155df327e3f73ab77762916dd5ed903cf9148e784379d1a
Instruction ID: 6762c584412465bc67809f802c3e27b85537b83e6ee2983fd0cc2984d763da02
Opcode Fuzzy Hash: 341c79f0287e06bab155df327e3f73ab77762916dd5ed903cf9148e784379d1a
Instruction Fuzzy Hash: 707163357006499BEB11EBA4CC91FAFB3FAEF88301F5084F9B5019B696DA38DD098750

Uniqueness

Uniqueness Score: -1.00%

Function 00BC072C Relevance: 13.7, APIs: 9, Instructions: 192COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00BC0798

Part of subcall function 00BBFFAC: BeginPaint.USER32(00000000,?), ref: 00BBFFD7
Part of subcall function 00BBFFAC: EndPaint.USER32(00000000,?,00BC0112), ref: 00BC0105

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Paint$Begin
String ID:
API String ID: 3787552996-0
Opcode ID: 3fdb159c66f2ac9fd9c76572cd2fe8e6b15b1814a05768c8ff58cadd80f70d75
Instruction ID: 8f8844760ebd9eff1f7928cf73b0b7bf1ce21307af1637d7014c52e67710f0dc
Opcode Fuzzy Hash: 3fdb159c66f2ac9fd9c76572cd2fe8e6b15b1814a05768c8ff58cadd80f70d75
Instruction Fuzzy Hash: 4961E771A14108EFDB05EFA8C992FAEBBF9EB49700F1084E9F504E7251DA74AE05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4F34 Relevance: 13.6, APIs: 9, Instructions: 131windowregistryCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00B50000,00BA4B50,?), ref: 00BA4F96
RegisterClassW.USER32(00BE1860), ref: 00BA4FAE

Part of subcall function 00B57E84: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00B57EC9

SetWindowLongW.USER32(?,000000FC,?), ref: 00BA504E
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00BA5073
SetClassLongW.USER32(?,000000F2,00000000), ref: 00BA5089
GetSystemMenu.USER32(?,00000000,?,000000FC,?), ref: 00BA5097
DeleteMenu.USER32(00000000,0000F030,00000000,?,00000000,?,000000FC,?), ref: 00BA50A6
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,?,00000000,?,000000FC,?), ref: 00BA50B3
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,?,00000000,?,000000FC,?), ref: 00BA50CA

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Menu$ClassDelete$Long$InfoLoadMessageRegisterSendStringSystemWindow
String ID:
API String ID: 2334458219-0
Opcode ID: 1526c6be1bd98d8ec8c27fdba40351b93f99f35c83746136d3a798095e036280
Instruction ID: 857cc2ef3b1424f6d14f94ca77bde877cfeb1ba777c6f731a629f488d88e9fdb
Opcode Fuzzy Hash: 1526c6be1bd98d8ec8c27fdba40351b93f99f35c83746136d3a798095e036280
Instruction Fuzzy Hash: C3413E71644740AFE761EB78DC82FA933E8AB09704F5448E0FD04EF2E2DEB5A8448764

Uniqueness

Uniqueness Score: -1.00%

Function 00BBAF40 Relevance: 13.6, APIs: 9, Instructions: 122windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BBAF77
GetDCEx.USER32(?,00000000,00000402), ref: 00BBAF8A
SelectObject.GDI32(?,00000000), ref: 00BBAFAD
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 00BBAFD3
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 00BBAFF5
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 00BBB014
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 00BBB02E
SelectObject.GDI32(?,?), ref: 00BBB03B
ReleaseDC.USER32(?,?), ref: 00BBB055

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ObjectSelect$DesktopReleaseWindow
String ID:
API String ID: 1187665388-0
Opcode ID: d5f8a18b27a5bb6c0ea15043b5b91644157a52431997c7433468a350e4e0ee05
Instruction ID: ff3646f54ce6b679baa61df27d8c29253ba313e63ebee018714859c8d7bfd908
Opcode Fuzzy Hash: d5f8a18b27a5bb6c0ea15043b5b91644157a52431997c7433468a350e4e0ee05
Instruction Fuzzy Hash: 3631CAB6E00619AFDB40DEAD8C85EEFBBFCEF09704B4044A5B914F7241CA75AD048B60

Uniqueness

Uniqueness Score: -1.00%

Function 00BA40D0 Relevance: 13.6, APIs: 9, Instructions: 106COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(0000001F,0000005C,?,00000000), ref: 00BA412A
CreateFontIndirectW.GDI32(?), ref: 00BA4137
GetStockObject.GDI32(0000000D), ref: 00BA414A

Part of subcall function 00B8B688: MulDiv.KERNEL32(00000000,?,00000048), ref: 00B8B695

SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00BA4171
CreateFontIndirectW.GDI32(?), ref: 00BA4181
CreateFontIndirectW.GDI32(?), ref: 00BA4197
CreateFontIndirectW.GDI32(?), ref: 00BA41B0
GetStockObject.GDI32(0000000D), ref: 00BA41D3
GetStockObject.GDI32(0000000D), ref: 00BA41E7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CreateFontIndirect$ObjectStock$InfoParametersSystem
String ID:
API String ID: 2565622021-0
Opcode ID: 70fe733393b2ecbfe6860f88319a617fe3d9befb3b46df6620e768aad66979f9
Instruction ID: d0e0d2ee981379fc75ae11c420b3d8bfffa690c8011e9b5bcedf8b50ebd04376
Opcode Fuzzy Hash: 70fe733393b2ecbfe6860f88319a617fe3d9befb3b46df6620e768aad66979f9
Instruction Fuzzy Hash: A8413D706046849BDB50FBB8CD86F9A37E5AB45301F0440F1B918DB2ABDF749C49CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00B62100 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 203threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00B623DE,?,?,00000000,00000000), ref: 00B62136

Part of subcall function 00B5FDF4: GetLocaleInfoW.KERNEL32(?,00000044,?,00000100,00000044,?,?,00B5FFED,?,00000000,?,00000001,00BDF9BC,?,00B6004F,00000000), ref: 00B5FE12

Strings

mmmm d, yyyy, xrefs: 00B6223B
AMPM , xrefs: 00B62369
:mm:ss, xrefs: 00B62396
m/d/yy, xrefs: 00B6220E
:mm, xrefs: 00B62379
AMPM, xrefs: 00B6235A

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 7cabf60c2714959ca6f95fe063d8bdb55ef3e9816a8ad0d7a240c47318f5820b
Instruction ID: 086583336cd1196c1465e6d7e5edca234438ded8c959efb2d799213c7ae728dc
Opcode Fuzzy Hash: 7cabf60c2714959ca6f95fe063d8bdb55ef3e9816a8ad0d7a240c47318f5820b
Instruction Fuzzy Hash: BB7172357006899BEB15FBB8D891BAEB2F6EF48301F5094F5F600AB356CA3CD9099750

Uniqueness

Uniqueness Score: -1.00%

Function 00B65C04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00B65C9D
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00B65CB9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00B65CF2
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00B65D6F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00B65D88
VariantCopy.OLEAUT32(?), ref: 00B65DBD

Strings

, xrefs: 00B65C1E

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 6705a1c88de002fd5d08f1ac81b508c2e68d5c2f89119b1d436c2adb5189841c
Instruction ID: 0d2ddf8d67e73b979786c80fbe0560e9c6df69b511335aed880f0e3d98b7cf90
Opcode Fuzzy Hash: 6705a1c88de002fd5d08f1ac81b508c2e68d5c2f89119b1d436c2adb5189841c
Instruction Fuzzy Hash: 3351D575900A2D9BCB36DB58C885BDAB3FCEF49300F4041E5E549E7252DA38AF948F60

Uniqueness

Uniqueness Score: -1.00%

Function 00BBEA6C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134registryCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(?,?,?), ref: 00BBEB3C
UnregisterClassW.USER32(?,?), ref: 00BBEB67
RegisterClassW.USER32(?), ref: 00BBEB86
GetWindowLongW.USER32(00000000,000000F0), ref: 00BBEBC2
GetWindowLongW.USER32(00000000,000000F4), ref: 00BBEBD7
SetWindowLongW.USER32(00000000,000000F4,00000000), ref: 00BBEBEA

Strings

@, xrefs: 00BBEAA8

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ClassLongWindow$InfoRegisterUnregister
String ID: @
API String ID: 717780171-2766056989
Opcode ID: c9e7f521b207e41bef3229dca8eabf69314422290bc7dc75bf6e532c323b96f4
Instruction ID: 05052d36377df5b3fb0a08ff855e5a298137fca5125cfce1f65bf09e0864dcf6
Opcode Fuzzy Hash: c9e7f521b207e41bef3229dca8eabf69314422290bc7dc75bf6e532c323b96f4
Instruction Fuzzy Hash: CA514B31A003588BDB71EB28CC85BEA77E9EB05304F1045E5F95AA72A1DBB4ED84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B8EC48 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 00B8ECEA
MulDiv.KERNEL32(?,000009EC,00000000), ref: 00B8ED07
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 00B8ED33
GetEnhMetaFileHeader.GDI32(00000016,00000064,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 00B8ED53
DeleteEnhMetaFile.GDI32(00000016), ref: 00B8ED74
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,00000064,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 00B8ED87

Strings

`, xrefs: 00B8ECCF

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 75661da54fd14d88b25a58418ed61e2be60f0beeec5ddeb9dd115360db900537
Instruction ID: 6744c836c31500a8fdbff07f8db0e245030a81512b0b2dc8835c2c809b22dadb
Opcode Fuzzy Hash: 75661da54fd14d88b25a58418ed61e2be60f0beeec5ddeb9dd115360db900537
Instruction Fuzzy Hash: 48410DB5D00208AFDB50EFA8C885AAEB7F9EF48710F1084A6F914EB251E7349D44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B94280 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 00B942B1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B942D8
GetSystemMetrics.USER32(00000000), ref: 00B942ED
GetSystemMetrics.USER32(00000001), ref: 00B942F8
lstrcpyW.KERNEL32(?,DISPLAY), ref: 00B94322

Part of subcall function 00B93EC8: GetProcAddress.KERNEL32(75BD0000,00000000), ref: 00B93F64

Strings

GetMonitorInfoW, xrefs: 00B94298
DISPLAY, xrefs: 00B94319

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: System$InfoMetrics$AddressMonitorParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoW
API String ID: 1539801207-2774842281
Opcode ID: 4e20f41bf308fd39588372083f8b5f81141eaa3cc02159a87fa9b1e740c0654a
Instruction ID: 6720c53d6428c4cd51687f120060ae0a501bbbabd6d83a323ef9dc8b58e68c6b
Opcode Fuzzy Hash: 4e20f41bf308fd39588372083f8b5f81141eaa3cc02159a87fa9b1e740c0654a
Instruction Fuzzy Hash: EC110331A00B059FDB208F709C80BA7B7E8FF09311F4049B9EC49DB241DBB0A905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B550B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B550E9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B550EF
GetStdHandle.KERNEL32(000000F5,00B5513C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161), ref: 00B55104
WriteFile.KERNEL32(00000000,000000F5,00B5513C,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00B55161), ref: 00B5510A
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00B55128

Strings

Runtime error at 00000000, xrefs: 00B550E2, 00B55121
Error, xrefs: 00B5511C

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 9c2bdbdecf1e7b53eddb880175fc5a14a965dc1f32d7420c2253f25e546f6117
Instruction ID: 1bda694bb184f970793389905df6dd91c1b35917590c325aaabfb31bd705cb62
Opcode Fuzzy Hash: 9c2bdbdecf1e7b53eddb880175fc5a14a965dc1f32d7420c2253f25e546f6117
Instruction Fuzzy Hash: E4F02B60A8878079F72073548C9BFA975C88704F13F544ED6F921EB0E2DEE0498C8721

Uniqueness

Uniqueness Score: -1.00%

Function 00BB1A88 Relevance: 12.2, APIs: 8, Instructions: 170windowCOMMON

Download Yara Rule

APIs

ImageList_DrawEx.COMCTL32(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,?), ref: 00BB1AE7
ImageList_DrawEx.COMCTL32(00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000), ref: 00BB1B88
SetTextColor.GDI32(00000000,00FFFFFF), ref: 00BB1BD5
SetBkColor.GDI32(00000000,00000000), ref: 00BB1BDD
BitBlt.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,00E20746), ref: 00BB1C02

Part of subcall function 00BB1A60: ImageList_GetBkColor.COMCTL32(00000000,?,00BB1AC1,00000000,?), ref: 00BB1A76

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ColorImageList_$Draw$Text
String ID:
API String ID: 2027629008-0
Opcode ID: 8e009a5f8bf578b8679fef070f319347d233c422d408058ac1986430880fbf5f
Instruction ID: 7e806e070b34118120526dd099bc560bf01a8a37753ed3c0985c5d135fcf51ff
Opcode Fuzzy Hash: 8e009a5f8bf578b8679fef070f319347d233c422d408058ac1986430880fbf5f
Instruction Fuzzy Hash: 9D51F271601204AFDB50FF6CCDD2FAE3BE8AF08710F5405A5B904EB296DA74EC458B65

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6550 Relevance: 12.1, APIs: 8, Instructions: 118windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000200,0000020A,00000001), ref: 00BA656C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BA6584
IsWindowUnicode.USER32 ref: 00BA6598
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA65BF
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00BA65D5
TranslateMessage.USER32 ref: 00BA6660
DispatchMessageW.USER32 ref: 00BA666D
DispatchMessageA.USER32 ref: 00BA6675

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
String ID:
API String ID: 2190272339-0
Opcode ID: cb5d2c4aad58e4151697eba4b6a9d11df891c9fdc734f310b3b84ca0aedc3a5a
Instruction ID: ecfae16ec0ab470bbb3122fae8ae5b1641248160f25bcdff9aae9683908b05c3
Opcode Fuzzy Hash: cb5d2c4aad58e4151697eba4b6a9d11df891c9fdc734f310b3b84ca0aedc3a5a
Instruction Fuzzy Hash: 4531C4A074C34079EE31663C4C42BEE67D58F63705F1C40D5F9C0B61C2CBD6984A8296

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6304 Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00BA632A
IsWindowUnicode.USER32(00000000), ref: 00BA636D
SendMessageW.USER32(00000000,-0000BBEE,00000000,?), ref: 00BA6388
SendMessageA.USER32(00000000,-0000BBEE,00000000,?), ref: 00BA63A7
GetWindowThreadProcessId.USER32(00000000), ref: 00BA63B6
GetWindowThreadProcessId.USER32(?,?), ref: 00BA63C7
SendMessageW.USER32(00000000,-0000BBEE,00000000,?), ref: 00BA63E7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: MessageSendWindow$ProcessThread$CaptureUnicode
String ID:
API String ID: 1994056952-0
Opcode ID: 7272788b782743969813a075259b1e172f413ac623a296b144a87246ebbf6d6b
Instruction ID: 5231188b8440716c6136d58f950fd8ec3f6ce2fe4a91fc45fb77f013f7379e1a
Opcode Fuzzy Hash: 7272788b782743969813a075259b1e172f413ac623a296b144a87246ebbf6d6b
Instruction Fuzzy Hash: 682135B1208609AFDA60EA9DC941F6B73ECEF19310F1884B8FD99D7242DA11FC054768

Uniqueness

Uniqueness Score: -1.00%

Function 00B60738 Relevance: 12.1, APIs: 8, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6054C: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00B606F8), ref: 00B6057F
Part of subcall function 00B6054C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00B605A3
Part of subcall function 00B6054C: GetModuleFileNameW.KERNEL32(00B50000,?,00000105), ref: 00B605BE
Part of subcall function 00B6054C: LoadStringW.USER32(00000000,0000FFE7,?,00000100), ref: 00B60659

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00B6085D), ref: 00B60799
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B607CC
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B607DE
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B607E4
GetStdHandle.KERNEL32(000000F4,00B60878,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 00B607F8
WriteFile.KERNEL32(00000000,000000F4,00B60878,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00B607FE
LoadStringW.USER32(00000000,0000FFE8,?,00000040), ref: 00B60822
MessageBoxW.USER32(00000000,?,?,00002010), ref: 00B6083C

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: ad36f6e26494f50e0727226d23361e6e1910d5dce19e9d23debf855f49ccf468
Instruction ID: e7907334be0ceaf93b10c9d7ee1d69160d1d00aa61287c58628d78a752727a70
Opcode Fuzzy Hash: ad36f6e26494f50e0727226d23361e6e1910d5dce19e9d23debf855f49ccf468
Instruction Fuzzy Hash: 4F313E71650208BEEB54EB64DC82FAA77ECEB08701F5041E1BA04F71D1DEB46E448B65

Uniqueness

Uniqueness Score: -1.00%

Function 00B8CD98 Relevance: 12.1, APIs: 8, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B8CDC6
GetDeviceCaps.GDI32(?,00000068), ref: 00B8CDE2
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 00B8CE01
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 00B8CE25
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 00B8CE43
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 00B8CE57
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 00B8CE77
ReleaseDC.USER32(00000000,?), ref: 00B8CE8F

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 6d1f51740a4b5fe0959a03a3ab0d039f3e2c4c0c34e41666b8969566adb4441b
Instruction ID: ec442e3188d990a21ce88be27d93c65b7b44be63ec09abb80137c3f6ec2788a4
Opcode Fuzzy Hash: 6d1f51740a4b5fe0959a03a3ab0d039f3e2c4c0c34e41666b8969566adb4441b
Instruction Fuzzy Hash: D9212FF1A40208AAEB51DBA8CD86FAE77ECEB08705F5004D1BB04F7191DA75AE44DB34

Uniqueness

Uniqueness Score: -1.00%

Function 00B52088 Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5eda683c8d70fcc940603999df81f6bb9a183c1b0ff643f71f402dba88b7e7
Instruction ID: d087fc2a570990e8f15feda54874a75cff4932e7093c7b1a1136e196dcd722b8
Opcode Fuzzy Hash: ff5eda683c8d70fcc940603999df81f6bb9a183c1b0ff643f71f402dba88b7e7
Instruction Fuzzy Hash: F2C1F0627026000BD715AB7C9CC576EB3C6DB85323F188AF9EE54CB396DA64C9498790

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3884 Relevance: 10.8, APIs: 7, Instructions: 311windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00BD24D0,00000003), ref: 00BD38B3
IntersectClipRect.GDI32(00BD24D0,?,?,?,?), ref: 00BD3AF4
GetWindowOrgEx.GDI32(?,?,00000000,00BD3BBF,?,00BD24D0,00000003,?,00000000,00000000), ref: 00BD3B01
SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 00BD3B1F
OffsetWindowOrgEx.GDI32(00BD24D0,?,?,00000000,?,?,?,00000000,?,?,00000000,00BD3BBF,?,00BD24D0,00000003), ref: 00BD3B3B
SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 00BD3BA1
OffsetWindowOrgEx.GDI32(00BD24D0,?,?,00000000,?,?,?,00000000,00BD3BC6,00000000,?,?,?,00000000,?,?), ref: 00BD3BB9

Part of subcall function 00BD24F0: StretchBlt.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00BD261C

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$OffsetStretch$ClipIntersectModeRect
String ID:
API String ID: 1933952845-0
Opcode ID: 8a230adcfbfbba1f4160e77c152fd138eafb42ee800a336fe85530f9e4237972
Instruction ID: d7a1733404c1eb9580c3be3f7964826bb3ecf4576d7f72cc892d1dd9c2f455ba
Opcode Fuzzy Hash: 8a230adcfbfbba1f4160e77c152fd138eafb42ee800a336fe85530f9e4237972
Instruction Fuzzy Hash: C7C1D075E00209AFCB00DFE9CA85A9EFBF4FF08710F158196E804BB316DA74AA45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BC43D4 Relevance: 10.7, APIs: 7, Instructions: 224COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,000000FF,?,?,?,?,00000010,00000000,00BC4671), ref: 00BC4569
GetTickCount.KERNEL32 ref: 00BC456E
SystemParametersInfoW.USER32(00001016,00000000,?,00000000), ref: 00BC45CD
SystemParametersInfoW.USER32(00001018,00000000,00000000,00000000), ref: 00BC45E5
AnimateWindow.USER32(00000000,00000064,?), ref: 00BC462A
ShowWindow.USER32(00000000,00000004,00000000,000000FF,?,?,?,?,00000010,00000000,00BC4671), ref: 00BC463B
GetTickCount.KERNEL32 ref: 00BC4658

Part of subcall function 00BC7DC0: GetCursorPos.USER32(?), ref: 00BC7DC4

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$CountInfoParametersSystemTick$AnimateCursorShow
String ID:
API String ID: 3024527889-0
Opcode ID: 73e880cfae7fc928e2e3e5ee1f152007ba93813d67c83f11c7d3bb9ad3aab684
Instruction ID: bb628a8532c11d94f4d924e5d07bc5b349ae45abdfdee2c31547e4f2ce11026f
Opcode Fuzzy Hash: 73e880cfae7fc928e2e3e5ee1f152007ba93813d67c83f11c7d3bb9ad3aab684
Instruction Fuzzy Hash: 8381F170A04204AFDB11EF68C892F9EB7E5AB4A700F2448E8F445EB352DB74EE45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BA68B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA7D60: GetActiveWindow.USER32 ref: 00BA7D87
Part of subcall function 00BA7D60: GetLastActivePopup.USER32(?), ref: 00BA7D9C

GetWindowRect.USER32(?,?), ref: 00BA693B
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,?), ref: 00BA6976
MessageBoxW.USER32(00000000,?,?,?), ref: 00BA69B5
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,00BA6A2E,?,00000000,00BA6A27), ref: 00BA6A08
SetActiveWindow.USER32(00000000,00BA6A2E,?,00000000,00BA6A27), ref: 00BA6A19

Strings

(, xrefs: 00BA6915

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Active$LastMessagePopupRect
String ID: (
API String ID: 3456420849-3887548279
Opcode ID: a7fc36a0bcb0414696dc0acfeef445f11dbbbd9201b71d5da53731f0ff4dcfd9
Instruction ID: 198c0472616a90538323fa6e1fb5553e11f88f641afa7ef35733138ab6924333
Opcode Fuzzy Hash: a7fc36a0bcb0414696dc0acfeef445f11dbbbd9201b71d5da53731f0ff4dcfd9
Instruction Fuzzy Hash: A351E6B5E04208AFDB05DBA8D885FAEB7F9FB49301F5844A9F504EB291DA70AD018B50

Uniqueness

Uniqueness Score: -1.00%

Function 00B72F30 Relevance: 10.6, APIs: 7, Instructions: 119synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B72F3D
CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000), ref: 00B72FAF
EnterCriticalSection.KERNEL32(00BE7E6C,00000000,00B730CD), ref: 00B72FD7
LeaveCriticalSection.KERNEL32(00BE7E6C,00000000,00B730A6,?,00BE7E6C,00000000,00B730CD), ref: 00B7304E
WaitForSingleObject.KERNEL32(?,000000FF,00000000,00B73087,?,00BE7E6C,00000000,00B730A6,?,00BE7E6C,00000000,00B730CD), ref: 00B7306A
EnterCriticalSection.KERNEL32(00BE7E6C,00B7308E,00B73087,?,00BE7E6C,00000000,00B730A6,?,00BE7E6C,00000000,00B730CD), ref: 00B73081

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CriticalSection$Enter$CreateCurrentEventLeaveObjectSingleThreadWait
String ID:
API String ID: 1504017990-0
Opcode ID: f7b0986264fc36b3a75b4d0dbecbe4fca60d2db59adac7087e3e525c1f6dee60
Instruction ID: 55f6b0f055f0714440f4b00fb9eba59b8ce745cf52158e1b70f5bacbb311f6b8
Opcode Fuzzy Hash: f7b0986264fc36b3a75b4d0dbecbe4fca60d2db59adac7087e3e525c1f6dee60
Instruction Fuzzy Hash: 7C41BC30A48248AFC711DF64C892B59F7F5EB49700F55C1E1EC28AB3A1DB75AE00EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00B8F20C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 00B8F25E
MulDiv.KERNEL32(?,?,000009EC), ref: 00B8F275
GetDC.USER32(00000000), ref: 00B8F28C
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,00B8F347,?,00000000,?,?,000009EC,?,?,000009EC), ref: 00B8F2B0
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,00B8F327,?,?,00000000,00000000,00000008,?,00000000,00B8F347), ref: 00B8F2E3

Strings

`, xrefs: 00B8F244

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: 12e0334d4dcd4ed959402c24bd74f96291a6fe2ee145f6070b604a2187624f2e
Instruction ID: ae5723d1b20f3b86e56b2549b59a5671539a4b2c20a5ab627732553c3cfd51dd
Opcode Fuzzy Hash: 12e0334d4dcd4ed959402c24bd74f96291a6fe2ee145f6070b604a2187624f2e
Instruction Fuzzy Hash: 59313E79A10208ABDB01EFE4C882ABEB7F8EF4D701F5044E5F904EB291D6349E44DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B94370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B943C8
GetSystemMetrics.USER32(00000000), ref: 00B943DD
GetSystemMetrics.USER32(00000001), ref: 00B943E8
lstrcpyW.KERNEL32(?,DISPLAY), ref: 00B94412

Part of subcall function 00B93EC8: GetProcAddress.KERNEL32(75BD0000,00000000), ref: 00B93F64

Strings

GetMonitorInfoA, xrefs: 00B94388
DISPLAY, xrefs: 00B94409

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoA
API String ID: 2545840971-1370492664
Opcode ID: 7b8bae4bc70fc0319a1150a9783feff1de8424a5a0f756856326a226f335fd92
Instruction ID: 9107a66b1f4d88f5e3226c5d86d80fcba74fa10930123c5f94bd7771e55a36a5
Opcode Fuzzy Hash: 7b8bae4bc70fc0319a1150a9783feff1de8424a5a0f756856326a226f335fd92
Instruction Fuzzy Hash: 7611D671600B009FDF208F609C85BA7B7E8EB0A724F008979ED599B341DFB0A805CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B94460 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B944B8
GetSystemMetrics.USER32(00000000), ref: 00B944CD
GetSystemMetrics.USER32(00000001), ref: 00B944D8
lstrcpyW.KERNEL32(?,DISPLAY), ref: 00B94502

Part of subcall function 00B93EC8: GetProcAddress.KERNEL32(75BD0000,00000000), ref: 00B93F64

Strings

GetMonitorInfoW, xrefs: 00B94478
DISPLAY, xrefs: 00B944F9

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoW
API String ID: 2545840971-2774842281
Opcode ID: c913680e0a92bddbb316b4ad15c64e72b2ee018da3674d69be31142a84ede00f
Instruction ID: d19abb3df57835f8497ba85b9ece6a20477874a1befc740a24bd29f0138144de
Opcode Fuzzy Hash: c913680e0a92bddbb316b4ad15c64e72b2ee018da3674d69be31142a84ede00f
Instruction Fuzzy Hash: 3E11E9756007009FDB20CFA09C84BA7B7E8FB15721F114979FD4D9B255EBB0A949CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B8F978 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00B8CFEC: GetObjectW.GDI32(?,00000004), ref: 00B8D003
Part of subcall function 00B8CFEC: GetPaletteEntries.GDI32(?,00000000,?,?), ref: 00B8D026

GetDC.USER32(00000000), ref: 00B8F9B6
CreateCompatibleDC.GDI32(?), ref: 00B8F9C2
SelectObject.GDI32(?), ref: 00B8F9CF
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,00B8FA27,?,?,?,?,00000000), ref: 00B8F9F3
SelectObject.GDI32(?,?), ref: 00B8FA0D
DeleteDC.GDI32(?), ref: 00B8FA16
ReleaseDC.USER32(00000000,?), ref: 00B8FA21

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: a3d99f1fc9fe6f5146b7dd434b68b927729e89f049e016df63112105e2bfb6dd
Instruction ID: edaf988f993b4804451a0ec7fe8f34202c1011de44b1c5b13cf5740e800b9571
Opcode Fuzzy Hash: a3d99f1fc9fe6f5146b7dd434b68b927729e89f049e016df63112105e2bfb6dd
Instruction Fuzzy Hash: 32111FB5E1420A6BDB54EBE4C891ABEB7FCEB08711F0044F5BA18E7251DA749944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BA403C Relevance: 10.6, APIs: 7, Instructions: 58threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00BA4057
WindowFromPoint.USER32(?,?), ref: 00BA4064
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00BA4072
GetCurrentThreadId.KERNEL32 ref: 00BA4079
SendMessageW.USER32(00000000,00000084,00000000,00000000), ref: 00BA409C
SendMessageW.USER32(00000000,00000020,00000000,?), ref: 00BA40AE
SetCursor.USER32(00000000), ref: 00BA40C0

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: fb3e21c984c28e86c1b2dfd69925152f00a11f0ee6feda3fafa845f2f16ee52c
Instruction ID: eae0f687eee458c9b06c2935c75f84d00644eb3ba39fc8476919436d1e15a97a
Opcode Fuzzy Hash: fb3e21c984c28e86c1b2dfd69925152f00a11f0ee6feda3fafa845f2f16ee52c
Instruction Fuzzy Hash: 2601B93210521066D7303A344C46F3F26E5DFC6B51F1449E5BA44AA182EFA69C056265

Uniqueness

Uniqueness Score: -1.00%

Function 00B9E10C Relevance: 9.2, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 00B9E18B
GetClientRect.USER32(00000000,?), ref: 00B9E1B6
FillRect.USER32(?,?,00000000), ref: 00B9E1D2

Part of subcall function 00B9E080: CallWindowProcW.USER32(?,?,?,?,?), ref: 00B9E0BA

BeginPaint.USER32(?,?), ref: 00B9E24A
GetWindowRect.USER32(?,?), ref: 00B9E277
EndPaint.USER32(?,?,00B9E2EB), ref: 00B9E2D7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Rect$FillPaintWindow$BeginCallClientProc
String ID:
API String ID: 901200654-0
Opcode ID: 6eb1a813c4c10ba9ef840e2f5e704c47d1a9efaa99bf41f65f1b729c44fc8443
Instruction ID: 477649e0d37673787019f6db3a0db3799966dfa4ffbaad0d3a26fd0bcc730bb3
Opcode Fuzzy Hash: 6eb1a813c4c10ba9ef840e2f5e704c47d1a9efaa99bf41f65f1b729c44fc8443
Instruction Fuzzy Hash: 6051A675A00208EFCF50DBA8C585A9DBBF9EB08310F1585E5F924AB252DB34EE45DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00B7296C Relevance: 9.1, APIs: 6, Instructions: 119threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B72977
GetCurrentThreadId.KERNEL32 ref: 00B72986

Part of subcall function 00B72920: ResetEvent.KERNEL32(00000240,00B729C1), ref: 00B72926

EnterCriticalSection.KERNEL32(00BE7E6C), ref: 00B729CB
InterlockedExchange.KERNEL32(00BDFC50,?), ref: 00B729E7
LeaveCriticalSection.KERNEL32(00BE7E6C,00000000,00B72B2F,?,00BDFC50,?,00000000,00B72B4E,?,00BE7E6C), ref: 00B72A40
EnterCriticalSection.KERNEL32(00BE7E6C,00B72AD8,00BE7E6C,00000000,00B72B2F,?,00BDFC50,?,00000000,00B72B4E,?,00BE7E6C), ref: 00B72ACB

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID:
API String ID: 2189153385-0
Opcode ID: f45194bda306cf2581a26398eeb363d339e2691b228deb8a8c3a6f9325b3d6b6
Instruction ID: 74a2416974c70a81c23f4f4c481c1729081bdbee8e892c828ad47291efc669aa
Opcode Fuzzy Hash: f45194bda306cf2581a26398eeb363d339e2691b228deb8a8c3a6f9325b3d6b6
Instruction Fuzzy Hash: 8041A030A04344AFD721DFA4C892A69B7F9EB49700F95C4E0F828A76A1DB74AD44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BA096C Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00B8C0C8: EnterCriticalSection.KERNEL32(00BE7F08,00000000,00B8A492,00000000,00B8A4F1), ref: 00B8C0D0
Part of subcall function 00B8C0C8: LeaveCriticalSection.KERNEL32(00BE7F08,00BE7F08,00000000,00B8A492,00000000,00B8A4F1), ref: 00B8C0DD
Part of subcall function 00B8C0C8: EnterCriticalSection.KERNEL32(0000003C,00BE7F08,00BE7F08,00000000,00B8A492,00000000,00B8A4F1), ref: 00B8C0E6

SaveDC.GDI32(?), ref: 00BA09B9
ExcludeClipRect.GDI32(?,?,?,?,?), ref: 00BA0A34
GetStockObject.GDI32(00000004), ref: 00BA0A53
FillRect.USER32(00000000,?,00000000), ref: 00BA0A6C
RestoreDC.GDI32(?,?), ref: 00BA0AE2

Part of subcall function 00B8AC4C: GetSysColor.USER32(?), ref: 00B8AC56

SetBkColor.GDI32(00000000,00000000), ref: 00BA0AB7

Part of subcall function 00B8C04C: FillRect.USER32(?,00000000,00000000), ref: 00B8C075

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CriticalRectSection$ColorEnterFill$ClipExcludeLeaveObjectRestoreSaveStock
String ID:
API String ID: 3001281481-0
Opcode ID: 814d16392d63098c8c43d82dcf15fcad37b366248657f2896ec07c80204fc8f3
Instruction ID: a6f424ab20d10302bf38b34b7d70e640a30e1fa40462204510ea164d7aa9ef94
Opcode Fuzzy Hash: 814d16392d63098c8c43d82dcf15fcad37b366248657f2896ec07c80204fc8f3
Instruction Fuzzy Hash: 9641DA74A14208EFDB41EFA8C989E9E77F9EB09304F5544E5F904A7622C734AE44DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00B6072A Relevance: 9.1, APIs: 6, Instructions: 103filewindowCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00B6085D), ref: 00B60799
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B607CC
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B607DE
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B607E4
GetStdHandle.KERNEL32(000000F4,00B60878,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 00B607F8
WriteFile.KERNEL32(00000000,000000F4,00B60878,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00B607FE

Part of subcall function 00B6054C: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00B606F8), ref: 00B6057F
Part of subcall function 00B6054C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00B605A3
Part of subcall function 00B6054C: GetModuleFileNameW.KERNEL32(00B50000,?,00000105), ref: 00B605BE
Part of subcall function 00B6054C: LoadStringW.USER32(00000000,0000FFE7,?,00000100), ref: 00B60659

LoadStringW.USER32(00000000,0000FFE8,?,00000040), ref: 00B60822
MessageBoxW.USER32(00000000,?,?,00002010), ref: 00B6083C

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: c2d2ba66e9c5909320d8236114d5fcfc190254e606cf06df665816219460de74
Instruction ID: 5593d81bd8d66bc97241ec7e5596e981908998c9547869b3c5acb0944c267e30
Opcode Fuzzy Hash: c2d2ba66e9c5909320d8236114d5fcfc190254e606cf06df665816219460de74
Instruction Fuzzy Hash: 4431A771650204BFEB14FB64DC83FAE77E8EB45711F6001E5BA00A71D1DEB46E448BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00BA6050 Relevance: 9.1, APIs: 6, Instructions: 98windowCOMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,?,00BA59E2,00000000,00BA5F12), ref: 00BA6072
ShowWindow.USER32(00000000,00000009,?,?,?,00BA59E2,00000000,00BA5F12), ref: 00BA6095
IsWindowEnabled.USER32(00000000), ref: 00BA60B7
DefWindowProcW.USER32(?,00000112,0000F120,00000000,00000000,?,?,?,00BA59E2,00000000,00BA5F12), ref: 00BA60D3
SetWindowPos.USER32(?,00000000,00000000,?,?,00BA59E2,00000000,00BA5F12), ref: 00BA611F
SetFocus.USER32(00000000,?,?,?,00BA59E2,00000000,00BA5F12), ref: 00BA616D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$ActiveEnabledFocusProcShow
String ID:
API String ID: 2052594614-0
Opcode ID: 874c1e74d852dc71c36baf2e8d8f875158e030bbbc99595bee802c499c40da58
Instruction ID: 0ff9fd0004159aceffe726bcb0d28f61f9c2b1187b0cc777820a185cd6d9ae6e
Opcode Fuzzy Hash: 874c1e74d852dc71c36baf2e8d8f875158e030bbbc99595bee802c499c40da58
Instruction Fuzzy Hash: C1315CB06086409BEB21AB68CCD6B9927E4AB06705F0C54F4FE04EF297CAB5EC448754

Uniqueness

Uniqueness Score: -1.00%

Function 00BD00F8 Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 00BD011F
GdipSaveGraphics.GDIPLUS(?,?), ref: 00BD0137
GdipSetInterpolationMode.GDIPLUS(?,?,00000000,00BD01F2,?,?,?), ref: 00BD0165
GdipSetSmoothingMode.GDIPLUS(?,?,?,?,00000000,00BD01F2,?,?,?), ref: 00BD017F
GdipSetPixelOffsetMode.GDIPLUS(?,00000004,?,?,?,?,00000000,00BD01F2,?,?,?), ref: 00BD0197

Part of subcall function 00BCCA2C: GdipDrawImageRect.GDIPLUS(?,00000000,?,?,?,?), ref: 00BCCA4F

GdipRestoreGraphics.GDIPLUS(?,?,00BD01F9,?,?,?,00000000,00BD01F2,?,?,?), ref: 00BD01E2

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Gdip$Mode$GraphicsRect$DrawEmptyImageInterpolationOffsetPixelRestoreSaveSmoothing
String ID:
API String ID: 3194780657-0
Opcode ID: 98a226226a6f93a592ffd5573794c0cb60d769fb17519390159d17c457da95f8
Instruction ID: 6c9d9720aa87eee91aa71a8bab17e8a42c7f57143de31c68d6afd57259a9e478
Opcode Fuzzy Hash: 98a226226a6f93a592ffd5573794c0cb60d769fb17519390159d17c457da95f8
Instruction Fuzzy Hash: FF318675A00108EFDB01EBA8C986E9EB7F9AB48300B5584E5F508E7366D635EE41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B8D29C Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 00B8D2EA
GetSystemMetrics.USER32(0000000C), ref: 00B8D2F6
GetDC.USER32(00000000), ref: 00B8D312
GetDeviceCaps.GDI32(00000000,0000000E), ref: 00B8D339
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B8D346
ReleaseDC.USER32(00000000,00000000), ref: 00B8D37F

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: e0d01230bbc6ca7d2a84f382be8a2e81aec3eb5cfbd966939071399c98d47fa0
Instruction ID: 3a56edc43e74bb5fb06feea992d58b1377c2a1f0151cb4232f524a9a29a29ffc
Opcode Fuzzy Hash: e0d01230bbc6ca7d2a84f382be8a2e81aec3eb5cfbd966939071399c98d47fa0
Instruction Fuzzy Hash: 22312F74A00204EFDB00EFA4C981BAEBBF5FF89710F1085A5F914AB3A0D670AD40CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B8D734 Relevance: 9.1, APIs: 6, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8D5E0: GetObjectW.GDI32(?,00000054), ref: 00B8D5F4

CreateCompatibleDC.GDI32(00000000), ref: 00B8D756
SelectPalette.GDI32(?,?,00000000), ref: 00B8D777
RealizePalette.GDI32(?), ref: 00B8D783
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 00B8D79A
SelectPalette.GDI32(?,00000000,00000000), ref: 00B8D7C2
DeleteDC.GDI32(?), ref: 00B8D7CB

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: a3c3609012c41ac68e7c8cb49cc4ed3b01360915f4f557f2412b69f79447fce5
Instruction ID: de141482f87fc76de25657c8bac1bf27ba77b3459fb326234fff09698fc10e4f
Opcode Fuzzy Hash: a3c3609012c41ac68e7c8cb49cc4ed3b01360915f4f557f2412b69f79447fce5
Instruction Fuzzy Hash: F6114F75A042047FEB11EAA88C81FAEB7FCEB48710F5084E6B914E7291DA749D00CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00B8CF48 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00B8CF61
SelectObject.GDI32(00000000,00000000), ref: 00B8CF6A
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,00B911E3,?,?,?,?,00B8F7E3), ref: 00B8CF7E
SelectObject.GDI32(00000000,00000000), ref: 00B8CF8A
DeleteDC.GDI32(00000000), ref: 00B8CF90
CreatePalette.GDI32 ref: 00B8CFD7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: c2fa1f967998c7ab2ee2e7197103ad49e26538733e0dbfca0cc3f4aea14bc43e
Instruction ID: 2bccdd3e04de7a5a5171424ad6b1c52f795d78ff9e181c881d2ecd3c29f50cf0
Opcode Fuzzy Hash: c2fa1f967998c7ab2ee2e7197103ad49e26538733e0dbfca0cc3f4aea14bc43e
Instruction Fuzzy Hash: 030196E120834062E654B7358C43B7B76F98FC0715F04D899BA88A7292EA78C84DC3A7

Uniqueness

Uniqueness Score: -1.00%

Function 00B51B0C Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00B51ADA), ref: 00B51BC3
Sleep.KERNEL32(0000000A,00000000,?,00B51ADA), ref: 00B51BD9
Sleep.KERNEL32(00000000,?,?,?,00B51ADA), ref: 00B51C07
Sleep.KERNEL32(0000000A,00000000,?,?,?,00B51ADA), ref: 00B51C1D

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9172ee3cc2c5a2e6a96d7d1405c97f98b53ea91ee01fa65216c57ed993ec3bce
Instruction ID: 2b907c7300ebde9537b45664e30fe86378c36ba02cbe424a4004f682e3abfeb7
Opcode Fuzzy Hash: 9172ee3cc2c5a2e6a96d7d1405c97f98b53ea91ee01fa65216c57ed993ec3bce
Instruction Fuzzy Hash: 24C128725012918BC715CF2CD8C8359BBE1EB85716F188AFEDC858F395DB709989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00B8C624 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00B8BCBC: CreateBrushIndirect.GDI32(?), ref: 00B8BD67

UnrealizeObject.GDI32(00000000), ref: 00B8C630
SelectObject.GDI32(?,00000000), ref: 00B8C642
SetBkColor.GDI32(?,00000000), ref: 00B8C665
SetBkMode.GDI32(?,00000002), ref: 00B8C670
SetBkColor.GDI32(?,00000000), ref: 00B8C68B
SetBkMode.GDI32(?,00000001), ref: 00B8C696

Part of subcall function 00B8AC4C: GetSysColor.USER32(?), ref: 00B8AC56

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: f9119eac90db1e7a66479efbca53dfc6082f0859905973c00d7f069f431522f6
Instruction ID: 7f150f6c0780b62e7d4b327df97c0936d9f4d71ff6088d9e16c9408449c8d904
Opcode Fuzzy Hash: f9119eac90db1e7a66479efbca53dfc6082f0859905973c00d7f069f431522f6
Instruction Fuzzy Hash: 98F05FA5601100ABDB44FFB8DAC6E0B6BD8AF4430270444D5B908EF56BDE25D8148B31

Uniqueness

Uniqueness Score: -1.00%

Function 00BAEC88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000000,00000000,000000FF,?), ref: 00BAED09
SetMenuItemInfoW.USER32(00000000,00000000,000000FF,?), ref: 00BAED61
DrawMenuBar.USER32(00000000), ref: 00BAED6E

Strings

P, xrefs: 00BAECBE
,, xrefs: 00BAECE2

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: ,$P
API String ID: 3227129158-1419105988
Opcode ID: fddca0cd243628d7459ddd5a1b9e9bc7f03f33b2d87f3e43bdf64a9fc3871eee
Instruction ID: d1d0bed15d2e05b198f96643892dc252ea039d487dc43b55ed28b0e2fd49b6ef
Opcode Fuzzy Hash: fddca0cd243628d7459ddd5a1b9e9bc7f03f33b2d87f3e43bdf64a9fc3871eee
Instruction Fuzzy Hash: 28219E31A082089FEB119FA8DC81BA977E8FB4A320F5442F5F860E7291D775D844CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BAE794 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

GetKeyboardLayoutNameW.USER32(00000000), ref: 00BAE7BE

Part of subcall function 00B74B20: RegCloseKey.ADVAPI32(10AC0000,00B74960,00000000,00B74A62,0002001F,00000001,00B74AA6,?,00000000,00BDBA7C,00BDC069,?,?,00000000), ref: 00B74B34

Part of subcall function 00B74CAC: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00B74E5D,?,?,00000000,00000000), ref: 00B74D25

Part of subcall function 00B6317C: SetErrorMode.KERNEL32 ref: 00B63186
Part of subcall function 00B6317C: LoadLibraryW.KERNEL32(00000000,00000000,00B631D0,?,00000000,00B631EE), ref: 00B631B5

Part of subcall function 00B58708: GetProcAddress.KERNEL32(?,?), ref: 00B5872C

FreeLibrary.KERNEL32(?,00BAE88D,?,00000000,00BAE8CD,?,00000000), ref: 00BAE880

Strings

Layout File, xrefs: 00BAE81F
KbdLayerDescriptor, xrefs: 00BAE84A
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\, xrefs: 00BAE803

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Library$AddressCloseErrorFreeKeyboardLayoutLoadModeNameOpenProc
String ID: KbdLayerDescriptor$Layout File$\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
API String ID: 3365787578-2194312379
Opcode ID: ae4f666e9824fa9b12353af82247e5ce3e20231997ca782cfe2adcceae9b5b60
Instruction ID: c3b05221cea5bb376ca722e079a37a05feba4036141285b7f5f479167900a3b4
Opcode Fuzzy Hash: ae4f666e9824fa9b12353af82247e5ce3e20231997ca782cfe2adcceae9b5b60
Instruction Fuzzy Hash: 63318D35A14208AFDB01EFA4DC5299DB7FAEB4A700F5184F4E810A76A1DB399E45CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00BB262C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00B614C8: GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00B6159E), ref: 00B6150A
Part of subcall function 00B614C8: GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00B61581,?,00000000,?,00000000,00B6159E), ref: 00B6153F
Part of subcall function 00B614C8: VerQueryValueW.VERSION(?,00B615B0,?,?,00000000,?,00000000,?,00000000,00B61581,?,00000000,?,00000000,00B6159E), ref: 00B61559

GetModuleHandleW.KERNEL32(comctl32.dll), ref: 00BB2660

Part of subcall function 00B58708: GetProcAddress.KERNEL32(?,?), ref: 00B5872C

ImageList_Write.COMCTL32(00000000,?,00000000,00BB2726), ref: 00BB26F0

Strings

ImageList_WriteEx, xrefs: 00BB266B
comctl32.dll, xrefs: 00BB265B
comctl32.dll, xrefs: 00BB2640

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileInfoVersion$AddressHandleImageList_ModuleProcQuerySizeValueWrite
String ID: ImageList_WriteEx$comctl32.dll$comctl32.dll
API String ID: 4063495462-3125200627
Opcode ID: a15ef05a748ad58ee9bf9cadad5315ff672eb095dbb9888f13104095d6cd6e62
Instruction ID: 8aaf36d5af504bdb62665cb1268bf5ebbb1c2f29f5ae3b9b19823650db77fb7f
Opcode Fuzzy Hash: a15ef05a748ad58ee9bf9cadad5315ff672eb095dbb9888f13104095d6cd6e62
Instruction Fuzzy Hash: 3E21AC302006019BD715AF3ADC86BBA33E9EF45744B5008E4F805EB2A1DEB59C44DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B753A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00B753BD
FindWindowExW.USER32(00000000,00000000,OleMainThreadWndClass,00000000), ref: 00B753EE
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B75427
GetCurrentThreadId.KERNEL32 ref: 00B7542E

Part of subcall function 00B580C0: TlsGetValue.KERNEL32(0000001B,0000001B,00B530E2,00000002,00B551C5,?,?,?,00000002,00B55276,00B53127,00B5316E,00000000), ref: 00B580E5

Strings

OleMainThreadWndClass, xrefs: 00B753E7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Thread$CurrentFindProcessValue
String ID: OleMainThreadWndClass
API String ID: 973455579-3883841218
Opcode ID: ee477d3e94d75582fa4ccbea1ba6c405c64ed263582b772e4f23fbcb24e11a2c
Instruction ID: 08fee5a4e4a1ea78d10370342791615ef016ed7028c745af9181863b6ad1d550
Opcode Fuzzy Hash: ee477d3e94d75582fa4ccbea1ba6c405c64ed263582b772e4f23fbcb24e11a2c
Instruction Fuzzy Hash: 0E0156312016048FC6307BB48986FAA22D4DB01357F0A44F5FA19AB1F2CEB44C48DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B9D0D4 Relevance: 7.7, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000000,?,00000000), ref: 00B9D1A7
MulDiv.KERNEL32(?,00000000,00000000), ref: 00B9D236
MulDiv.KERNEL32(?,00000000,00000000), ref: 00B9D265
MulDiv.KERNEL32(?,00000000,00000000), ref: 00B9D294
MulDiv.KERNEL32(?,00000000,00000000), ref: 00B9D2B7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29fa81dbb29bf7d0d344c866cc77b7529f1b8404a367a855af35ea8fd1d8c2f
Instruction ID: 6c23ff73ef8b570215454fee30510dee0bc2dd4d7786e6baeb0a43dcf51f28d2
Opcode Fuzzy Hash: c29fa81dbb29bf7d0d344c866cc77b7529f1b8404a367a855af35ea8fd1d8c2f
Instruction Fuzzy Hash: 50819234A01144EFDB04DBA9C689EAEB7F5FB48300F6540F5E808EB362DB70AE409B50

Uniqueness

Uniqueness Score: -1.00%

Function 00BC8E90 Relevance: 7.7, APIs: 5, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00B8C04C: FillRect.USER32(?,00000000,00000000), ref: 00B8C075

CreateRectRgn.GDI32(?,?,?,?), ref: 00BC8EFC
SelectObject.GDI32(00000000,?), ref: 00BC8F17

Part of subcall function 00B8BCBC: CreateBrushIndirect.GDI32(?), ref: 00B8BD67

FrameRgn.GDI32(00000000,?,00000000,00000001,00000001), ref: 00BC8F69
SelectObject.GDI32(00000000,?), ref: 00BC90A9
DeleteObject.GDI32(?), ref: 00BC90B2

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Object$CreateRectSelect$BrushDeleteFillFrameIndirect
String ID:
API String ID: 3847799725-0
Opcode ID: 624c7e8378f734461ff79b9a2fa3ccb9e0d196953271e2046b7b5cc65d626f4d
Instruction ID: fbcdbe338a3caa3c5b56303ba556888f3c28652f2e723d5b01bf5398a056e4d9
Opcode Fuzzy Hash: 624c7e8378f734461ff79b9a2fa3ccb9e0d196953271e2046b7b5cc65d626f4d
Instruction Fuzzy Hash: 3B71A775A0410AEFCB00EFA8C989EDEB7F5AF09304F1544E5F914AB261DB71AE06DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B9EE5C Relevance: 7.7, APIs: 5, Instructions: 174windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00B9EF80
SetMenu.USER32(00000000,00000000), ref: 00B9EF9D
SetMenu.USER32(00000000,00000000), ref: 00B9EFD2
SetMenu.USER32(00000000,00000000), ref: 00B9EFEE

Part of subcall function 00B57E84: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 00B57EC9

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00B9F035

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Menu$LoadStringWindow
String ID:
API String ID: 1738039741-0
Opcode ID: 3903df9d79153a386bec6ec87ae18b7a8953b02631f457149eeabb6ed1eff182
Instruction ID: 5046e61318eafe73a3262073eb9343edc794e955f624ee3a2dca0b0bfb87e7b6
Opcode Fuzzy Hash: 3903df9d79153a386bec6ec87ae18b7a8953b02631f457149eeabb6ed1eff182
Instruction Fuzzy Hash: EA518A30A047419BEF65EF288C85B6A76D9AF41310F1848FABC55DB293CEB4DC49C791

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD230 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

GdipImageGetFrameDimensionsCount.GDIPLUS(?,00BCD58D,00000000,00BCD366), ref: 00BCD262
GdipImageGetFrameDimensionsList.GDIPLUS(?,?,00000000), ref: 00BCD29B
GdipImageGetFrameDimensionsCount.GDIPLUS(?,00000000,?,?,00000000), ref: 00BCD2D3
IsEqualGUID.OLE32(?,00BE1C38), ref: 00BCD30D
GdipImageGetFrameCount.GDIPLUS(?,?,00BCD3DA,?,00BE1C38,?,00000000,?,?,00000000), ref: 00BCD327

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FrameGdipImage$CountDimensions$EqualList
String ID:
API String ID: 45328727-0
Opcode ID: a42eaa383c7dc4cdeb6b9e2a8d46ce738e325624007a85836dca3fbf2d01dc51
Instruction ID: 500a4940fe2d8b3281c7bfe0abb13747533da3bdbdc4ae1794e38b52c4bdc45e
Opcode Fuzzy Hash: a42eaa383c7dc4cdeb6b9e2a8d46ce738e325624007a85836dca3fbf2d01dc51
Instruction Fuzzy Hash: F2411076A001089BCB40DBA8DC81EDFBBF9EB89310F1445F9F905E7211DA34DE4587A4

Uniqueness

Uniqueness Score: -1.00%

Function 00BA54C8 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00BA53D4,00000000), ref: 00BA54FF
ShowWindow.USER32(?,00000000,00BA53D4,00000000), ref: 00BA5536
ShowOwnedPopups.USER32(00000000,?), ref: 00BA5565
ShowWindow.USER32(?,00000005), ref: 00BA55CD
ShowOwnedPopups.USER32(00000000,?), ref: 00BA55FC

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Show$OwnedPopupsWindow$EnumWindows
String ID:
API String ID: 315437064-0
Opcode ID: 6c3cc4769086343fae9aa823bd42d6e2288db19a03ef3f6f0f563181c3071598
Instruction ID: 3e88cdeda3a76a3ff4ac64d4be448c7853a22fc581022a7058c7102175ce8a79
Opcode Fuzzy Hash: 6c3cc4769086343fae9aa823bd42d6e2288db19a03ef3f6f0f563181c3071598
Instruction Fuzzy Hash: AE415E71A04A009FD7309B38C885FAA73E7EB52325F5409E5E5598B2E2DB74AD85CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00B75474 Relevance: 7.6, APIs: 5, Instructions: 86windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B753A0: IsWindow.USER32(?), ref: 00B753BD
Part of subcall function 00B753A0: FindWindowExW.USER32(00000000,00000000,OleMainThreadWndClass,00000000), ref: 00B753EE
Part of subcall function 00B753A0: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B75427
Part of subcall function 00B753A0: GetCurrentThreadId.KERNEL32 ref: 00B7542E

MsgWaitForMultipleObjectsEx.USER32(?,?,?,000000BF,?), ref: 00B754A2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B754BD
TranslateMessage.USER32(?), ref: 00B754CA
DispatchMessageW.USER32(?), ref: 00B754D3
WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,00000000), ref: 00B754FF

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: MessageWindow$MultipleObjectsThreadWait$CurrentDispatchFindPeekProcessTranslate
String ID:
API String ID: 2725875890-0
Opcode ID: c9a8707bb0bcd6ba96c72498bf29ed6a82f825750113ccf3125fc4f9043c9fcc
Instruction ID: f168e560c0b61b98078257b143a105d482af4940c76623b63f033d02fae6569b
Opcode Fuzzy Hash: c9a8707bb0bcd6ba96c72498bf29ed6a82f825750113ccf3125fc4f9043c9fcc
Instruction Fuzzy Hash: C4219572600609ABDB60DEA4CCC6FAF73EDEB18310F1085A5FE19D7240D6B5DD4487A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BAA308 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1a69e111eabaeacf50588f3725da8bf9ae7d2248b410053959b909aaf26fa3
Instruction ID: a4b25951061a00ccf68a29e83a56ae8e057bc4c0148b90405c3edb79dc359def
Opcode Fuzzy Hash: 9c1a69e111eabaeacf50588f3725da8bf9ae7d2248b410053959b909aaf26fa3
Instruction Fuzzy Hash: BA11AF2070C3889ADF60BB398C05B6A7AD89F53749F0444E8BD45AB283CF74CC09C276

Uniqueness

Uniqueness Score: -1.00%

Function 00B91198 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B911EE
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B91203
GetDeviceCaps.GDI32(00000000,0000000E), ref: 00B9120D
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00B8F7E3,00000000,00B8F86F), ref: 00B91231
ReleaseDC.USER32(00000000,00000000), ref: 00B9123C

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: eed417e74729194c0b611d44ba846d398721aac03b78b1963268e6be6b5b3f7c
Instruction ID: 4f1e9e8ad16996df771646b5880f0db5da849b526e983d47248118aa757283d2
Opcode Fuzzy Hash: eed417e74729194c0b611d44ba846d398721aac03b78b1963268e6be6b5b3f7c
Instruction Fuzzy Hash: 9B11B12160126A9ADF60FF6898817FE3BD0FB22352F0019E1FC40EA1C1DBB48C94D3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B73174 Relevance: 7.6, APIs: 5, Instructions: 66threadsynchronizationwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B7319F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B731CB
MsgWaitForMultipleObjects.USER32(00000002,?,00000000,000003E8,00000040), ref: 00B731E0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B7320D
GetExitCodeThread.KERNEL32(?,?,?,000000FF), ref: 00B73218

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ThreadWait$CodeCurrentExitMessageMultipleObjectObjectsPeekSingle
String ID:
API String ID: 1797888035-0
Opcode ID: e14821e7a392f05d24062d593006f40ba310e8c2ba4b9823a9bbf033ff506386
Instruction ID: 721af63901e92bb0f6b1edc74696489072214376b26b2947aee9da4299c60c0f
Opcode Fuzzy Hash: e14821e7a392f05d24062d593006f40ba310e8c2ba4b9823a9bbf033ff506386
Instruction Fuzzy Hash: 89110E307003006BD210EB78CCC6B5E33D8AB45B11F508A94FA68EB2D2DA74ED889B46

Uniqueness

Uniqueness Score: -1.00%

Function 00BA2CD8 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000EC), ref: 00BA2D0C
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 00BA2D3E
SetLayeredWindowAttributes.USER32(00000000,00000000,?,00000000,00000000,000000EC,?,?,00BA004B), ref: 00BA2D7C
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 00BA2D95
RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,000000EC,00000000,00000000,000000EC,?,?,00BA004B), ref: 00BA2DAB

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Long$AttributesLayeredRedraw
String ID:
API String ID: 1758778077-0
Opcode ID: c3cd3b2b4322a5177f75645a03a00a787dcbd80ccc2865fe5db1afec7fbb9075
Instruction ID: 4bbc78a22c50fb4f27b6e986ad6f096b689f8bf3336e79e3a3820de31607c4b5
Opcode Fuzzy Hash: c3cd3b2b4322a5177f75645a03a00a787dcbd80ccc2865fe5db1afec7fbb9075
Instruction Fuzzy Hash: 051142A090829016DB567B7C4CD5F962ADC4B06315F280DF4BD95AE1D3CE68DD44C764

Uniqueness

Uniqueness Score: -1.00%

Function 00B8CEB0 Relevance: 7.6, APIs: 5, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B8CEC8
GetDeviceCaps.GDI32(?,00000068), ref: 00B8CEE4
GetPaletteEntries.GDI32(E2080E87,00000000,00000008,?), ref: 00B8CEFC
GetPaletteEntries.GDI32(E2080E87,00000008,00000008,?), ref: 00B8CF14
ReleaseDC.USER32(00000000,?), ref: 00B8CF30

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: b38424fa529a12cfb1b5a0f46c6845ded2f9f625eee984d6ff3c687a352b4eba
Instruction ID: 5485afb25eece6b0144faa8c8fbab7ce2ebaccf10fa820a3d76a507399e8155e
Opcode Fuzzy Hash: b38424fa529a12cfb1b5a0f46c6845ded2f9f625eee984d6ff3c687a352b4eba
Instruction Fuzzy Hash: 0211E17169C3447EFB40DBA48C82FA97BECE719701F4080D1FA44AA1D1DEB69808C721

Uniqueness

Uniqueness Score: -1.00%

Function 00B601CC Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00B60263,?,?,00000000), ref: 00B601E4

Part of subcall function 00B5FDF4: GetLocaleInfoW.KERNEL32(?,00000044,?,00000100,00000044,?,?,00B5FFED,?,00000000,?,00000001,00BDF9BC,?,00B6004F,00000000), ref: 00B5FE12

GetThreadLocale.KERNEL32(00000000,00000004,?,00000000,00B60263,?,?,00000000), ref: 00B60214
EnumCalendarInfoW.KERNEL32(Function_00010118,00000000,00000000,00000004,?,00000000,00B60263,?,?,00000000), ref: 00B6021F
GetThreadLocale.KERNEL32(00000000,00000003,Function_00010118,00000000,00000000,00000004,?,00000000,00B60263,?,?,00000000), ref: 00B6023D
EnumCalendarInfoW.KERNEL32(Function_00010154,00000000,00000000,00000003,Function_00010118,00000000,00000000,00000004,?,00000000,00B60263,?,?,00000000), ref: 00B60248

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 51d83202284c23b5435849bb872fdfda3b6b6a31608a49c6a56237f9ec0fd84b
Instruction ID: 0e29d43aa8f53320d0229ff8c5d4f8f6bf124cc6be232ba35ad12e49fb1305c5
Opcode Fuzzy Hash: 51d83202284c23b5435849bb872fdfda3b6b6a31608a49c6a56237f9ec0fd84b
Instruction Fuzzy Hash: 4901D671214644ABEB12B675DC23F5B71DCEF4A715F7006F0F900F66D1EAB89E0486A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BA4958 Relevance: 7.5, APIs: 5, Instructions: 25synchronizationthreadCOMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32(00000000), ref: 00BA4967
SetEvent.KERNEL32(00000000,00BA75FE,?,00BA7483), ref: 00BA4982
GetCurrentThreadId.KERNEL32 ref: 00BA4987
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00BA75FE,?,00BA7483), ref: 00BA499C
CloseHandle.KERNEL32(00000000,00000000,00BA75FE,?,00BA7483), ref: 00BA49A7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CloseCurrentEventHandleHookObjectSingleThreadUnhookWaitWindows
String ID:
API String ID: 2429646606-0
Opcode ID: 1f1a372f4c47d77791068ce27de8198432b5229e382a3ed4a924a22332bd0fce
Instruction ID: dd395e131a71d0961e89e046036b05d250c44fce9e10d95f169152c8d0e51866
Opcode Fuzzy Hash: 1f1a372f4c47d77791068ce27de8198432b5229e382a3ed4a924a22332bd0fce
Instruction Fuzzy Hash: E5F01570914A80DECB90EBB8ECCAF1733E8A304311B048994B119DB1A2EF74E40CCFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00B60280 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00000000,00B604B3,?,00000409,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00B6260E,00BDCD05), ref: 00B602BB

Part of subcall function 00B5FDF4: GetLocaleInfoW.KERNEL32(?,00000044,?,00000100,00000044,?,?,00B5FFED,?,00000000,?,00000001,00BDF9BC,?,00B6004F,00000000), ref: 00B5FE12

Strings

ggg, xrefs: 00B603DA
yyyy, xrefs: 00B603EA
eeee, xrefs: 00B60406

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: ccb117a55160f6aea2e2b46d18afbb1b0a5016b0151db29c0a9ce05a25a0833e
Instruction ID: 0aedc9a60ebf4e66d74d365d8e30432d554abefae659fc9d04de723220fd75b4
Opcode Fuzzy Hash: ccb117a55160f6aea2e2b46d18afbb1b0a5016b0151db29c0a9ce05a25a0833e
Instruction Fuzzy Hash: CA518371A201099BCB20FB6AC4D26AFB3F5EF94312F6440E1E901D7365EA38DE059755

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E00C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00B5E0FD), ref: 00B5E094
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00B5E0FD), ref: 00B5E09A

Strings

, xrefs: 00B5E060
yyyy, xrefs: 00B5E06F

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 2dce2639cc7cb94d1f30c33704befdc5f1eab00ba5f2317638ce28e79cdbb6b8
Instruction ID: 2c033ca48d4fef6696bef107e1a53df2ec31d9f35414e6dfd8d7dcdd2ba4b99e
Opcode Fuzzy Hash: 2dce2639cc7cb94d1f30c33704befdc5f1eab00ba5f2317638ce28e79cdbb6b8
Instruction Fuzzy Hash: FF214F35A005189BDB15DB54C896BADB3F8EF08302F5540E5FC04E7291D6709F48C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B59850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00B50000,CHARTABLE,0000000A,?,?,00B5970C,?,00B5B701,00000000,00B5B81D), ref: 00B59864
LoadResource.KERNEL32(00B50000,00000000,00B50000,CHARTABLE,0000000A,?,?,00B5970C,?,00B5B701,00000000,00B5B81D), ref: 00B5987B
LockResource.KERNEL32(00000000,00B50000,00000000,00B50000,CHARTABLE,0000000A,?,?,00B5970C,?,00B5B701,00000000,00B5B81D), ref: 00B5988C

Part of subcall function 00B62B00: GetLastError.KERNEL32(00B5989D,00000000,00B50000,00000000,00B50000,CHARTABLE,0000000A,?,?,00B5970C,?,00B5B701,00000000,00B5B81D), ref: 00B62B00

Strings

CHARTABLE, xrefs: 00B59859

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: CHARTABLE
API String ID: 1074440638-2668339182
Opcode ID: 0e27f818ddd7e3efb0859a743cf11531312cbaec873d4c70cec5165e48e4c6e1
Instruction ID: 469705ab1cfe98dba262620b7f70e7e23e9531b6b52364a4bbcc91996ee0ec82
Opcode Fuzzy Hash: 0e27f818ddd7e3efb0859a743cf11531312cbaec873d4c70cec5165e48e4c6e1
Instruction Fuzzy Hash: AE0169B4600A408FD72CEF74D8E0A6977EAEB8831571945EDE9458B762CF789800CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00B5B55C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,?,?,00000000,?,00BD71DD,?,?,?,?,?,?,?,?,?,00000012), ref: 00B5B566
CompareStringW.KERNEL32(00000400,00000001,00000000,?,00000000,Color,00000000,?,?,00000000,?,00BD71DD), ref: 00B5B5A2
GetLastError.KERNEL32(00000400,00000001,00000000,?,00000000,Color,00000000,?,?,00000000,?,00BD71DD), ref: 00B5B5AC

Strings

Color, xrefs: 00B5B589

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ErrorLast$CompareString
String ID: Color
API String ID: 621929658-2811717613
Opcode ID: b714e544f78803bc0219e06a850719c32d489eb2a3adc89038829df34317ef1d
Instruction ID: 1c055a32ce761d05d3d84e3adc225915bba190b732e75720bcf345ce8644dc1e
Opcode Fuzzy Hash: b714e544f78803bc0219e06a850719c32d489eb2a3adc89038829df34317ef1d
Instruction Fuzzy Hash: E8F082A2B4261417E63469BD5CCAF2A76CDDB54753B5502F1FF04E7286ED91CC0982B0

Uniqueness

Uniqueness Score: -1.00%

Function 00BBF938 Relevance: 6.4, APIs: 4, Instructions: 359COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00BBFDA8

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Capture
String ID:
API String ID: 1145282425-0
Opcode ID: 747c86602ef54e6b80de834f17e026af0db389d4c1b911257bd6b664c65745ed
Instruction ID: 7f803f256f41aa0991e9d9e0b26db64e908baef32a44922e4ed1732823b0c0c4
Opcode Fuzzy Hash: 747c86602ef54e6b80de834f17e026af0db389d4c1b911257bd6b664c65745ed
Instruction Fuzzy Hash: A7E1C834A0020AEBDB14DBA8C985BFDB7F1EB45310F6445F5E404AB2A6DBB4DE45DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD5DC Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000000,00000000), ref: 00BBD75B
MulDiv.KERNEL32(?,?,?), ref: 00BBD796

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67f1f6eab24bcd93ce47e51e857d930aa6bed28cde3ecb0580bbe15df8820ca
Instruction ID: 6e9ad4de4117196abf221a738cfa0791e97378f58a3627eabdae7e101d337a73
Opcode Fuzzy Hash: f67f1f6eab24bcd93ce47e51e857d930aa6bed28cde3ecb0580bbe15df8820ca
Instruction Fuzzy Hash: 2BD15A75A00A059FCB11CF68C584BEABBF6FF49300F248A98E4969B355EB74ED01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BC9514 Relevance: 6.2, APIs: 4, Instructions: 248sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,00000000,00BC990A), ref: 00BC9588
ShowWindow.USER32(00000000,00000004,?,00000000,00BC990A), ref: 00BC95D0

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ShowSleepWindow
String ID:
API String ID: 4218995503-0
Opcode ID: 007704b7c4eacc24bb2240342619bf3e1d70fc294bc8c2a760033601bea34b55
Instruction ID: 3e2b6d09a6b89dc9f8e4ae1698fc0cdd4147bdf9ed736d830ffd997c3de3632b
Opcode Fuzzy Hash: 007704b7c4eacc24bb2240342619bf3e1d70fc294bc8c2a760033601bea34b55
Instruction Fuzzy Hash: D4915A70A14245EFEB11DFA8C896FAE77F4EB09710F1144E8F500AB6A2DB75AD40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7844 Relevance: 6.1, APIs: 4, Instructions: 136threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB7C84: WindowFromPoint.USER32(-000000F4,?,?,00BB785E,?,-0000000C,?), ref: 00BB7C8A
Part of subcall function 00BB7C84: GetParent.USER32(00000000), ref: 00BB7CA1

GetWindow.USER32(00000000,00000004), ref: 00BB7866
GetCurrentThreadId.KERNEL32 ref: 00BB793D
EnumThreadWindows.USER32(00000000,00BB77E4,?), ref: 00BB7943
GetWindowRect.USER32(00000000,?), ref: 00BB795A

Part of subcall function 00BB6BA4: GetWindowThreadProcessId.USER32(00000000), ref: 00BB6BB1
Part of subcall function 00BB6BA4: GetCurrentProcessId.KERNEL32(?,00000000,00000000,00BB87C3,?,?,00000000,00000001,00BB87F0), ref: 00BB6BBA
Part of subcall function 00BB6BA4: GlobalFindAtomW.KERNEL32(00000000), ref: 00BB6BCF
Part of subcall function 00BB6BA4: GetPropW.USER32(00000000,00000000), ref: 00BB6BE6

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Thread$CurrentProcess$AtomEnumFindFromGlobalParentPointPropRectWindows
String ID:
API String ID: 349414421-0
Opcode ID: d79a4218ec46b723f08694edfefa6c3a952e4d26744f4d50def08ef2b5827ede
Instruction ID: c1b0be3a4f980317feea65a241811372ceae4e030c2e426240969aa223d8def0
Opcode Fuzzy Hash: d79a4218ec46b723f08694edfefa6c3a952e4d26744f4d50def08ef2b5827ede
Instruction Fuzzy Hash: 3B510930A44205AFCB00DF69C885BEEB7F4AB48304F1045E5E954EB352DB70DE45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B6594C Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00B659FB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00B65A17
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00B65A8E
VariantClear.OLEAUT32(?), ref: 00B65AB7

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 688cfe94023306c05974f56a35ebdeb227dc6cce220f9299d84d9f9acebd2738
Instruction ID: bc82c351da7ba3cedbd65e79915497fcee4170d43f79a62eb5029b939b830abe
Opcode Fuzzy Hash: 688cfe94023306c05974f56a35ebdeb227dc6cce220f9299d84d9f9acebd2738
Instruction Fuzzy Hash: BB41FB75A01A199FCB71DB58CC91BD9B3FCEF49310F4042D5E649A7252DA38AF908F50

Uniqueness

Uniqueness Score: -1.00%

Function 00B6054C Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00B606F8), ref: 00B6057F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00B605A3
GetModuleFileNameW.KERNEL32(00B50000,?,00000105), ref: 00B605BE
LoadStringW.USER32(00000000,0000FFE7,?,00000100), ref: 00B60659

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 47e5bfdda7d715b83f38e3706eee58a707397df34d3ae306ee623c5c484dae8c
Instruction ID: eb39d0c519461a48a815daa48b744395963b4711ead863a2cb916d111331ed9a
Opcode Fuzzy Hash: 47e5bfdda7d715b83f38e3706eee58a707397df34d3ae306ee623c5c484dae8c
Instruction Fuzzy Hash: A8413D70A002589FDB20EF69CC81B9AB7FAEB98301F4040E5E908E7251DB759E95CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B6054A Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00B606F8), ref: 00B6057F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00B605A3
GetModuleFileNameW.KERNEL32(00B50000,?,00000105), ref: 00B605BE
LoadStringW.USER32(00000000,0000FFE7,?,00000100), ref: 00B60659

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 735b1d1b386123a357e183c9998272b6c56f9aaf940f9164710c1181b5f17147
Instruction ID: fd749bfc0b548eb7049152cc4b09ab784eed92caef957f9ba73c24bcc8bd65e1
Opcode Fuzzy Hash: 735b1d1b386123a357e183c9998272b6c56f9aaf940f9164710c1181b5f17147
Instruction Fuzzy Hash: 90414D70A002589FDB20EF69CC81B9AB7FAEB98301F4040E5E908E7251DB759E99CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00BA37AC Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32(00000000), ref: 00BA37F1
GetDC.USER32(00000000), ref: 00BA3846
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BA3850
ReleaseDC.USER32(00000000,00000000), ref: 00BA385B

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CapsDeviceKeyboardLayoutRelease
String ID:
API String ID: 3331096196-0
Opcode ID: a54ca4268c297b62e269f06dbd1f87c002421f1bff650be4725addddcbbc49a8
Instruction ID: 87a6f6f802d0748cde57e6955629821d4438a3ed40a6707bfc27bbbd96b16636
Opcode Fuzzy Hash: a54ca4268c297b62e269f06dbd1f87c002421f1bff650be4725addddcbbc49a8
Instruction Fuzzy Hash: 1A41F5706042409FDB40EF28D8C6B997BE4AB09709F0481E9FD08CF3A6DBB29848CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00B8F790 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B8C0C8: EnterCriticalSection.KERNEL32(00BE7F08,00000000,00B8A492,00000000,00B8A4F1), ref: 00B8C0D0
Part of subcall function 00B8C0C8: LeaveCriticalSection.KERNEL32(00BE7F08,00BE7F08,00000000,00B8A492,00000000,00B8A4F1), ref: 00B8C0DD
Part of subcall function 00B8C0C8: EnterCriticalSection.KERNEL32(0000003C,00BE7F08,00BE7F08,00000000,00B8A492,00000000,00B8A4F1), ref: 00B8C0E6

Part of subcall function 00B91198: GetDC.USER32(00000000), ref: 00B911EE
Part of subcall function 00B91198: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B91203
Part of subcall function 00B91198: GetDeviceCaps.GDI32(00000000,0000000E), ref: 00B9120D
Part of subcall function 00B91198: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00B8F7E3,00000000,00B8F86F), ref: 00B91231
Part of subcall function 00B91198: ReleaseDC.USER32(00000000,00000000), ref: 00B9123C

CreateCompatibleDC.GDI32(00000000), ref: 00B8F7E5
SelectObject.GDI32(00000000,?), ref: 00B8F7FE
SelectPalette.GDI32(00000000,?,000000FF), ref: 00B8F827
RealizePalette.GDI32(00000000), ref: 00B8F833

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: 47cf7b5d5dd78d7d2f05b1fb3860857053ec1df11146e3818e003ce10da9f1ca
Instruction ID: 6603f62fe63922a79c8adc180a56e0bf6318533de5f6f2c48609152968a65a6c
Opcode Fuzzy Hash: 47cf7b5d5dd78d7d2f05b1fb3860857053ec1df11146e3818e003ce10da9f1ca
Instruction Fuzzy Hash: 5031E574A04659EFDB04EB69D981E6DB7F5EF48310B6245E1E804AB332D730EE40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BBE01C Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

IsZoomed.USER32(00000000), ref: 00BBE031
GetParent.USER32(00000000), ref: 00BBE046
GetWindowRect.USER32(00000000,?), ref: 00BBE05F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000016,00000000,?,00000000), ref: 00BBE0CA

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$ParentRectZoomed
String ID:
API String ID: 3993858495-0
Opcode ID: a83f2b4ab59357166d2a5e491fae83f6b5c2197cd1707a44e97f40fce429f4b3
Instruction ID: 99ad74749ca91942ece8f0a0d0d239f6a19e146dfa76622cf5e8d23b55958534
Opcode Fuzzy Hash: a83f2b4ab59357166d2a5e491fae83f6b5c2197cd1707a44e97f40fce429f4b3
Instruction Fuzzy Hash: 5E21CA74610104DFDB20EF5CC882EA9B3F5AF58310B604999FA90E73A5DBB2ED44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BA53D4 Relevance: 6.1, APIs: 4, Instructions: 75threadwindowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000004), ref: 00BA53E4
GetWindowThreadProcessId.USER32(?,?), ref: 00BA5401
GetCurrentProcessId.KERNEL32(?,00000004), ref: 00BA540D
IsWindowVisible.USER32(?), ref: 00BA5463

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Process$CurrentThreadVisible
String ID:
API String ID: 3926708836-0
Opcode ID: ab46668f9b54683ec6db85a79d73cf8dd98eb0fefd92a4b36dbdfc2cf1114c17
Instruction ID: e91bc2317418d8510f366b9033e585457011b4fad2b919d1ce65ccbd1c45983c
Opcode Fuzzy Hash: ab46668f9b54683ec6db85a79d73cf8dd98eb0fefd92a4b36dbdfc2cf1114c17
Instruction Fuzzy Hash: B7216231204E409FD750EB68DAC1EAA73F6EB09321F5501F1EA08DB396CF34AD498B61

Uniqueness

Uniqueness Score: -1.00%

Function 00BAF3DC Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetMenuState.USER32(?,?,?), ref: 00BAF3FF
GetSubMenu.USER32(?,?), ref: 00BAF40A
GetMenuItemID.USER32(?,?), ref: 00BAF423
GetMenuStringW.USER32(?,?,?,?,?), ref: 00BAF478

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Menu$ItemStateString
String ID:
API String ID: 306270399-0
Opcode ID: 763ab7c44be626f8c9db593f5923548da99bac0fa8e4c96b9849dfe473163485
Instruction ID: ebb64eec1e55d48f0541faad4adb68722c0bbe78a203d62c97b8f0311fa05603
Opcode Fuzzy Hash: 763ab7c44be626f8c9db593f5923548da99bac0fa8e4c96b9849dfe473163485
Instruction Fuzzy Hash: 89116A31605218AF8B40EEACD881ABF77F8EF5A360B1444B9FC19DB391DA30DD059760

Uniqueness

Uniqueness Score: -1.00%

Function 00BD2470 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00BD2496
SelectObject.GDI32(00000000), ref: 00BD249F

Part of subcall function 00BD3884: SetStretchBltMode.GDI32(00BD24D0,00000003), ref: 00BD38B3

SelectObject.GDI32(00000000,00000000), ref: 00BD24D5
DeleteDC.GDI32(00000000), ref: 00BD24DB

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDeleteModeStretch
String ID:
API String ID: 386942-0
Opcode ID: fa82165de608dea53207c57c765dae6e6bed12200243bd61bd3306455826cd5b
Instruction ID: 6015ca41068d7cc5a4bb956657d8dca03a15819bc1684994fefdd4cf787e8754
Opcode Fuzzy Hash: fa82165de608dea53207c57c765dae6e6bed12200243bd61bd3306455826cd5b
Instruction Fuzzy Hash: E001C47250015D6B8B41DEA98C41DEFBBED9E4A221F040092FD08F7201D5759E0487F1

Uniqueness

Uniqueness Score: -1.00%

Function 00B92774 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 00B92795
GetObjectW.GDI32(?,00000018,?), ref: 00B927B6
DeleteObject.GDI32(?), ref: 00B927E2
DeleteObject.GDI32(?), ref: 00B927EB

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: b984ef14a12ff8852abe1ad38cec6fce120a34817d6ce96c8f30d5ad45f38cc6
Instruction ID: 56d69f6ed8a417acb1da909a7562b3dfd51e6200aa32d94652bee3d25deeca38
Opcode Fuzzy Hash: b984ef14a12ff8852abe1ad38cec6fce120a34817d6ce96c8f30d5ad45f38cc6
Instruction Fuzzy Hash: DF111875E04208AFDF04DFE9C9819AEB7F9EB88310B6484E5FD04E7751DA34EE059A50

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2570 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?), ref: 00BC2588
MulDiv.KERNEL32(?), ref: 00BC25A2
MulDiv.KERNEL32(?), ref: 00BC25BF
MulDiv.KERNEL32(?), ref: 00BC25DC

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fc2640a6c9bd9736bf65b13d4d492e8cd65202b96d6c59ecaf6f28c3bb41e3
Instruction ID: 30c71bcbea5704aff50a7dce3e3f4d8184aae160f4b58012b1ae808c7c7f5899
Opcode Fuzzy Hash: 29fc2640a6c9bd9736bf65b13d4d492e8cd65202b96d6c59ecaf6f28c3bb41e3
Instruction Fuzzy Hash: A901D6243012582B8664BA3A5C59F5B3ADDDBDA751F1040FC7C299B307EE65DD148264

Uniqueness

Uniqueness Score: -1.00%

Function 00BA5208 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnumWindows.USER32(Function_00055154), ref: 00BA5235
GetWindow.USER32(?,00000003), ref: 00BA524D
GetWindowLongW.USER32(00000000,000000EC), ref: 00BA525A
SetWindowPos.USER32(00000000,000000EC,00000000,00000000,00000000,00000000,00000213,00000000,000000EC,?,00000003,Function_00055154), ref: 00BA5299

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: 7ecb27bcd9a5bc837a0c622c05d84686b92e2ce9286798aaffa5d125fd4fdba5
Instruction ID: 5e8710a3cfbbfd47e6a9dad0d3c1aca89d3e37adcd44471021fef0b8c84f1bb3
Opcode Fuzzy Hash: 7ecb27bcd9a5bc837a0c622c05d84686b92e2ce9286798aaffa5d125fd4fdba5
Instruction Fuzzy Hash: 75112E316087109FEB20AA68CC85F9572E4EF55721F1441E4FA98EF2D2C7709D448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB9D98 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000000,00000000), ref: 00BB9DAD
MulDiv.KERNEL32(?,00000000,00000000), ref: 00BB9DCA
MulDiv.KERNEL32(?,00000000,00000000), ref: 00BB9DE7
MulDiv.KERNEL32(?,00000000,00000000), ref: 00BB9E04

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66bc59204ffba7ca094aa6f80266b3ca93293beb4e1c068bbde4d6a21dcae848
Instruction ID: bf296579d901d2c5597aa0f706bf66ca68e5167ebee1421b014b16b7a77f6563
Opcode Fuzzy Hash: 66bc59204ffba7ca094aa6f80266b3ca93293beb4e1c068bbde4d6a21dcae848
Instruction Fuzzy Hash: B201D6247002182BC764BA3A5C85FAB3A9EDFCA711F1044F8791A9B307EDA9DC14C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00BA7270 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00BA7284
GetWindowLongW.USER32(?,000000EC), ref: 00BA72C6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00BA72D7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,C31852FF,?,-00000001,00000000,?,00BA7391,?,?,?,00000000), ref: 00BA72FF

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Window$Long$Visible
String ID:
API String ID: 2967648141-0
Opcode ID: 033de7feae188332d3a3599620fbdb470edb996ec63ebc6cd94f56511a5c868f
Instruction ID: 05e3123a31965707131c056935524b729b2ac25d2064b6775284b47e13a33e26
Opcode Fuzzy Hash: 033de7feae188332d3a3599620fbdb470edb996ec63ebc6cd94f56511a5c868f
Instruction Fuzzy Hash: 2E118431159294AFDB01DB6CDC88FB97BE8EB0A311F9405D1F848CB2A2CA319DC5C754

Uniqueness

Uniqueness Score: -1.00%

Function 00B6F054 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,00B69B68,?,00000001,00000000,?,00B6EF96,00000000,?,?,?,?,?,00B6B4F1), ref: 00B6F06B
LoadResource.KERNEL32(?,00B6F0F0,?,?,?,00B69B68,?,00000001,00000000,?,00B6EF96,00000000,?), ref: 00B6F085
SizeofResource.KERNEL32(?,00B6F0F0,?,00B6F0F0,?,?,?,00B69B68,?,00000001,00000000,?,00B6EF96,00000000,?), ref: 00B6F09F
LockResource.KERNEL32(00B6ED28,00000000,?,00B6F0F0,?,00B6F0F0,?,?,?,00B69B68,?,00000001,00000000,?,00B6EF96,00000000), ref: 00B6F0A9

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 492f5f4542f09671089480d7f13d143b18b93402ea3595912ad67f44744f4f1f
Instruction ID: 72c21a054bb2a0327e48e1c236a9106dca8a98abe53c7de42ce893e7c6777bbd
Opcode Fuzzy Hash: 492f5f4542f09671089480d7f13d143b18b93402ea3595912ad67f44744f4f1f
Instruction Fuzzy Hash: A7F08CB76052046F6B44EE6CA881E6B73ECEE8836032000EAFD18D7302EE34DD018775

Uniqueness

Uniqueness Score: -1.00%

Function 00B61266 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00BE5CB8,00000001,00000000), ref: 00B61281
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00BE5CB8,00000001,00000000), ref: 00B61298
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B612B7
ResetEvent.KERNEL32(00000000), ref: 00B612BF

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Event$Create$CompareExchangeInterlockedReset
String ID:
API String ID: 2790937731-0
Opcode ID: 8391166bb3ace09fd63412dcb257aa948342ddcc9aa860aa7ccf86535f00ece8
Instruction ID: 5942990035c5317eb1b3563311cdbc3aa101a40f57f29fb5886d8e2705647b79
Opcode Fuzzy Hash: 8391166bb3ace09fd63412dcb257aa948342ddcc9aa860aa7ccf86535f00ece8
Instruction Fuzzy Hash: FFF08231781300BAFF311A199C93B2611D5CBD1B62F2844E5FF04FE1C1EAB8EC048269

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7C24 Relevance: 6.0, APIs: 4, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00BB7C31
GetCurrentProcessId.KERNEL32(00000000,?,?,00000000,00000000,00BB7C9C,-000000F4,?,?,00BB785E,?,-0000000C,?), ref: 00BB7C3A
GlobalFindAtomW.KERNEL32(00000000), ref: 00BB7C4F
GetPropW.USER32(00000000,00000000), ref: 00BB7C66

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: ddd95c9e05908d6690c06440164e2b244f17769b072ea33dd62d1c4d87452fef
Instruction ID: 4ae58797f754b4d88b6a6957d74d7ca33d570c9bfde85aafdd26362851e44b77
Opcode Fuzzy Hash: ddd95c9e05908d6690c06440164e2b244f17769b072ea33dd62d1c4d87452fef
Instruction Fuzzy Hash: 02F0A05224A6211B563077B95C82AFF17ECCE44392B2500F9FC40E6061DF64CC4691A7

Uniqueness

Uniqueness Score: -1.00%

Function 00BA48E4 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BA48FC
SetWindowsHookExW.USER32(00000003,00BA48A0,00000000,00000000), ref: 00BA490C
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00BA7BE3), ref: 00BA4927
CreateThread.KERNEL32(00000000,000003E8,00BA4844,00000000,00000000), ref: 00BA494C

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: CreateThread$CurrentEventHookWindows
String ID:
API String ID: 1195359707-0
Opcode ID: cb270df12b4c72e74acfdd74fa9117dfeb6f40a22a6749f88ff8905caeb00eef
Instruction ID: 032cbb0ded6a147fbbc917b3bcb83f4c620b4827bd181454a8c88c87c4fd6a08
Opcode Fuzzy Hash: cb270df12b4c72e74acfdd74fa9117dfeb6f40a22a6749f88ff8905caeb00eef
Instruction Fuzzy Hash: 08F01D70684780AEFB50DB54AC87F2732D8E351712F104099F6086F0D2DFB0584C8B19

Uniqueness

Uniqueness Score: -1.00%

Function 00BB6BA4 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00BB6BB1
GetCurrentProcessId.KERNEL32(?,00000000,00000000,00BB87C3,?,?,00000000,00000001,00BB87F0), ref: 00BB6BBA
GlobalFindAtomW.KERNEL32(00000000), ref: 00BB6BCF
GetPropW.USER32(00000000,00000000), ref: 00BB6BE6

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: a71d347745b7d1256d170b501d20c23ef61abaf032f991a88fd4830511e8a753
Instruction ID: 9e738f04ba5acdb524d05a6759ca83521c8118c833333a341da9570bd0e2de07
Opcode Fuzzy Hash: a71d347745b7d1256d170b501d20c23ef61abaf032f991a88fd4830511e8a753
Instruction Fuzzy Hash: 8DF03052200661678A3077B99CC3ABA23FCCA187E270544F5BD05EB162DD68CC468371

Uniqueness

Uniqueness Score: -1.00%

Function 00BDB01C Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000000,00000060), ref: 00BDB070

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ec468983c9405e913787c29a97e7885189f6bb3ce78113d8e1fbc210bac9b3
Instruction ID: ccfa305f2f68e8a52ad12fc6d3fa24ca7453c43d0f3a14a387dffbdc3e1c1d16
Opcode Fuzzy Hash: 68ec468983c9405e913787c29a97e7885189f6bb3ce78113d8e1fbc210bac9b3
Instruction Fuzzy Hash: 8AF01231641A80EBD2A0EB18EDC5F6673E8EB4A742F0100D6F704AF3A1DF605C05CA22

Uniqueness

Uniqueness Score: -1.00%

Function 00B92910 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B92919
SelectObject.GDI32(00000000,058A00B4), ref: 00B9292B
GetTextMetricsW.GDI32(00000000), ref: 00B92936
ReleaseDC.USER32(00000000,00000000), ref: 00B92947

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 2dfdc5a813821a0c117de8555e8b0cdfe5d673bc74f90a94bc760e6c57fe382f
Instruction ID: 82221a006da086cac7a9f5a3f00d188e27831025539cb9cf8092079a4e64416a
Opcode Fuzzy Hash: 2dfdc5a813821a0c117de8555e8b0cdfe5d673bc74f90a94bc760e6c57fe382f
Instruction Fuzzy Hash: 79E04F11A476B136DD51A2750C82BEB25CCCF022B6F0811F1FD44AA2A1DE05CD0982F2

Uniqueness

Uniqueness Score: -1.00%

Function 00B9B1F4 Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00B9B1FA
EnumWindows.USER32(Function_0004B1BC), ref: 00B9B213
GetCurrentThreadId.KERNEL32 ref: 00B9B222
EnumThreadWindows.USER32(00000000,Function_0004B19C), ref: 00B9B228

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: EnumThreadWindows$ActiveCurrentWindow
String ID:
API String ID: 1202916826-0
Opcode ID: b3fa94be34b93a6cdd90651739b89096589a7f58cf8ff9b5865044c2bc47caed
Instruction ID: 00eac3ffcf81b65f4df2d6333d4424a6ec0e3ac52fb35deb1aa6d2a3ebde83cd
Opcode Fuzzy Hash: b3fa94be34b93a6cdd90651739b89096589a7f58cf8ff9b5865044c2bc47caed
Instruction Fuzzy Hash: ECE0869024A3902ADA0473B42A53B3D39C8CA43762F1445E9FCD4E71D2DA6548086232

Uniqueness

Uniqueness Score: -1.00%

Function 00B529CC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,00B51548,00002010), ref: 00B52DA1

Strings

7, xrefs: 00B52B44
, xrefs: 00B52CDA

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: Message
String ID: $7
API String ID: 2030045667-2388253531
Opcode ID: 369f466e2535236a08e2c4426ed52654d4820e2bfe7277e975aec4f30c9ff4e0
Instruction ID: 542c133a02c6f857ae6a7e6de22f710fcb3932d0340de9500321467c160d064b
Opcode Fuzzy Hash: 369f466e2535236a08e2c4426ed52654d4820e2bfe7277e975aec4f30c9ff4e0
Instruction Fuzzy Hash: BAB1A130A062948FDB21EB2CC8D0B98B7E4EB1A741F1441F5E849DB356EBB49D89CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B5E000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00B5E0FD), ref: 00B5E094
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00B5E0FD), ref: 00B5E09A

Strings

, xrefs: 00B5E060

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID:
API String ID: 3303714858-3916222277
Opcode ID: b77430fbf5db379191e9c21073cdac61616fcb7d24071a64f651a8f9800c74ab
Instruction ID: 02259a3622dc07329e22b0aa184841302e4e13bd0927942eef08ddf9f4b11799
Opcode Fuzzy Hash: b77430fbf5db379191e9c21073cdac61616fcb7d24071a64f651a8f9800c74ab
Instruction Fuzzy Hash: E421A231A046589FDB15DF64C896BADB7F4EF09302F4940E6FC44E7291D6709E48C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B941D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 00B94222
GetSystemMetrics.USER32(00000001), ref: 00B94234

Part of subcall function 00B93EC8: GetProcAddress.KERNEL32(75BD0000,00000000), ref: 00B93F64

Strings

MonitorFromPoint, xrefs: 00B941E6

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromPoint
API String ID: 1792783759-1072306578
Opcode ID: ba45f2885429ecdb54ba7d54b9c444615aec00315138a35611177b58c9894a66
Instruction ID: ce78fc2f75fcf2607120a7b29cf9887d39223b419eb759504e14c5f707a60dce
Opcode Fuzzy Hash: ba45f2885429ecdb54ba7d54b9c444615aec00315138a35611177b58c9894a66
Instruction Fuzzy Hash: 1301D132200558AFDF208F95EC84F9ABBE5FB40764F008475F9189F252CB709D469BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00B94084 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 00B940D5
GetSystemMetrics.USER32(00000001), ref: 00B940E1

Part of subcall function 00B93EC8: GetProcAddress.KERNEL32(75BD0000,00000000), ref: 00B93F64

Strings

MonitorFromRect, xrefs: 00B94099

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromRect
API String ID: 1792783759-4033241945
Opcode ID: badff7dc88ec8bc968ef843ea43f9417a17f8b7299fea588536326e8da29574b
Instruction ID: a2cdaf80d56686a657acc38b7cffc9d44ded59cb60d1efb14f1cbdb43c688279
Opcode Fuzzy Hash: badff7dc88ec8bc968ef843ea43f9417a17f8b7299fea588536326e8da29574b
Instruction Fuzzy Hash: F5018B326006549BDF208B54D8C5F15BBA8EB413A5F2440F5FA08DF243CF709C8A9BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00B94740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(DWMAPI.DLL,?,?,?,00BA2FAD), ref: 00B9476A

Strings

DwmExtendFrameIntoClientArea, xrefs: 00B94782
DWMAPI.DLL, xrefs: 00B94765

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: LibraryLoad
String ID: DWMAPI.DLL$DwmExtendFrameIntoClientArea
API String ID: 1029625771-2956373744
Opcode ID: 82c4e3d51b572aea13633fecfe5689d13c857abad4b1c6278f4ec0c0f682a0cd
Instruction ID: 9d37908dca0725a45e31fdd8a4d260c523951e613fd76271a512bc305971e92b
Opcode Fuzzy Hash: 82c4e3d51b572aea13633fecfe5689d13c857abad4b1c6278f4ec0c0f682a0cd
Instruction Fuzzy Hash: DDF09630240994DFDB609BA5ECC8F4636D8D74A306F1005B5E50DAB162CF7C0C8DCB21

Uniqueness

Uniqueness Score: -1.00%

Function 00BAE9D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 00BAE9F3
GetKeyState.USER32(00000011), ref: 00BAEA04

Strings

, xrefs: 00BAEA13

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-3916222277
Opcode ID: 5aa25ab758b455b4f825cff33b5522c257e8b4d4a42736178dfc993d09ffed06
Instruction ID: b9c30cb7e13302eeb6f92c3e6036c20b7065459759b2b273a54e3011574adf07
Opcode Fuzzy Hash: 5aa25ab758b455b4f825cff33b5522c257e8b4d4a42736178dfc993d09ffed06
Instruction Fuzzy Hash: D6E0682670878512E72278685C013E717C49F533B5F0902E7FEE03A0C3E5864D1551B1

Uniqueness

Uniqueness Score: -1.00%

Function 00B94804 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(DWMAPI.DLL,?,?,00B948CA,?,00BA2EEB), ref: 00B9482A

Strings

DwmIsCompositionEnabled, xrefs: 00B94842
DWMAPI.DLL, xrefs: 00B94825

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: LibraryLoad
String ID: DWMAPI.DLL$DwmIsCompositionEnabled
API String ID: 1029625771-2128843254
Opcode ID: 66b9f6c40d9c6393981210bdb210411cd4d38cba0817caa2919cab94c155e5b6
Instruction ID: 20c0f7353a524c016494c30a19c58853ef2b584de9289b8bece2fd3067f187d9
Opcode Fuzzy Hash: 66b9f6c40d9c6393981210bdb210411cd4d38cba0817caa2919cab94c155e5b6
Instruction Fuzzy Hash: 02F0F874641AD09FDB60AB64ECC8B5937D8E709306F100DB5E50DAB2A2DF78098ECB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B62BF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00BDE128,00000000,00BDE13B), ref: 00B62BFE

Part of subcall function 00B58708: GetProcAddress.KERNEL32(?,?), ref: 00B5872C

Strings

GetDiskFreeSpaceExW, xrefs: 00B62C09
kernel32.dll, xrefs: 00B62BF9

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: 4f2084850288098899a4b9de31cd7b8308316b3696aed393a5754646522ba689
Instruction ID: bf0260d132eae95f38c1ac502fce7260f537cb3d27f1a1b1ae2e7d2abf4cd1e2
Opcode Fuzzy Hash: 4f2084850288098899a4b9de31cd7b8308316b3696aed393a5754646522ba689
Instruction Fuzzy Hash: 1CD09E61A17746AEE7016BF85DB673A66D8D745306B0014F6A40176172EE7CC948C714

Uniqueness

Uniqueness Score: -1.00%

Function 00B75558 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ole32.dll,?,00B755F2), ref: 00B7555E

Part of subcall function 00B58708: GetProcAddress.KERNEL32(?,?), ref: 00B5872C

Strings

ole32.dll, xrefs: 00B75559
CoWaitForMultipleHandles, xrefs: 00B75569

Memory Dump Source

Source File: 00000035.00000002.2557506356.0000000000B51000.00000020.00000001.01000000.0000001D.sdmp, Offset: 00B50000, based on PE: true

Associated: 00000035.00000002.2557468569.0000000000B50000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557824934.0000000000BDF000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557880940.0000000000BE7000.00000004.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557924477.0000000000BEB000.00000008.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000BED000.00000002.00000001.01000000.0000001D.sdmpDownload File
Associated: 00000035.00000002.2557957428.0000000000C05000.00000002.00000001.01000000.0000001D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_b50000_WSHelper.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CoWaitForMultipleHandles$ole32.dll
API String ID: 1646373207-2593175619
Opcode ID: 0c7f5d5fb86b4edad1e9c13d9d94feb97d8adf1e64f03dfb522e9c613c40031b
Instruction ID: fc154aef1abe0bc67390a6cc28a9ebe75e1dfe3fe2fe3e9c9bac343c4e7d9c8c
Opcode Fuzzy Hash: 0c7f5d5fb86b4edad1e9c13d9d94feb97d8adf1e64f03dfb522e9c613c40031b
Instruction Fuzzy Hash: 21D0C7A5544B81DED7305BB06CC672A26DEA724305F8085D5E4242F161EFF58D84C710

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report free-youtube-downloader_setup_full384.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Cryptography

Privilege Escalation

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll (copy)

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSProducstInfo.dll (copy)

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll (copy)

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\KPByName.dll (copy)

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Languages\English.dat (copy)

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Languages\is-R7B0L.tmp

Windows Analysis Report
free-youtube-downloader_setup_full384.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre